Security Bulletin: Insecure Deserialization Vulnerability in Mina Core Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-47065)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-47065 DESCRIPTION: ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a...

Security Bulletin: Multiple Security Vulnerabilities in Netty Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-42586 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis code...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package...

Security Bulletin: Deserialization of Untrusted Data in Apache Axis2 affects AS4 of IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-66713)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-66713 DESCRIPTION: Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-49476, CVE-2026-49477)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-49476 DESCRIPTION: Soup Sieve is a CSS selector...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-45409)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Nam...

Security Bulletin: IBM QRadar SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-73088, CVE-2026-73089)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-73088 DESCRIPTION: Browserslist is a configuration tool fo...

Security Bulletin: IBM QRadar SOAR is vulnerable to using components with known vulnerabilities (CVE-2026-45819)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar SOAR has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45819 DESCRIPTION: baseline-browser-mapping 2.x before...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms including gdb, gdb-headless, pip, gzip, unbound-libs, tar, binutils, libpkgconf, pkgconf, pkgconf-m4, pkgconf-pkg-config, python3-unbound, platform-python-pip,...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-50734, CVE-2026-53917, CVE-2026-10050, CVE-2026-10051, CVE-2026-6790 affect IBM Sterling Secure Proxy and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-50734 DESCRIPTION: Memory Allocation with Excessive Size Value vulnerability i...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-25526)

Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-25526 DESCRIPTION: JinJava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Prior to versions 2.7.6 and 2.8.3,...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Security Bulletin: There are multiple security vulnerability in IBM Maximo Asset Management application

Summary There are multiple security vulnerability in IBM Maximo Asset Management application Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in...

Security Bulletin: IBM Sterling Connect:Direct FTP+ is impacted by mulitple vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct FTP+ in product configuration and data transmission. IBM Sterling Connect:Direct FTP+ is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct FTP+ has upgraded IBM Java 17 to address the issues CVE-2026-41254,...

Security Bulletin: Vulnerable Version of Software in Use (CVE-2026-5704)

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of tar. Vulnerability Details CVEID:CVE-2026-5704 DESCRIPTION: A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection wit...

Security Bulletin: Vulnerable Version of Software in Use

Summary Vulnerable Version of Software in Use: Prior versions include vulnerable version of curl. Vulnerability Details CVEID:CVE-2026-3805 DESCRIPTION: When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory. CWE:CWE-416: U...

Security Bulletin: IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [CVE-2026-17262, CVE-2026-18869]

Summary IBM i is vulnerable to a denial of service and security restriction bypass due to improper validation of commands CVE-2026-17262, CVE-2026-18869 in File Transfer Protocol FTP as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17262 DESCRIPTION: IBM i...

Security Bulletin: node-tar is a tar archive manipulation library for Node.js vulnerability

Summary node-tar is a tar archive manipulation library for Node.js vulnerability causing an uncatchable RangeError stack overflow. Vulnerability Details CVEID:CVE-2026-73566 DESCRIPTION: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in idna

Summary IBM Watson Discovery Cartridge affected by vulnerability in idna Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in sanitize-html

Summary IBM Watson Discovery Cartridge affected by vulnerability in sanitize-html Vulnerability Details CVEID:CVE-2026-53606 DESCRIPTION: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-ht...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core-2.25.2.jar Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf Vulnerability Details CVEID:CVE-2026-33123 DESCRIPTION: pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtim...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in python_dotenv

Summary IBM Watson Discovery Cartridge affected by vulnerability in pythondotenv Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec

Summary IBM Watson Discovery Cartridge affected by vulnerability in netty-codec Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in axios

Summary IBM Watson Discovery Cartridge affected by vulnerability in axios Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION: axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in WebSphere Application Server Liberty Vulnerability Details CVEID:CVE-2026-18499 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using...

Security Bulletin: IBM Planning Analytics Connector for SAP is affected by security vulnerabilities

Summary IBM Planning Analytics Connector for SAP is affected by security vulnerabilities Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with ...

Security Bulletin: IBM Informix HQ is affected by multiple security vulnerabilities due to Hono (CVE-2026-54286, CVE-2026-54287, CVE-2026-54288, CVE-2026-54289, CVE-2026-54290).

