ibm.com resources | appsec.fyi

ibm.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-08.

AI 1 API Sec 1 AuthN 1 Deser 1 Python 1 RCE 1 XSS 1 XXE 1

Date Added	Resource	Excerpt
2026-11-08 2026	IBM: arbitrary code execution in Qiskit SDK QPY deserialization AI Deser Python RCE	Bulletin on CVE-2026-116499, an arbitrary code execution vulnerability in IBM's Qiskit SDK. Versions prior to 13.0 of the QPY deserialization process are susceptible to specially crafted payloads that can execute embedded Python code without privilege escalation, impacting the `qiskit.qpy.load()` function. The issue is patched in Qiskit v2.6.2.
2026-06-19 2026	API Sprawl API Sec	Analysis of API Sprawl discusses the security risks and inefficiencies arising from unmanaged and undocumented APIs. Fueled by factors like decentralized development, microservices architectures, and DevOps practices, API sprawl leads to an expanded attack surface, with instances of shadow and zombie APIs posing significant threats. Organizations like Imperva report having more active APIs than they are aware of, contributing to an average of 10% to 20% more. This proliferation, highlighted by SALT's survey showing 57% of organizations suffering API-related data breaches, underscores the urgent need for robust API management and governance to mitigate security vulnerabilities and costs.
2026-04-19 2026	IBM Business Automation Workflow XXE (CVE-2025-13096)XXE	Bulletin concerning CVE-2025-13096, an XML external entity injection (XXE) vulnerability affecting IBM Business Automation Workflow. This flaw, categorized under CWE-918 (Server-Side Request Forgery), allows remote attackers to potentially expose sensitive information or consume memory resources. IBM recommends applying the Interim Fix (iFix) or Cumulative Fix (CF) containing DT456229 to remediate this issue.
2026-04-10 2026	IBM: What is XML Signature Wrapping?AuthN	Library detailing XML Signature Wrapping (XSW) attacks, a vulnerability class impacting applications using XML-based security protocols like SAML, SOAP, and WS-Security. These attacks exploit XML's structural flexibility to trick systems into processing unauthenticated data while maintaining signature validity. The library covers attack methods such as element wrapping, ID attribute manipulation, namespace abuse, and XPath injection, highlighting their potential consequences like unauthorized access and privilege escalation through scenarios involving SAML SSO and SOAP web services.
2026-03-26 2026	CISA and FBI release secure-by-design guidelines on cross-site scripting XSS	Alert from CISA and FBI providing secure-by-design guidelines to eliminate cross-site scripting (XSS) vulnerabilities. The alert details how XSS exploits user trust, enabling session hijacking, data theft, and malware installation, referencing past attacks like the ResumeLooters breach and the Fortnite incident. It advocates for proactive measures including input validation, output encoding, and Content Security Policies (CSP), aligning with broader secure-by-design principles for developers to build security into applications from inception.