Security Warnings — Source: ibm

Security Bulletin: Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

2026-06-12 CVE-2026-4502

mediumIBM 2026-W24

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.x) Platform - Multiple Vulnerabilities in IBM Java

2026-06-12 CVE-2026-21945

highIBM 2026-W24

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed

2026-06-12 CVE-2025-33128

mediumIBM 2026-W24

Security Bulletin: IBM Event Processing is affected by Multiple vulnerabilities

2026-06-12 CVE-2025-59471

criticalIBM 2026-W24

Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities in Java SE (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933).

2026-06-12 CVE-2026-21945

highIBM 2026-W24

Security Bulletin: IBM TRIRIGA Cross-Site Scripting Vulnerability

2026-06-12 CVE-2026-11372

mediumIBM 2026-W24

Security Bulletin: Langflow OSS Unauthenticated IDOR on Image Downloads

2026-06-12 CVE-2026-4503

highIBM 2026-W24

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026

2026-06-12 CVE-2026-22745

criticalIBM 2026-W24

Security Bulletin: Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

2026-06-12 CVE-2021-23337

criticalIBM 2026-W24

Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

2026-06-12 CVE-2025-41249

highIBM 2026-W24

Security Bulletin: Multiple vulnerabbilities exist in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager IP Edition core components

2026-06-12 CVE-2026-34268

highIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

2026-06-12 CVE-2018-20225

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM Software Support App

2026-06-12 CVE-2021-23337

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

2026-06-12 CVE-2025-2099

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

2026-06-12 CVE-2026-34043

criticalIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

2026-06-12 CVE-2021-23337

criticalIBM 2026-W24

Security Bulletin: Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.

2026-06-12 CVE-2026-4870

highIBM 2026-W24

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

2026-06-12 CVE-2025-53864

mediumIBM 2026-W24

Security Bulletin: Security Vulnerability in Spring Boot Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-22235)

2026-06-12 CVE-2025-22235

highIBM 2026-W24

Security Bulletin: Security Vulnerability in Spring Cloud Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41235)

2026-06-12 CVE-2025-41235

highIBM 2026-W24

Security Bulletin: Security Vulnerability in Spring Security Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41248)

2026-06-12 CVE-2025-41249

highIBM 2026-W24

Security Bulletin: The IBM Common Licensing product using WebSphere Application Server Liberty is affected by a remote code execution vulnerability (CVE-2025-14914)

2026-06-12 CVE-2025-14914

highIBM 2026-W24

Security Bulletin: Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

2026-06-12 CVE-2026-4503

highIBM 2026-W24

Security Bulletin: upload filename directly from the multipart Content-Disposition header without sanitization

2026-06-12 CVE-2026-4502

mediumIBM 2026-W24

Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

2026-06-11 CVE-2026-42587

criticalIBM 2026-W24

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities in Eclipse Paho Java client library

2026-06-11 CVE-2019-11777

highIBM 2026-W24

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

2026-06-11 CVE-2014-3004

criticalIBM 2026-W24

Security Bulletin: Security Vulnerabilities were found in IBM Security Verify Directory (CVE-2018-2799, CVE-2022-23437)

2026-06-11 CVE-2018-2799

mediumIBM 2026-W24

Security Bulletin: IBM Cloud Pak for Data System 1.0 is affected by multiple vulnerabilities

2026-06-10 CVE-2025-14087

criticalIBM 2026-W24

Security Bulletin: IBM Maximo Scheduler Optimizer uses dompurify-3.2.4.tgz which is vulnerable to CVE-2025-15599, CVE-2026-0540

2026-06-10 CVE-2025-15599

mediumIBM 2026-W24

Security Bulletin: IBM Maximo Scheduler Optimizer uses path-to-regexp-0.1.12.tgz which is vulnerable to CVE-2026-4867

2026-06-10 CVE-2026-4867

highIBM 2026-W24

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is affected by an identity spoofing vulnerability

2026-06-10 CVE-2026-8644

lowIBM 2026-W24

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server is affected by multiple vulnerabilities when using when using Web Server Plug-ins.

2026-06-10 CVE-2026-8633

lowIBM 2026-W24

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server traditional is affected by remote code execution.

