be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), ch.exense.step:step-automation-packages-controller (>=3.29.0, <=3.29.5) +325 more potentially affected by CVE-2026-18661 via org.eclipse.jetty:jetty-annotations (>=11.0.0, <=11.0.26)

org.eclipse.jetty:jetty-annotations MAVEN version =11.0.0, =4.0.0-beta.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =2.5.0, =2.5.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.5 and more Source cves: CVE-2026-18661 Source advisory:...

app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2), app.cash.backfila:client-misk-hibernate (>=0.1.4-20221221.1702-8b7db03, <=2024.05.13.200245-a6430b2) +274 more potentially affected by CVE-2026-18661 via org.eclipse.jetty:jetty-annotations (>=10.0.0, <=10.0.26)

org.eclipse.jetty:jetty-annotations MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221128.2102-bdd85b6, =0.1.4-20221128.2102-bdd85b6, =6.4.0, =6.4.0, =6.4.0, =6.6.0, =6.4.0, =6.4.0, =6.3.0, =3.0.0, =10.0, =9.0.0, =9.0.1 and...

ai.starlake:starlake-spark2_2.11 (>=0.2.7, <=0.2.8), ai.starlake:starlake-spark3_2.12 (>=0.2.7, <=0.2.10) +1297 more potentially affected by CVE-2026-18661 via org.eclipse.jetty:jetty-annotations (>=9.4.0.v20161208, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-annotations MAVEN version =9.4.0.v20161208, =0.2.7, =0.2.7, =2.0.3.release, =2.1.4.release, =2.0.2.release, =1.0.3.release, =0.14, =0.0.2, =0.0.1, =0.9.1, =1.0.0, =1.0.15 and more Source cves: CVE-2026-18661 Source advisory: MEND:CVE-2026-18661...

UBUNTU-CVE-2026-18661

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

CVE-2026-18661: Incorrect Authorization

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

CVE-2026-18661

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

PT-2026-114860

In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...

CVE-2026-108381

The dataclasses-avroschema library (versions 0.44.0 through 0.70.5 ) is vulnerable to code injection within its Pydantic and AvroDantic model generators. The vulnerability occurs because the library inserts a schema field's pydantic-class value into a generated field annotation without safely res...

CVE-2026-108381 dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a...

CVE-2026-108381 dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a...

CVE-2026-94603

Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL,...

threatspec

threatspec - modelado de amenazas continuo, a través del código Threatspec es un proyecto de código abierto que tiene como objetivo cerrar la brecha entre el desarrollo y la seguridad al incorporar el proceso de modelado de amenazas más profundamente en el proceso de desarrollo. Esto se logra...

openSUSE 16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (openSUSE-SU-2026:22034-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22034-1 advisory. - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues bsc1273856. - CVE-2026-19032:...

Security update for jackson-annotations, jackson-core, jackson-databind (important)

openSUSE security update: security update for jackson-annotations, jackson-core, jackson-databind ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22034-1 Rating: important References: bsc1273856 bsc1273857 bsc1277883 bsc1278008 bsc1280125 bsc1282491...

SUSE-SU-2026:24149-1 Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues bsc1273856. - CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-suppli...

OPENSUSE-SU-2026:22034-1 Security update for jackson-annotations, jackson-core, jackson-databind

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues bsc1273856. - CVE-2026-19032: deserializer for java.nio.file.Path resolves attacker-suppli...

podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation

A flaw was found in Podman. When a container image with checkpoint annotations is executed using the podman run command, Podman treats the image as a restored checkpoint and ignores user-specified sandboxing options, such as dropped privileges. An attacker can exploit this issue by enticing a use...

podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation

A flaw was found in Podman. When a container image with checkpoint annotations is executed using the podman run command, Podman treats the image as a restored checkpoint and ignores user-specified sandboxing options, such as dropped privileges. An attacker can exploit this issue by enticing a use...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-annotations / pki-jackson-annotations-javadoc (ALMALINUX9.2:CLSA-2025:1764847045)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764847045 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...

CVE-2026-62146

A trust-boundary flaw in CRI-O 's sandbox state persistence allows a user with permissions to create Pods to perform sandbox state poisoning . By using arbitrary pod annotations , an attacker can overwrite reserved sandbox bookkeeping. Following a CRI-O restart or node reload, this can lead to th...