38351 matches found
Security Bulletin: This Power System update is being released to address CVE-2026-18848
Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resultin...
Security Bulletin: This Power System update is being released to address CVE-2026-16938
Summary Power Systems Firmware is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain...
Security Bulletin: This Power System update is being released to address CVE-2026-16832
Summary Power Systems Firmware is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity...
Security Bulletin: This Power System update is being released to address CVE-2026-16835
Summary Power Systems Firmware is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state,...
Security Bulletin: This Power System update is being released to address CVE-2026-16687
Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentialit...
Security Bulletin: This Power System update is being released to address CVE-2026-18849
Summary Power Systems Firmware is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact...
Security Bulletin: This Power System update is being released to address CVE-2026-17414
Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions where OS secure...
Security Bulletin: This Power System update is being released to address CVE-2026-17028
Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and...
Security Bulletin: This Power System update is being released to address CVE-2026-18821
Summary Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and...
Security Bulletin: This Power System update is being released to address CVE-2026-17097
Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL ...
Security Bulletin: This Power System update is being released to address CVE-2026-17091
Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a...
Security Bulletin: This Power System update is being released to address CVE-2026-52943, CVE-2026-43373, and CVE-2026-43194
Summary An unauthenticated attacker on the FSP's local network can cause loss of service. Vulnerability Details CVEID:CVE-2026-52943 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskbcarve helpers...
Security Bulletin: This Power System update is being released to address CVE-2026-45447
Summary An authenticated administrator user uploading a specially crafted certificate to the FSP can lead to loss of integrity or remote code execution. Vulnerability Details CVEID:CVE-2026-45447 DESCRIPTION: Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a...
Security Bulletin: This Power System update is being released to address CVE-2026-15961
Summary IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings. Vulnerability Details CVEID:CVE-2026-15961 DESCRIPTION: IBM PowerVM could allow a local attacker to obtain sensitive information or cause a deni...
Security Bulletin: This Power System update is being released to address CVE-2026-4936
Summary PowerVM Platform KeyStore PKS and virtual TPM use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data. Vulnerability Details...
Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-10051, CVE-2026-6790, CVE-2026-8384, CVE-2026-10050, CVE-2026-59879, CVE-2026-59880)
Summary IBM Rational Developer for i is affected by a sensitive information exposure vulnerability in Eclipse Jetty-server CVE-2026-10051, an improper input validation vulnerability in Eclipse Jetty-server CVE-2026-6790, an authorization decision vulnerability in Eclipse Jetty-util CVE-2026-8384,...
Security Bulletin: The Log Source Management App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Log Source Management App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION:...
Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION:...
Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel ...
Security Bulletin: Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
Summary The POST /api/v2/registration/ endpoint in affected versions lacked authentication requirements, allowing unauthenticated attackers to overwrite the server's registered admin email address and trigger outbound telemetry calls to external servers, enabling the Langflow instance to be abuse...
Security Bulletin: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (CVE-2026-1014)
Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2026-1014 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON server respon...
Security Bulletin: Multiple Vulnerabilities in IBM Bob
Summary Multiple vulnerabilities were addressed in IBM Bob V 2.0.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779. CWE:CWE-770: Allocation of Resources Without Limi...
Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint
Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...
Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Jackson Data Binding, Jackson Core, Postgresql, Scram Client, Apache MINA SSHD, Jansi Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0. Vulnerability Details CVEID:CVE-2025-47273 DESCRIPTION: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability ...
Security Bulletin: IBM Engineering Test Management product using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by uncontrolled resource consumption and denial of service CVE-2026-50645, CVE-2026-9322, CVE-2026-9171. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)
Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...
Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1,...
Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability (CVE-2026-11806)
Summary IBM WebSphere Application Server Liberty is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...
Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-4410)
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service CVE-2026-4410 caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. This affects...
Security Bulletin: IBM Transformation Extender Advanced is affected by IBM WebSphere Application Server Liberty vulnerabilities
Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine uses WebSphere Application Server Liberty which is affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Host Servers
Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17223, CVE-2026-17206, CVE-2026-17208, CVE-2026-16929, CVE-2026-17004, CVE-2026-18846, CVE-2026-17197, CVE-2026-17217, CVE-2026-17199, CVE-2026-17229, CVE-2026-16982 in host servers, and a buffer overflow CVE-2026-17220 in host,...
Security Bulletin: Multiple vulnerabilities within WebSphere Application Server and WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.
Summary Multiple vulnerabilities within WebSphere Application Server and KCCI WebSphere Liberty Server which are included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-8408 DESCRIPTION: IBM WebSphere Application Server is affected by ...
Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath
Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...
Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition shipped with IBM Tivoli Monitoring.
Summary Multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. CVE-2026-41254, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027, CVE-2026-47021, CVE-2026-47059,...
Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now addressed in 5.2.3.9 or higher and 6.0.1.1 or higher
Summary The following vulnerabilities, which can affect IBM Storage Scale and the HDFS layer and could provide weaker-than-expected security, are now addressed in Storage Scale 5.2.3.9 or higher and 6.0.1.1 or higher. CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585,...
Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now addressed in 5.2.3.8 or higher and 6.0.1.1 or higher
Summary The following vulnerabilities, which can affect IBM Storage Scale and the HDFS layer and could provide weaker-than-expected security, are now addressed in Storage Scale 5.2.3.8 or higher and 6.0.1.1 or higher. CVE-2026-33558, CVE-2026-2332, CVE-2026-33870, CVE-2025-11143 Vulnerability...
Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition
Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their July 2026 Critical Patch Update. For more information please refer to Oracle's July 2026 CPU Advisory and the CVE links referenced below. Vulnerability Details...
Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.
Summary TSSC/IMC addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2026-22007 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE...
Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution
Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...
Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache Kerby
Summary IBM SPSS Modeler is affected by vulnerabilities in Apache Kerby. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-57914 DESCRIPTION: By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a...
Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities
Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION:...
Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in Jackson-core library
Summary IBM Engineering Systems Design Rhapsody was affected by Vulnerability in Jackson-core library, The non-blocking async JSON parser in jackson-core bypasses the maxNumberLength constraint default: 1000 characters defined in StreamReadConstraints. Vulnerability has been mitigated and...
Security Bulletin:Vulnerability in decode-uri affects IBM Netezza Appliance
Summary The decode-uri package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-45822 Vulnerability Details CVEID:CVE-2026-45822 DESCRIPTION: decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode function splits input on...
Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.24 IF3 Vulnerability Details CVEID:CVE-2026-15043 DESCRIPTION: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = and = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQ...
Security Bulletin: Vulnerability in fast-uri affects IBM Netezza Appliance
Summary The fast-uri package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-6321 Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its...
Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access Digital Credentials (CVE-2026-16221)
Summary Security vulnerability has been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal...
Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench
Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.1 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By...
Security Bulletin: Vulnerability in netty affects IBM Netezza Appliance
Summary The netty package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-42579, CVE-2026-42578 Vulnerability Details CVEID:CVE-2026-42579 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final an...
Security Bulletin:Incorrect Authorization Vulnerability: Unauthenticated Access to CGI Scripts Protected by Directory Rules via script_alias in Erlang OTP (inets modules)
Summary Incorrect Authorization vulnerability in Erlang OTP inets modules allows unauthenticated access to CGI scripts protected by directory rules when served via scriptalias. When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access control...