37185 matches found
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Software have been addressed in security patch ina-release-callhomeimage-1.0.2.3. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in security patch INA-release-9.6.26.08.SP03. Vulnerability Details CVEID:CVE-2026-27448 DESCRIPTION: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, i...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses httpclient5-5.6.2.jar, aiohttp-3.13.4-cp311-cp311-manylinux2014x8664.manylinux217x8664.manylinux228x8664.whl, ip-address-10.2.0.tgz, datasets-3.6.0-py3-none-any.whl, jackson-databind-2.21.4.jar, keras-3.13.2-py3-none-any.whl, log4j-api-2.24.3.jar,...
Security Bulletin: Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust
Summary Langflow contains two vulnerabilities affecting client-side security and access control integrity. The MarkdownField component renders chat messages using the rehypeRaw plugin without a sanitization pass, causing attacker-controlled LLM response text containing raw HTML to be inserted...
Security Bulletin: Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
Summary Langflow uses outbound HTTP request functionality as part of several flow components, including components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. These components accept user-supplied URL values and issue...
Security Bulletin: Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
Summary Langflow contains two authenticated vulnerabilities that allow an attacker to write or delete arbitrary files on the server filesystem accessible to the Langflow process identity. The SaveToFileComponent constructs file paths directly from the attacker-controlled file name field supplied...
Security Bulletin: Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows
Summary Langflow contains two authenticated information disclosure vulnerabilities. The MCP Tools component caches discovered tools in a shared process-local cache keyed only by the MCP server display name without including the user, session, flow, or resolved configuration; when two authenticate...
Security Bulletin: Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
Summary Langflow contains multiple authenticated path-traversal vulnerabilities that allow an attacker to read arbitrary files accessible to the Langflow server process, bypassing the LANGFLOWRESTRICTLOCALFILEACCESS=true security control. The ChatInput component's files parameter accepts absolute...
Security Bulletin: Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint
Summary Langflow contains an authorization policy bypass vulnerability that allows a non-superuser authenticated attacker to execute arbitrary Python code as the Langflow service identity despite the LANGFLOWCUSTOMCOMPONENTADMINONLY=true security control. The dedicated custom component API...
Security Bulletin: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
Summary Langflow contains multiple Server-Side Request Forgery vulnerabilities across several components where authenticated users can supply attacker-controlled URLs or database connection strings that reach internal network hosts without adequate validation. The LMStudio model and embeddings...
Security Bulletin: IBM DataPower Gateway affected by server-side request forgery (CVE-2026-14521)
Summary IBM DataPower Gateway affected by server-side request forgery CVE-2026-14521 Vulnerability Details CVEID:CVE-2026-14521 DESCRIPTION: IBM DataPower Gateway is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the...
Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)
Summary IBM DataPower Gateway affected by cross-site scripting due to DOMPurify CVE-2026-66010 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Babel (@babel/helpers) (CVE-2025-27789)
Summary A ReDoS and performance degradation vulnerability in Babel CVE-2025-27789 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading @babel/helpers to versions 7.27.4 and 7.29.2. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next...
Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache Thrift
Summary IBM SPSS Modeler is affected by vulnerabilities in Apache Thrift. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java...
Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime
Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime. These vulnerabilities are addressed. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...
Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office
Summary axios versions before 1.18.0 0.x: before 0.33.0 have multiple vulnerabilities CVSS up to 8.3, High. CVE-2026-67312/67313 are uncontrolled recursion issues in formDataToJSON that exhaust the call stack via deeply nested field names, causing denial of service. CVE-2026-67314/67316/67319 are...
Security Bulletin: Vulnerabilities in spring-core-5.3.25.jar and spring-expression-6.1.11.jar (CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41848) affect IBM PowerVM Novalink.
Summary The spring-core-5.3.25.jar and spring-expression-6.1.11.jar are used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS atta...
Security Bulletin: Vulnerabilities in IBM WebSphere Profile (CVE-2026-9563, CVE-2026-10842, CVE-2026-11897, CVE-2026-15057, CVE-2026-14981, CVE-2026-15064, CVE-2026-15328, CVE-2026-15325) affect PowerVM Novalink
Summary The IBM WebSphere Liberty Profile is used by PowerVM Novalink. PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10842 DESCRIPTION: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7...
Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server ...
Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75838 DESCRIPTION: DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization whe...
Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses ansible_core-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010
Summary IBM Maximo Application Suite - Cluster Performance Insights uses ansiblecore-2.19.11, postcss-8.5.10 and dompurify-3.4.11 which are vulnerable to CVE-2026-16493, CVE-2026-45623, CVE-2026-69153 and CVE-2026-66010. This bulletin contains information regarding these vulnerabilities and their...
Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886
Summary IBM Maximo Application Suite - Location Service for Esri Component uses pyasn1-0.6.3 which is vulnerable to CVE-2026-59884, CVE-2026-59885, CVE-2026-59886. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-59884...
Security Bulletin: Security vulnerabilities have been identified in Java Jackson Databind library shipped with IBM Guardium Cryptography Manager (GCM)
Summary Security vulnerabilities identified in Jackson Databind shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...
