Security Bulletin:Pallets Click 8.3.2 Command Injection Vulnerability

Summary Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit function, allowing attackers to pass arbitrary OS commands from an unprivileged account. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2 and below,...

Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.

Summary There are vulnerabilities in the jackson-databind jar used by IBM APM Linux KVM Agent for Virtual Environments. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-59879, CVE-2026-59880)

Summary IBM Tivoli Netcool/OMNIbus WebGUI includes the Immutable.js library for persistent immutable data structures used in the client-side UI. Vulnerabilities have been identified in this library that could affect the product. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...

Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.4 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C wrapper implementation contains a heap...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14512, CVE-2026-14528)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14446)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14529)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM QRadar SIEM is vulnerable to remote code execution by privileged users

Summary An authenticated QRadar SIEM administrator can execute arbitrary commands on the QRadar host due to improper validation of user supplied input. Vulnerability Details CVEID:CVE-2026-13477 DESCRIPTION: QRadar could allow an authenticated privileged user to execute arbitrary commands with...

Security Bulletin: IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability

Summary IBM QRadar has an XML External Entity XXE injection vulnerability. This vulnerability is not exploitable in all configurations. All of the following conditions must be simultaneously true for a system to be at risk: 1 XML Property Autodetection must be actively enabled on at least one log...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jackson-databind-2.22.0.jar, postgresql-42.7.11.jar, kafka-clients-3.9.1.jar which is vulnerable to CVE-2025-11143, CVE-2026-59889, CVE-2026-54291,CVE-2026-33558. This bulletin contains information regarding the...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses HdrHistogram-2.1.12.jar which is vulnerable to CVE-2026-14683, CVE-2026-14684, CVE-2026-14685, CVE-2026-14686. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-14683...

Security Bulletin: Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities.

Summary Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, and CVE-2026-59889. To address these vulnerabilities, the webMethods...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra Reaper 4.0

Summary IBM Sterling Global Availability Mailbox uses Cassandra Reaper 4.0, which is affected by privilege escalation CVE-2026-27314 and resource consumption CVE-2026-32588 vulnerabilities. Vulnerability Details CVEID:CVE-2026-27314 DESCRIPTION: Privilege escalation in Apache Cassandra 5.0 on an...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra 4.0

Summary Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8....

Security Bulletin: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

Summary IBM Maximo Application Suite uses axios-1.15.2.tgz, protobufjs-8.0.1.tgz, protobufjs-8.2.0.tgz and undici-7.26.0.tgz which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679, CVE-2026-9697, CVE-2026-54270, CVE-2026-45740,...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses spring-security-core-6.5.10.jar, form-data-4.0.5.tgz, ws-8.20.1.tgz, pythonmultipart-0.0.27-py3-none-any.whl, starlette-1.2.1-py3-none-any.whl, httpcore5-5.3.6.jar, httpcore5-h2-5.3.6.jar, mlflow-3.13.0-py3-none-any.whl, js-yaml-4.2.0.tgz and tar-7.5.16.tgz which ar...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-33814

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-33814. This bulletin contains information regarding the vulnerability and its remediation Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses undici which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-9679

Summary IBM Maximo Application Suite - Visual Inspection component uses undici which is vulnerable to CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-9679, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-11525...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs

Summary IBM Maximo Application Suite - Predict Component uses aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-22815, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses click-8.3.1-py3-none-any.whl,aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-7246, CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229,...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library.(CVE-2026-33870).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow attacker to exploit the parsing flaw to craft requests that are interpreted differently by intermediaries and backend servers, resulting in HTTP request smuggling and...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec library that could allow a remote attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. (CVE-2026-42583).

Summary IBM Storage Protect Server uses the netty-codec library in certain components. A vulnerability in netty could allow an attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. By providing a small malicious payload that advertises a large...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could lead to HTTP request smuggling, desynchronization, or RTSP request injection.(CVE-2026-41417).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow an attacker to inject malicious CRLF sequences into request URIs, resulting in HTTP request smuggling, protocol desynchronization, and the execution of unintended HTTP ...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pacote which is vulnerable to CVE-2026-9496

Summary IBM Maximo Application Suite - Visual Inspection component uses pacote which is vulnerable to CVE-2026-9496, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-9496 DESCRIPTION: Versions of the package pacote from 11.2....

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Torch - 2.3.1+cu121 which is vulnerable to CVE-2025-32434

Summary IBM Maximo Application Suite - Visual Inspection component uses Torch - 2.3.1+cu121 which is vulnerable to CVE-2025-32434 ,This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-32434 DESCRIPTION: PyTorch is a Python packag...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse jetty-ee10-jaspi library that could cause broken access controls, potentially allowing unauthorized access or privilege escalation. (CVE-2026-5795).

Summary IBM Storage Protect Server uses the Eclipse jetty-ee10-jaspi library in certain components. A vulnerability in Jetty could cause authentication context being retained in ThreadLocal variables and inadvertently reused by subsequent requests processed on the same thread. This can lead to...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could allow remote attacker to send a large number of specially crafted frames, causing excessive CPU consumption (CVE-2026-33871).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow remote attacker to send a large number of specially crafted CONTINUATION frames, causing excessive CPU consumption and rendering the server unresponsive. The issue aris...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920, CVE-2026-4372

Summary IBM Maximo Application Suite - Visual Inspection component uses transformers which is vulnerable to CVE-2026-1839,CVE-2025-14920,CVE-2026-4372. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-14920 DESCRIPTION: Huggi...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses brace-expansion which is vulnerable to CVE-2026-13149

Summary IBM Maximo Application Suite - Visual Inspection component uses brace-expansion which is vulnerable to CVE-2026-13149, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 ...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses form-data which is vulnerable to CVE-2026-12143

Summary IBM Maximo Application Suite - Visual Inspection component uses form-data which is vulnerable to CVE-2026-12143, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to multiple vulnerabilities

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/crypto-v0.45.0 which is vulnerable to CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506, This bulletin contains information regarding the vulnerability an...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-44249)

Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...

Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-47244, CVE-2026-48043)

Summary There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-47244 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs

Summary There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs mentioned below. Vulnerability Details CVEID:CVE-2026-48712 DESCRIPTION: protobuf...

Security Bulletin: There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50020)

Summary There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50560)

Summary There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50560 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a privilege escalation

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a privilege escalation CVE-2026-14446 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50010)

Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50010 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server Liberty is affected by a security bypass issue (CVE-2026-5516)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is affected by a security bypass issue. This issue has been addressed in this release. Vulnerability...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service (DoS) flaw (CVE-2024-26308, CVE-2024-25710)

Summary IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service DoS flaw. All those libraries have been upgraded and this issue has been addressed in this release. Vulnerability Details CVEID:CVE-2024-26308...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-4410)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service. This issue has been addressed i...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes ( CVE-2026-34478)

Summary IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. This issue has been fixed in this release by incorporating the Apache...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server Liberty is affected by a denial of service in glassfish jsonp (CVE-2025-36097)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is affected by a denial of service in glassfish jsonp. This issue has been addressed in this release...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses WebSphere Application Server Liberty, which is vulnerable to cross-site scripting (CVE-2025-12635)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is vulnerable to cross-site scripting. This issue has been addressed in this release. Vulnerability...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments incorporates Oracle's January 2026 Critical Patch Update (CPU) to fix multiple security vulnerabilities (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary IBM Storage Protect Data Protection for Virtual Environments incoprporates the security fixes related to Oracle's January 2026 Critical Patch Update CPU. The IBM SDK, Java Technology Edition Critical Patch Update CPU bundles several security updates from Oracle to address multiple...