Summary IBM Informix HQ is affected by multiple vulnerabilities in Hono. To address these vulnerabilities, IBM Informix HQ has been updated to the latest version of Hono. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.25

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.25 Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This...

Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.24 Vulnerability Details CVEID:CVE-2016-4970 DESCRIPTION: handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service infinite loo...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Ref...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details Refer...

Security Bulletin: JVM crash (SEGV) in IBM Java SDK affect IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact. Information about security vulnerability affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details Refer t...

Security Bulletin: IBM MQ queue manager is vulnerable to remote code execution (CVE-2026-10575)

Summary IBM MQ has addressed an heap buffer overflow vulnerability when processing MQPUT operations with malformed distribution headers that could allow a remote authenticated attacker to cause a denial of service or potentially escalate privileges. Vulnerability Details CVEID:CVE-2026-10575...

Security Bulletin: The IBM Platform RTM is affected by an SQL injection vulnerability (CVE-2026-17619)

Summary The IBM Platform RTM takes an input in web interface directly for SQL Query, unvalidated value might allow bad actor to insert malicious code into the SQL Query phase. Vulnerability Details CVEID:CVE-2026-17619 DESCRIPTION: IBM Platform RTM is vulnerable to SQL injection. A remote attacke...

Security Bulletin: Vulnerabilities in Eclipse affect Tivoli Netcool/OMNIbus

Summary There are vulnerabilities in the Jetty libraries shipped in the MIB Manager application that is a component of Tivoli Netcool/OMNIbus. The Jetty libraries have been removed from the application. Vulnerability Details CVEID:CVE-2026-2332 DESCRIPTION: In Eclipse Jetty, the HTTP/1.1 parser i...

Security Bulletin: IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a DBADM privileged user under certain conditions (CVE-2026-87958)

Summary IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a database administration authority DBADM privileged user under certain conditions CVE-2026-87958 Vulnerability Details CVEID:CVE-2026-87958 DESCRIPTION: IBM Db2 11.5.0 through...

Security Bulletin: Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294

Summary Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294. This security bulletin provides details about the vulnerability and...

Security Bulletin: IBM® Db2® could allow a authenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVE-2026-17463)

Summary IBM® Db2® could allow a authenticated attacker to cause a denial of service due to uncontrolled resource consumption CVE-2026-17463 Vulnerability Details CVEID:CVE-2026-17463 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle 1.84

Summary Bouncy Castle for Java before 1.85 was affected with the following CVE's.CVE-2026-12817, CVE-2026-59640, CVE-2026-59643, CVE-2026-59648, CVE-2026-59649 Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by vulnerabilities in bouncy castle 1.84

Summary Bouncy Castle for Java before 1.85 was affected with the following CVE's.CVE-2026-12802, CVE-2026-13586, CVE-2026-15055, CVE-2026-59639, CVE-2026-59642, CVE-2026-59647 Vulnerability Details CVEID:CVE-2026-12802 DESCRIPTION: In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fail...

Security Bulletin: Multiple vulnerabilities impact AIX due to ISC BIND

Summary Vulnerabilities in ISC BIND could cause: Allowing forged authenticated NXDOMAIN responses CVE-2026-10723, Denial of service CVE-2026-10822, CVE-2026-11331, CVE-2026-11622, CVE-2026-12617, CVE-2026-13204, DNS cache poisoning CVE-2026-11721, CVE-2026-13321. AIX uses ISC BIND as part of its...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in bouncy castle 1.84

Summary Bouncy Castle for Java before 1.85 was affected with the CVE-2026-59645 Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for...

Security Bulletin: IBM MQ Appliance is affected by a heap-based buffer overflow vulnerability (CVE-2026-10575)

Summary IBM MQ Appliance has addressed a heap-based buffer overflow vulnerability. Vulnerability Details CVEID:CVE-2026-10575 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQP...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced. IBM WebSphere Liberty has been updated within IBM CICS TX Advanced to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM WebSphere...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990 Vulnerability Details CVEID:CVE-2026-25854 DESCRIPTION: Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability i...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515 Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)

Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...