Latest high severity vulnerabilities for "ibm watsonx.data intelligence"

pip/pillowPillow is vulnerable to a FITS GZIP decompression bomb

Risk 47

Severity

8.7

First published (updated )

CVE-2026-40192

Apache TomcatApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Risk 46

Severity

7.5

First published (updated )

CVE-2026-34486

Apache TomcatApache Tomcat: TLS cipher order is not preserved

Risk 46

Severity

7.5

First published (updated )

CVE-2026-29129

npm/serialize-javascriptSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

Risk 43

Severity

7.5

First published (updated )

CVE-2026-34043

npm/node-forgeForge has signature forgery in Ed25519 due to missing S > L check

Risk 31

Severity

7.5

EPSS

0.03%

First published (updated )

CVE-2026-33895

npm/node-forgeForge has signature forgery in RSA-PKCS due to ASN.1 extra field

Risk 31

Severity

7.5

EPSS

0.03%

First published (updated )

CVE-2026-33894

npm/node-forgeForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Risk 31

Severity

7.5

EPSS

0.04%

First published (updated )

CVE-2026-33891

npm/path-to-regexppath-to-regexp vulnerable to Denial of Service via sequential optional groups

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-4926

npm/brace-expansionbrace-expansion: Zero-step sequence causes process hang and memory exhaustion

Risk 43

Severity

7.5

First published (updated )

CVE-2026-33750

npm/path-to-regexppath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-4867

npm/picomatchPicomatch has a ReDoS vulnerability via extglob quantifiers

Risk 31

Severity

7.5

EPSS

0.04%

First published (updated )

CVE-2026-33671

IBM WebSphere Application ServerIBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability

Risk 66

Severity

7.2

First published (updated )

CVE-2025-14915

npm/flattedflatted: Prototype Pollution via parse()

Risk 61

Severity

8.9

EPSS

0.03%

First published (updated )

CVE-2026-33228

pip/nltkNLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

Risk 31

Severity

7.5

EPSS

0.04%

First published (updated )

CVE-2026-33231

npm/socket.io-parsersocket.io allows an unbounded number of binary attachments

Risk 33

Severity

8.7

EPSS

0.08%

First published (updated )

CVE-2026-33151

NaturalIntelligence fast-xml-parserfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Risk 31

Severity

7.5

EPSS

0.04%

First published (updated )

CVE-2026-33036

npm/undiciundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

Risk 43

Severity

7.5

First published (updated )

CVE-2026-2229

npm/undiciundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

Risk 43

Severity

7.5

First published (updated )

CVE-2026-1528

npm/undiciundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

Risk 43

Severity

7.5

First published (updated )

CVE-2026-1526

npm/flattedflatted: Unbounded recursion DoS in parse() revive phase

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-32141

npm/node-tarnode-tar Symlink Path Traversal via Drive-Relative Linkpath

Risk 31

Severity

8.2

EPSS

0.01%

First published (updated )

CVE-2026-31802

npm/immutableImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Risk 61

Severity

8.7

EPSS

0.06%

First published (updated )

CVE-2026-29063

pypi/nltkPath Traversal in nltk/nltk

Risk 64

Severity

7.5

First published (updated )

CVE-2026-0847

npm/minimatchminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-27904

npm/minimatchminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Risk 31

Severity

7.5

EPSS

0.05%

First published (updated )

CVE-2026-27903

nltk/nltkZip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

Risk 87

Severity

8.8

First published (updated )

CVE-2025-14009

npm/tarnode-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

Risk 38

Severity

7.1

EPSS

0.01%

First published (updated )

CVE-2026-26960

Apache AvroApache Avro Java SDK: Code injection on Java generated code

Risk 55

Severity

7.3

First published (updated )

CVE-2025-33042

pip/pillowPillow has an out-of-bounds write when loading PSD images

Risk 61

Severity

8.9

EPSS

0.02%

First published (updated )

CVE-2026-25990

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty Path Traversal

Risk 60

Severity

7.6

First published (updated )

CVE-2025-14914

Trending

Versions

pip/pillowPillow is vulnerable to a FITS GZIP decompression bomb

Apache TomcatApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Apache TomcatApache Tomcat: TLS cipher order is not preserved

npm/serialize-javascriptSerialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

npm/node-forgeForge has signature forgery in Ed25519 due to missing S > L check

Don't miss critical vulnerabilities

npm/node-forgeForge has signature forgery in RSA-PKCS due to ASN.1 extra field

npm/node-forgeForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

npm/path-to-regexppath-to-regexp vulnerable to Denial of Service via sequential optional groups

npm/brace-expansionbrace-expansion: Zero-step sequence causes process hang and memory exhaustion

npm/path-to-regexppath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Don't miss critical vulnerabilities

npm/picomatchPicomatch has a ReDoS vulnerability via extglob quantifiers

IBM WebSphere Application ServerIBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability

npm/flattedflatted: Prototype Pollution via parse()

pip/nltkNLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

npm/socket.io-parsersocket.io allows an unbounded number of binary attachments

Don't miss critical vulnerabilities

NaturalIntelligence fast-xml-parserfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

npm/undiciundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

npm/undiciundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

npm/undiciundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

npm/flattedflatted: Unbounded recursion DoS in parse() revive phase

Don't miss critical vulnerabilities

npm/node-tarnode-tar Symlink Path Traversal via Drive-Relative Linkpath

npm/immutableImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

pypi/nltkPath Traversal in nltk/nltk

npm/minimatchminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

npm/minimatchminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Don't miss critical vulnerabilities

nltk/nltkZip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

npm/tarnode-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

Apache AvroApache Avro Java SDK: Code injection on Java generated code

pip/pillowPillow has an out-of-bounds write when loading PSD images

IBM WebSphere Application Server LibertyIBM WebSphere Application Server Liberty Path Traversal

Don't miss critical vulnerabilities

Company

Resources

Contact