Security Warnings — Source: ibm

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2026 - Includes Oracle April 2026 CPU

2026-06-16 CVE-2026-34268

highIBM 2026-W25

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM Semeru Runtime Quarterly CPU - Apr 2026 - Includes OpenJDK April 2026 CPU plus CVE-2026-6918

2026-06-16 CVE-2026-34282

highIBM 2026-W25

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to Node.js module file-type ( CVE-2026-31808 )

2026-06-16 CVE-2026-31808

mediumIBM 2026-W25

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module path-to-regexp

2026-06-16 CVE-2026-4867

highIBM 2026-W25

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules fast-uri and protobufjs (CVE-2026-6322, CVE-2026-45740 & CVE-2026-6321)

2026-06-16 CVE-2026-6322

highIBM 2026-W25

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by insufficient verification of data authenticity in PyJWT

2026-06-16 CVE-2026-32597

highIBM 2026-W25

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Test management is impacted by multiple vulnerabilities

2026-06-16 CVE-2022-42003

highIBM 2026-W25

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server

2026-06-16 CVE-2026-44631

criticalIBM 2026-W25

Security Bulletin: IBM MQ Appliance is affected by multiple open source vulnerabilities (CVE-2026-23193, CVE-2026-23231, CVE-2026-3497)

2026-06-16 CVE-2026-3497

highIBM 2026-W25

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

2026-06-16 CVE-2026-6638

criticalIBM 2026-W25

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Netty

2026-06-16 CVE-2024-47535

mediumIBM 2026-W25

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)

2026-06-16 CVE-2026-8646

highIBM 2026-W25

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using the Web Server Plug-ins (CVE-2026-9072, CVE-2026-8858, CVE-2026-10852)

2026-06-16 CVE-2026-10852

highIBM 2026-W25

Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass vulnerability (CVE-2026-10845)

2026-06-16 CVE-2026-10845

highIBM 2026-W25

Security Bulletin: IBM WebSphere Application Server is affected by server-side request forgery (CVE-2026-9006)

2026-06-16 CVE-2026-9006

highIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Direct Request ('Forced Browsing') (CVE-2026-22732)

2026-06-16 CVE-2026-22732

criticalIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Certificate Validation (CVE-2026-40971, CVE-2026-40974)

2026-06-16 CVE-2026-40974

criticalIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') (CVE-2026-40477, CVE-2026-40478)

2026-06-16 CVE-2026-40478

criticalIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVE-2024-1597)

2026-06-16 CVE-2024-1597

criticalIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CVE-2026-2332)

2026-06-16 CVE-2026-2332

criticalIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), URL Redirection to Untrusted Site ('Open Redirect'), and 3 more (CVE-2026-24880, CVE-2026-25854, and 3 more)

2026-06-16 CVE-2026-32990

criticalIBM 2026-W25

Security Bulletin: MongoDB Enterprised Advanced affected by: Use of a Broken or Risky Cryptographic Algorithm, Covert Timing Channel (CVE-2025-14813, CVE-2026-5598)

2026-06-16 CVE-2026-5598

criticalIBM 2026-W25

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

2026-06-16 CVE-2026-33814

highIBM 2026-W25

Security Bulletin: Multiple Vulnerabilities in IBM Datacap

2026-06-16 CVE-2026-45205

mediumIBM 2026-W25

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

2026-06-16 CVE-2026-42579

criticalIBM 2026-W25

Security Bulletin: Security Vulnerabilities were found in IBM Security Verify Directory (CVE-2018-2799, CVE-2022-23437)

2026-06-16 CVE-2018-2799

mediumIBM 2026-W25

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by CVE-2025-48924

2026-06-15 CVE-2025-48924

mediumIBM 2026-W25

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2025-11143

2026-06-15 CVE-2025-11143

mediumIBM 2026-W25

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2026-1605

2026-06-15 CVE-2026-1605

highIBM 2026-W25

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925

2026-06-15 CVE-2026-21925

highIBM 2026-W25

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses pillow-11.3.0 which is vulnerable to CVE-2026-40192

2026-06-15 CVE-2026-40192

highIBM 2026-W25

Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to multiple issues

2026-06-15 CVE-2026-6918

highIBM 2026-W25

Security Bulletin: Security vulnerability has been found in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

2026-06-15 CVE-2026-9319

criticalIBM 2026-W25

Security Bulletin: Security vulnerability has been identified in dojo library shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2018-1000665)

2026-06-15 CVE-2018-1000665

mediumIBM 2026-W25

Security Bulletin: Security vulnerability has been identified in WebSphere Application Server shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

2026-06-15 CVE-2026-9311

criticalIBM 2026-W25

Security Bulletin: Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

2026-06-12 CVE-2026-4502

mediumIBM 2026-W24

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.x) Platform - Multiple Vulnerabilities in IBM Java

2026-06-12 CVE-2026-21945

highIBM 2026-W24

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed

2026-06-12 CVE-2025-33128

mediumIBM 2026-W24

Security Bulletin: IBM Event Processing is affected by Multiple vulnerabilities

2026-06-12 CVE-2025-59471

criticalIBM 2026-W24

Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities in Java SE (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933).

2026-06-12 CVE-2026-21945

highIBM 2026-W24

Security Bulletin: IBM TRIRIGA Cross-Site Scripting Vulnerability

2026-06-12 CVE-2026-11372

mediumIBM 2026-W24

Security Bulletin: Langflow OSS Unauthenticated IDOR on Image Downloads

2026-06-12 CVE-2026-4503

highIBM 2026-W24

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026

2026-06-12 CVE-2026-22745

criticalIBM 2026-W24

Security Bulletin: Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

2026-06-12 CVE-2021-23337

criticalIBM 2026-W24

Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

2026-06-12 CVE-2025-41249

highIBM 2026-W24

Security Bulletin: Multiple vulnerabbilities exist in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager IP Edition core components

2026-06-12 CVE-2026-34268

highIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

2026-06-12 CVE-2018-20225

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM Software Support App

2026-06-12 CVE-2021-23337

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

2026-06-12 CVE-2025-2099

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

2026-06-12 CVE-2026-34043

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

2026-06-12 CVE-2021-23337

criticalIBM 2026-W24

Security Bulletin: Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.

2026-06-12 CVE-2026-4870

highIBM 2026-W24

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

2026-06-12 CVE-2025-53864

mediumIBM 2026-W24

Security Bulletin: Security Vulnerability in Spring Boot Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-22235)

2026-06-12 CVE-2025-22235

highIBM 2026-W24

Security Bulletin: Security Vulnerability in Spring Cloud Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41235)

2026-06-12 CVE-2025-41235

highIBM 2026-W24

Security Bulletin: Security Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41248)

2026-06-12 CVE-2025-41249

highIBM 2026-W24

Security Bulletin: The IBM Common Licensing product using WebSphere Application Server Liberty is affected by a remote code execution vulnerability (CVE-2025-14914)

2026-06-12 CVE-2025-14914

highIBM 2026-W24

Security Bulletin: Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

2026-06-12 CVE-2026-4503

highIBM 2026-W24

Security Bulletin: upload filename directly from the multipart Content-Disposition header without sanitization

2026-06-12 CVE-2026-4502

mediumIBM 2026-W24

Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

2026-06-11 CVE-2026-42587

criticalIBM 2026-W24