38326 matches found
Security Bulletin: Security Vulnerability identified in reactor-core-3.7.11.jar used by IBM Maximo Application Suite - MREF
Summary There is a vulnerability in reactor-core-3.7.11.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-47857 DESCRIPTION: In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Servic...
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty
Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2024-29025 DESCRIPTION: Netty is an asynchronous event-driven network application framework for rapid development of maintainable...
Security Bulletin: Security Vulnerability identified in Spring - 6.2.19 used by IBM Maximo Application Suite - MREF
Summary There is a vulnerability in Spring-6.2.19 used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering,...
Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-40553 DESCRIPTION: Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk ftype routine. This issue could be used to crash...
Security Bulletin: IBM Maximo Application Suite uses body-parser-1.20.5.tgz which is vulnerable to CVE-2026-12590
Summary IBM Maximo Application Suite uses body-parser-1.20.5.tgz which is vulnerable to CVE-2026-12590. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6 1.x line...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-11940 DESCRIPTION: tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink reference...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch releases of NPS and Callhome. Vulnerability Details CVEID:CVE-2026-1965 DESCRIPTION: libcurl can in some circumstances reuse the wrong connection when asked to do an...
Security Bulletin: Due to the use of jackson-databind, IBM Cloud Pak System is affected by Uncontrolled Resource Consumption and Deserialisation of Untrusted Data
Summary Jackson-databind is used internally by IBM Cloud Pak System CVE-2026-83557 and CVE-2026-68497 . These vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the...
Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 IF1 Vulnerability Details CVEID:CVE-2026-108104 DESCRIPTION: Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled...
Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem
Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 15 Vulnerability Details CVEID:CVE-2026-64847 DESCRIPTION: AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO...
Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates
Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.28 and 13.6.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...
Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs
Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-84003 DESCRIPTION:...
Security Bulletin: Multiple vulnerabilties in DevOps Test Hub
Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.8 Vulnerability Details CVEID:CVE-2026-5680 DESCRIPTION: A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiate...
Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console
Summary Session Token exposure in Admin console in versions below 5.0.9 Vulnerability Details CVEID:CVE-2026-93892 DESCRIPTION: IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the...
Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Business Automation Workflow
Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...
Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Netty
Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-93492 DESCRIPTION: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS...
Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition
Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 IF1 Vulnerability Details CVEID:CVE-2026-17508 DESCRIPTION: In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix crates
Summary Vulnerabilites were discovered in the gix family of crates used by the cargo package manager in IBM Open SDK for Rust on AIX 1.94.0.1 and 1.96.0.0. Vulnerability Details CVEID:CVE-2026-82248 DESCRIPTION: gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the...
Security Bulletin: z Open Editor and RSE CLI uses sdk-1.30.0.tgz which is vulnerable to CVE-2026-104850
Summary Security Bulletin: z Open Editor and RSE CLI uses sdk-1.30.0.tgz which is vulnerable to CVE-2026-104850 Vulnerability Details CVEID:CVE-2026-104850 DESCRIPTION: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and...
Security Bulletin: Vulnerabilities found in Watson Data Intelligence
Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.3.1 Patch15 Vulnerability Details CVEID:CVE-2026-69153 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to...
Security Bulletin: Security vulnerability has been detected in IBM Security Verify Governance Identity Manager Adapters
Summary IBM Security Verify Governance Identity Manager Adapters are affected by a security vulnerability in the jackson-databind-2.22.1.jar component Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or...
Security Bulletin: Multiple vulnerabilties in IBM Rational Functional Tester / DevOps Test UI
Summary Multiple vulnerabilities addressed in DevOps Test UI in version 12.0.0 Vulnerability Details CVEID:CVE-2026-45736 DESCRIPTION: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close implementation is vulnerable to uninitialized memory disclosure...
Security Bulletin: Multiple vulnerabilties in IBM Rational Functional Tester / DevOps Test UI
Summary Multiple vulnerabilities addressed in DevOps Test UI in version 11.0.9 Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service ReDoS when...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36069
Summary The Web UI and REST interfaces did not properly invalidate active user sessions after security-sensitive account changes, including password changes, password resets, or role and privilege updates, allowing previously issued session tokens to remain valid and potentially be reused to acce...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36252
Summary The Web UI did not generate a new session identifier following successful user authentication, allowing a pre-authentication session identifier to remain associated with the authenticated session. An attacker who could obtain or cause a user's browser to use a known session identifier...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2026-19178
Summary The Web UI and REST interfaces allowed users with administrative-level role-mapping privileges to modify their own role mapping, creating a race condition in which a user could potentially preserve or restore elevated privileges while an administrator was changing the user's role. This...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36061
Summary The Web UI allowed an authenticated user with administrative privileges to generate a large number of email notifications by submitting multiple user creation requests, potentially resulting in email flooding and impacting the readability and usability of recipients' mailboxes. The issue...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2026-19133
Summary The Web UI and REST interfaces did not properly enforce authorization when processing password modification requests, allowing a lower-privileged user to potentially use their own authenticated session to modify another user's password and gain access to the affected account. The issue ha...
Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access and IBM Security Verify Access (CVE-2026-109126)
Summary Security vulnerability has been addressed in IBM Verify Identity Access and IBM Security Verify Access. Vulnerability Details ID: CVE-2026-109126 DESCRIPTION: IBM Security Verify Access Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of...
Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub (Db2IC)
Summary Dependency updates and code fixes were done to fix multiple vulnerabilties found in Db2 intelligence center. Vulnerability Details CVEID:CVE-2026-109838 DESCRIPTION: IBM Db2 Genius Hub could allow a local attacker to obtain sensitive information due to improper verification of cryptograph...
Security Bulletin: IBM Content Navigator is affected by CVE-2026-1243, a Cross-Site Scripting (XSS) vulnerability
Summary IBM Content Navigator is affected by CVE-2026-1243, a Cross-Site Scripting XSS vulnerability that allows an authenticated user to embed arbitrary JavaScript into the Web UI. This could alter intended application behaviour and potentially lead to credentials disclosure within a trusted...
Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind
Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied...
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty
Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-93492 DESCRIPTION: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2...
Security Bulletin: Multiple vulnerabilities in IBM Aspera Console
Summary Multiple vulnerabilities were addressed in IBM Aspera Console version 3.4.12 Vulnerability Details CVEID:CVE-2026-54463 DESCRIPTION: websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads
Summary SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp task...
Security Bulletin: Multiple vulnerabilties in DevOps Test Hub
Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 12.0.0 Vulnerability Details CVEID:CVE-2026-47857 DESCRIPTION: In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. Reactor...
Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (September 2026)
Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Multiple vulnerabilties in DevOps Test Hub
Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.9 Vulnerability Details CVEID:CVE-2026-22735 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 throu...
Security Bulletin: a vulnerability has been addressed in IBM Concert Network Observability
Summary IBM Concert Network Observability has addressed this security vulnerability with a Network Collectors update. Vulnerability Details ID:WS-2026-0062 DESCRIPTION: Unbounded mutual recursion in the TOML parser of github.com/pelletier/go-toml/v2. "unstable.Parser.parseVal" dispatches nested...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.13 Vulnerability Details CVEID:CVE-2026-45820 DESCRIPTION: fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring...
Security Bulletin: Platform Navigator in IBM Integration is vulnerable to multiple vulnerabilities in undici
Summary Platform Navigator in IBM Integration is vulnerable to multiple vulnerabilities in undici. CVE-2026-18149, CVE-2026-18540, CVE-2026-19534, CVE-2026-84890, CVE-2026-84933, CVE-2026-84947, CVE-2026-84961, CVE-2026-85008, CVE-2026-85014, CVE-2026-85024 The vulnerabilities have been addressed...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1
Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.1 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...
Security Bulletin: IBM Storage Protect Server is affected by an improper domain name validation vulnerability (CVE-2026-42579).
Summary IBM Storage Protect Server uses the netty-codec-dns library in certain components. A vulnerability in netty could allow improper handling of domain names that do not comply with RFC 1035 constraints. An attacker can exploit this through malicious DNS responses or specially crafted...
Security Bulletin: IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System [CVE-2026-17068, CVE-2026-17073]
Summary IBM i is vulnerable to bypassing Network File System NFS version restrictions due to improper enforcement CVE-2026-17068 and obtaining sensitive information due to missing subtree checks CVE-2026-17073 in NFS as described in the vulnerability details section. Vulnerability Details...
Security Bulletin: IBM i is Affected By An Improper Privilege Management Vulnerability [CVE-2026-102917]
Summary IBM i is vulnerable to an authenticated user obtaining elevated privileges CVE-2026-102917 as described in the vulnerability details section. Vulnerability Details ID: CVE-2026-102917 DESCRIPTION: IBM i is vulnerable to an authenticated attacker elevating their privilege. A bad actor coul...
Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.
Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successfu...
Security Bulletin: Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
Summary GWT Mock Authentication Privilege Escalation in IBM TRIRIGA Vulnerability Details CVEID:CVE-2026-107400 DESCRIPTION: IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. CWE:CWE-287: Improper Authentication CVSS Source: IBM CVSS...
Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in golang.org/x/crypto
Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in golang.org/x/crypto. CVE-2026-56855, CVE-2026-78662 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-56855 DESCRIPTION: Previously, after a channel has be...
Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance
Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch release of NPS Vulnerability Details CVEID:CVE-2023-36464 DESCRIPTION: pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads t...