Security Bulletin:Axios Node.js HTTP Adapter Proxy Credential Leakage Vulnerability in 0.32.0 and 1.16.0

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios' Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header...

Security Bulletin:Polymorphic Type Validator Bypass in Jackson Databind 2.10.0 to 2.18.8, 2.21.4, and 3.1.4

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator PTV is the primary safety mechanism guarding polymorphic deserialization. When...

Security Bulletin:Improper Enforcement of Message Integrity in Erlang/OTP SSL: Vulnerability in tls_gen_connection Module Allows Unauthenticated Data Injection

Summary Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl tlsgenconnection module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server...

Security Bulletin:Prototype Pollution Vulnerability in js-yaml Before 4.1.1 and 3.14.2

Summary js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

Security Bulletin: Multiple vulnerabilities addressed in IBM Db2 Recovery Expert for Linux, Unix and Windows

Summary There are multiple vulnerabilities fixed in IBM Db2 Recovery Expert for Linux, Unix and Windows v12.1. Details on the vulnerabilities fixed are given below. All platforms are affected, and all previous versions may also be affected. Vulnerability Details CVEID:CVE-2015-4852 DESCRIPTION: T...

Security Bulletin: IBM SPSS Modeler is affected by an Apache Log4j logging vulnerability that may produce malformed JSON log output

Summary IBM SPSS Modeler is affected by an Apache Log4j logging vulnerability that may produce malformed JSON log output. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF003 for September 2026

Summary IBM Content Cortex CCx 26.0.0-IF003 addresses CVEs across components including CPE, GraphQL, External share and Content Based Search Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without...

Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and...

Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-14981 DESCRIPTION: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty ar...

Security Bulletin: Multiple vulnerabilities have been addressed in IBM Aspera Shares

Summary Multiple vulnerabilities have been addressed in IBM Aspera Shares Version 1.11.5 Vulnerability Details CVEID:CVE-2026-63435 DESCRIPTION: Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.qvaluedecode and...

Security Bulletin: IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution (CVE-2026-9764)

Summary IBM Bob could allow a remote attacker to execute arbitrary code when a user opens an untrusted repository in Bob Shell. Due to insufficient validation of workspace-provided MCP server configurations, MCP servers defined within the repository could be automatically executed without explici...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 federated server and IBM Db2 shipped with IBM WebSphere Remote Server

Summary IBM Db2 federated server and IBM Db2 are shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 federated server and IBM Db2 has been published in a security bulletin CVE-2026-41586, CVE-2026-16702, CVE-2026-10649, CVE-2026-17463,...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-42580 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflow...

Security Bulletin: InfoSphere Data Architect (IDA) 9.2.2 Vulnerability Fixes

Summary Security Bulletin: Multiple vulnerabilities getting fixed with InfoSphere Data Architect IDA 9.2.2. Hence, IBM strongly recommends upgrading to v9.2.2 Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec. The vulnerabilities have been addressed. Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were found in openSSL used by IBM OS Image for Red Hat Enterprise Linux Systems shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-34181 DESCRIPTION: Issue Summary: The...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant IDE Extensions

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant IDE Extensions for VSCode plugin & Eclipse WCA Core plugin Vulnerability Details CVEID:CVE-2026-41680 DESCRIPTION: Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service DoS...

Security Bulletin: Due to use Apache Commons Compress, IBM Cloud Pak System is affected by Vulnerability

Summary Vulnerability found in Apache Commons Compress CVE-2024-26308. Vulnerability was addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2024-26308 DESCRIPTION: Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This...

Security Bulletin: Due to use of HCL BigFix , IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Vulnerabilities found in HCL BigFix that affect IBM Endpoint Manager IEM pattern Type pType shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2022-27775 DESCRIPTION: An information disclosure...

Security Bulletin: Multiple Vulnerabilities in Axios affect IBM Cloud Pak System

Summary Due to the use of Axios, multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config...

Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Vulnerabilities found in IBM Db2 LUW that affect Foundation and IBM Tivoli Monitoring ITM pattern Types pTypes shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System v2.3.5.1. IBM Cloud Pak System provides IBM Db2 with BLU Acceleration Pattern 1.2.26.0...

Security Bulletin: Multiple Vulnerabilities in IBM® SDK, Java™ Technology affect IBM Cloud Pak System

Summary Multiple Vulnerabilities have been found in IBM® SDK, Java™ Technology that is shipped with IBM Cloud Pak System. IBM Cloud Pak System has addressed these vulnerabilities as per the IBM® SDK, Java™ Technology April 2026 in IBM Cloud Pak System 2.3.5.1. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.5 Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in github.com/go-openapi/spec. The expander inlines every $ref without memoizatio...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-90559 DESCRIPTION: snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in...