Security Bulletin: Security vulnerabilities have been identified in Jackson Databind shipped with IBM Guardium Cryptography Manager (GCM)
Summary Security vulnerabilities identified in Jackson Databind shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...
Security Bulletin: Vulnerability found in IBM ApplinX.
Summary IBM ApplinX has been updated in order to address the vulnerability CVE-2014-3604. Specifics of this vulnerability come under CWE-297: Improper Validation of Certificate with Host Mismatch Vulnerability Details CVEID:CVE-2014-3604 DESCRIPTION: Certificates.java in Not Yet Commons SSL befor...
Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-11806, CVE-2026-11541)
Summary Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is...
Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528 )
Summary IBM WebSphere Application Server used by IBM Tivoli System Automation Application Manager is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details CVEID:CVE-2026-14512 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 traditional is...
Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite
Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-67213, CVE-2026-67214, CVE-2026-59884, CVE-2026-59885, CVE-2026-59886, CVE-2026-56819, CVE-2026-15075, CVE-2026-50645, CVE-2026-9322, CVE-2026-9171, CVE-2026-11546, CVE-2026-11714,...
Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite
Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-69152, CVE-2026-59645, CVE-2026-16221, CVE-2026-18446, CVE-2026-14257, CVE-2026-34481, CVE-2026-12802, CVE-2026-13586, CVE-2026-15055, CVE-2026-59639, CVE-2026-59642, CVE-2026-59647,...
Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153)
Summary Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-66010, CVE-2026-54515, CVE-2026-59889, CVE-2026-49844, CVE-2026-69153. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute...
Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite
Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055, CVE-2026-58059, CVE-2026-58060, CVE-2026-58061, CVE-2026-58062,...
Security Bulletin: Security Vulnerabilities have been found in IBM Sovereign Core
Summary Security Vulnerabilities have been addressed in IBM Sovereign Core Vulnerability Details CVEID:CVE-2026-45022 DESCRIPTION: go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs...
Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management
Summary Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods developer portal and IBM webMethos API ControlPlane. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is using the...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to Cryptographic Weakness in IBM Liberty Server ( CVE-2020-36732)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the cryptographic weakness vulnerability Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an intege...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to spoofing vulnerabilty in MSSQL JDBC driver (CVE-2025-59250)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed MSSQL JDBC driver vulnerability Vulnerability Details CVEID:CVE-2025-59250 DESCRIPTION: Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable due to improper permission check vulnerability in Zookeeper (CVE-2025-58457)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable due to improper permission check vulnerability in Zookeeper Vulnerability Details CVEID:CVE-2025-58457 DESCRIPTION: Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and resto...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable due to improper permission check vulnerability in Zookeeper (CVE-2025-58457)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable due to improper permission check vulnerability in Zookeeper Vulnerability Details CVEID:CVE-2025-58457 DESCRIPTION: Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and resto...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to XSS vulnerability EBICS server (CVE-2025-14504)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability Vulnerability Details CVEID:CVE-2025-14504 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0 through 6.2.1.11, and...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to SQL Injection vulnerability in Dashboard UI (CVE-2025-36368)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed SQL Injection vulnerability Vulnerability Details CVEID:CVE-2025-36368 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, and 6.2.1.0 through...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to XSS security vulnerability in the dashboard UI (CVE-2023-40693)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the XSS security vulnerability Vulnerability Details CVEID:CVE-2023-40693 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, and 6.2.0.0 through 6.2.0.51, 6.2.1.0 through...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to reflected XSS vulnerability in AFT (CVE-2026-0835)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed reflected XSS vulnerability Vulnerability Details CVEID:CVE-2026-0835 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0 through 6.2.1.1...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to information disclosure (CVE-2025-14483)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed information disclosure security vulnerability Vulnerability Details CVEID:CVE-2025-14483 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51,...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Denial of Service due to IBM Liberty Server (CVE-2025-36000)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the denial-of-service security vulnerability Vulnerability Details CVEID:CVE-2025-36000 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. Th...
Security Bulletin: The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information Disclosure (CVE-2025-36348)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the information disclosure vulnerability Vulnerability Details CVEID:CVE-2025-36348 DESCRIPTION: IBM Sterling B2B Integrator versions 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1, an...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to an access control vulnerability in AFT web app ( CVE-2026-1264 )
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed access control security vulnerability Vulnerability Details CVEID:CVE-2026-1264 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0 throu...
Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to an access control security vulnerability in Ops server (CVE-2025-14031)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed access control security vulnerability Vulnerability Details CVEID:CVE-2025-14031 DESCRIPTION: IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0...
Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities in Spring Framework Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patter...
Security Bulletin: Security Vulnerability in Spring Boot Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-22235)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Spring Boot Vulnerability Details CVEID:CVE-2025-22235 DESCRIPTION: EndpointRequest.to creates a matcher for null/ if the actuator endpoint, for which the EndpointRequest has been create...
Security Bulletin: Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-64775)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Struts Vulnerability Details CVEID:CVE-2025-64775 DESCRIPTION: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issu...
Security Bulletin: Security Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41248)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Spring Security Vulnerability Details CVEID:CVE-2025-41248 DESCRIPTION: The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type...