2026-06-10 CVE-2026-9330

lowIBM 2026-W24

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server traditional is affected by remote code execution

2026-06-10 CVE-2026-9319

lowIBM 2026-W24

Security Bulletin: Multiple security vulnerabilities have been identified in IBM Db2 shipped with IBM Guardium Key Lifecycle Manager (SKLM/GKLM)

2026-06-10 CVE-2026-1718

highIBM 2026-W24

Security Bulletin: Vulnerabilities in kernel affects IBM Netezza Appliance

2026-06-10 CVE-2025-39979

highIBM 2026-W24

Security Bulletin: IBM App Connect Enterprise is vulnerable to FTP command injection and denial of service due to Node.js module basic-ftp ( CVE-2026-39983 & CVE-2026-41324 )

2026-06-09 CVE-2026-39983

highIBM 2026-W24

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to xmldom (CVE-2026-41672, CVE-2026-41673, CVE-2026-41674 & CVE-2026-41675)

2026-06-09 CVE-2026-41672

highIBM 2026-W24

Security Bulletin: IBM App Connect Enterprise is vulnerable to Uncontrolled Recursion due to Node.js module yaml (CVE-2026-33532)

2026-06-09 CVE-2026-33532

mediumIBM 2026-W24

Security Bulletin: IBM Automation Decision Services for May 2026- Multiple CVEs addressed

2026-06-09 CVE-2025-46295

criticalIBM 2026-W24

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in lodash-4.17.21.tgz

2026-06-09 CVE-2025-13465

criticalIBM 2026-W24

Security Bulletin: Due to use of spring-boot-autoconfigure-3.5.13.jar, IBM Sterling Connect:Direct Web Services is vulnerable to not perform hostname verification.

2026-06-06 CVE-2026-40974

criticalIBM 2026-W23

Security Bulletin: Due to use of spring-security-core-6.5.9.jar, IBM Sterling Connect:Direct Web Services is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition

2026-06-06 CVE-2026-22751

mediumIBM 2026-W23

Security Bulletin: Due to use of spring-web-6.2.17.jar, IBM Sterling Connect:Direct Web Services is vulnerable to allows an attacker to consume available disk space.

2026-06-06 CVE-2026-22740

mediumIBM 2026-W23

Security Bulletin: Due to use of spring-webmvc-6.2.17.jar, IBM Sterling Connect:Direct Web Services is vulnerable toDenial of Service attacks.

2026-06-06 CVE-2026-22745

mediumIBM 2026-W23

Security Bulletin: A vulnerability in the Axios package affects IBM® Db2® Big SQL on IBM Cloud Pak for Data.

2026-06-05 CVE-2025-62718

criticalIBM 2026-W23

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in simple-git

2026-06-05 CVE-2026-6951

criticalIBM 2026-W23

Security Bulletin: IBM watsonx.ai on Cloud Pak for Data is vulnerable to python-Python-3.12.0b4 (Publicly disclosed vulnerability found by Mend) due to python pip package ( CVE-2023-5752, PRISMA-2022-0168)

2026-06-05 CVE-2023-5752

mediumIBM 2026-W23

Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.

2026-06-05 CVE-2021-23337

criticalIBM 2026-W23

Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

2026-06-05 CVE-2021-23337

criticalIBM 2026-W23

Security Bulletin: Multiple vulnerabilities in the minimatch package affects IBM® Db2® Big SQL on IBM Cloud Pak for Data.

2026-06-05 CVE-2026-26996

highIBM 2026-W23

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Axios

2026-06-05 CVE-2025-62718

criticalIBM 2026-W23

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Container Storage Interface (CSI) are now fixed in Storage Scale Container Native 5.2.3.8 / CSI 2.14.7 and Storage Scale Container Native 6.0.1.0 / CSI 3.1.0 or higher

2026-06-05 CVE-2026-9167

mediumIBM 2026-W23

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI, Cloudkit or HDFS layer are now fixed in 5.2.3.7 and 6.0.1.0 or higher

2026-06-05 CVE-2026-27904

highIBM 2026-W23

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI, Cluster Export Services (CES) S3 or HDFS layer are now fixed in 5.2.3.8 and 6.0.1.0 or higher

2026-06-05 CVE-2021-23337

criticalIBM 2026-W23

Security Bulletin: Vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-8644, CVE-2026-9311, CVE-2026-9330 and CVE-2026-9319)

2026-06-05 CVE-2026-9319

criticalIBM 2026-W23

Security Bulletin: A vulnerability has been identified in the Netty framework used by IBM DevOps Plan (CVE-2025-58057)

2026-06-04 CVE-2025-58057

highIBM 2026-W23

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka are vulnerable to loss of confidentiality (CVE-2025-27817, CVE-2025-27818)

2026-06-04 CVE-2025-27818

highIBM 2026-W23

Security Bulletin: IBM Event Processing is vulnerable to a CRLF injection vulnerability in Netty (CVE-2025-67735)

2026-06-04 CVE-2025-67735

mediumIBM 2026-W23