Security Bulletin: Bouncy Castle(bcprov and bcpg) security vulnerability in IBM FileNet Content Manager(FNCM) reported for FileNet Deployment Manager(FDM)

Summary IBM FileNet Content ManagerFNCM 5.7.0-IF6 addresses multiple Bouncy Castle CVEs reported for FileNet Deployment ManagerFDM Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This iss...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM FileNet Content Manager(FNCM) 5.6.0-IF009 and 5.7.0-IF006 for September 2026

Summary IBM FileNet Content ManagerFNCM 5.6.0-IF009 and 5.7.0-IF006 addresses CVEs across components including CPE, GraphQL, External share and Content Based Search Vulnerability Details CVEID:CVE-2026-60412 DESCRIPTION: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty

Summary IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host a...

Security Bulletin: Multiple vulnerabilities within WebSphere Application Server Liberty, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within KCCI WebSphere Liberty Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-15057 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerabl...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream)

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin:Jackson-Databind Denial-of-Service Vulnerability in Versions 2.13.0 to 2.14.0

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as...

Security Bulletin:Sensitive Data Exposure in Erlang OTP inets (httpc_response module)

Summary Sensitive Data Exposure vulnerability in Erlang OTP inets httpcresponse module allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary...

Security Bulletin:Improper Certificate Validation in Erlang OTP public_key: DNS NameConstraints Bypass in TLS Hostname Verification

Summary Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeycert and publickey modules allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted e.g...

Security Bulletin:Netty SSL Vulnerability: Hostname Verification Failure in Client Builds Prior to 4.1.135.Final and 4.2.15.Final

Summary Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which...

Security Bulletin:Netty TLS ClientHello Length Vulnerability: Unbounded Memory Allocation

Summary Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates...

Security Bulletin:Netty IPv6 Subnet Rules Bypass in Versions Prior to 4.1.135.Final and 4.2.15.Final

Summary Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo. Valid public IP...

Security Bulletin:Netty IPv6 Subnet Rules Bypass in Versions Prior to 4.1.135.Final and 4.2.15.Final

Summary Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo. Valid public IP...

Security Bulletin:Netty Vulnerability: IndexOutOfBoundsException in SslClientHelloHandler Leading to Mutual TLS Bypass

Summary Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records c...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-14532 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a Reader-role attacker to obtain version information that causes an uncaught...

Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Multiple vulnerabilities were found in IBM Db2 LUW that affect Platform System Manager PSM and Db2 pattern Type pType shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System CPS 2.3.6.2. Vulnerability Details CVEID:CVE-2026-16480 DESCRIPTION: IBM Db...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms including gdb-headless, gdb, binutils-gold, binutils, cpp, gcc, gcc-gdb-plugin, libgcc, libgomp, libstdc++, python-unversioned-command, platform-python, python3,...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses mlflow-3.11.1-py3-none-any.whl, nltk-3.10.0-py3-none-any.whl, gitpython-3.1.53-py3-none-any.whl, and glib2 2.68.4-19.el98.1 which are vulnerable to CVE-2026-64849, CVE-2026-69148, CVE-2026-79657, CVE-2026-79674, CVE-2026-79675, CVE-2026-79676, CVE-2026-78675,...

Security Bulletin: Vulnerability jackson-databind, golang.org/x/mod, image-size, bcprov-jdk18on, bcpkix-jdk18on, pyasn, setuptools, Mako, paramiko, http2-common Oct 2026v1

Summary jackson-databind CVE-2026-19032, CVE-2026-83557,CVE-2026-19032, golang.org/x/mod CVE-2026-56864, CVE-2026-56865, image-size CLEVOS-111792, bcprov-jdk18on CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055,...

Security Bulletin: IBM Verify Antenna is affected by multiple vulnerabilities

Summary IBM Verify Antenna has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-56852 DESCRIPTION: A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CWE:CWE-835: Loop with Unreachable Exit Condition 'Infinite Loop' CVSS...

Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in xmldom

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in xmldom. CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614, CVE-2026-83615, CVE-2026-83616, CVE-2026-83619 The vulnerabilities have been addressed...

Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

Summary Vulnerabilities in PostgreSQL could allow Memory Corruption/Arbitrary Code Execution CVE-2026-14662, CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679, CVE-2026-14680, CVE-2026-15742, CVE-2026-16239, CVE-2026-19385, Information Disclosure...

Security Bulletin: Due to use of IBM Storage Scale, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Vulnerabilities found in IBM Storage Scale affect IBM Cloud Pak System. These vulnerabilities were addressed in IBM Cloud Pak System v2.3.5.1 power and IBM Cloud Pak System 2.3.6.2 intel. Vulnerability Details CVEID:CVE-2025-55163 DESCRIPTION: Netty is an asynchronous, event-driven networ...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...

Security Bulletin: Due to use of Nodejs Express.js, multiple vulnerabilities affect IBM Cloud Pak System[CVE-2024-43796, CVE-2024-43799, CVE-2024-43800]

Summary Multiple vulnerabilities in Send cross-site scripting XSS within the SendStream.redirect, serve-static built-in and response.redirect found in Node.js Express.js which is used by IBM Cloud Pak System. Vulnerabilities were addressed by IBM Cloud Pak System. Vulnerability Details...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 1.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 1.0 - NRS have been addressed in version 3.0.5.4 Vulnerability Details CVEID:CVE-2026-62574 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Ja...