CVE-2025-36139

IBM Lakehouse watsonx.data 2.2 is vulnerable to stored cross-site scripting in the Web UI due to insufficient input filtering/escaping. A privileged user could inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Remediation: upgrade to watsonx.data...

CVE-2025-36146

IBM Lakehouse (watsonx.data 2.2) contains an information disclosure vulnerability where an authenticated user could obtain sensitive server component version information from stack traces. The issue stems from CWE-209 and is documented in IBM’s Security Bulletin (CVE-2025-36146). Impact is limite...

CVE-2025-36143

IBM Lakehouse watsonx.data 2.2 is affected by an OS command injection vulnerability caused by improper validation of user input. An authenticated privileged user could execute arbitrary commands on the system. The CVE is CVE-2025-36143. Remediation provided in the IBM security bulletin is to upgr...