CVE-2026-70410 Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite Avatica. Plugin instantiation via AvaticaUtilsinstantiatePlugin and other methods initializes arbitrary classes via unrestricted calls to Class.forNameString which by default triggers...

CVE-2026-53042

A flaw was found in the Linux kernel's fwctl module. An issue with the class initialization ordering can lead to a null pointer dereference when a device is removed. This can cause a system crash, resulting in a Denial of Service DoS...

EUVD-2026-38910

In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use moduleinit, so cxlpcidriverinit runs first. When cxlpciprobe calls fwctlregister and then...

CVE-2026-53042 fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use moduleinit, so cxlpcidriverinit runs first. When cxlpciprobe calls fwctlregister and then...

CVE-2026-53042 fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

In the Linux kernel, the following vulnerability has been resolved: fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal CXL is linked before fwctl in drivers/Makefile. Both use moduleinit, so cxlpcidriverinit runs first. When cxlpciprobe calls fwctlregister and then...

Unsafe Reflection

Overview Affected versions of this package are vulnerable to Unsafe Reflection that leads to arbitrary class instantiation, via the instantiateExtension method in the ExtensionLoader class. An attacker can trigger the static initializer of any class present on the classpath by supplying a model...

CVE-2026-42027

Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtensionClass, String method loads a class by its fully-qualified name via Class.forName and invokes its...

PT-2026-51936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fwctl component where incorrect class initialization ordering can lead to a NULL pointer dereference during device removal. Because CXL is linked before fwctl in t...

EUVD-2025-29428

Malicious code in bioql PyPI...

GHSA-29G5-M8V7-V564 Measured is vulnerable to Path Traversal attacks during class initialization

Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files. Patches Users should update to the latest version...

Measured is vulnerable to Path Traversal attacks during class initialization

Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files. Patches Users should update to the latest version...

jackson-databind:AdaLObjectReader3Fuzzer: Security exception in jaz.Zer.<clinit>

Project: https://github.com/FasterXML/jackson-databind.git Detailed Report: https://oss-fuzz.com/testcase?key=6525496154521600 Project: jackson-databind Fuzzing Engine: libFuzzer Fuzz Target: AdaLObjectReader3Fuzzer Job Type: libfuzzerasanjackson-databind Platform Id: linux Crash Type: Security...

tomcat:ELEvaluationFuzzer: Security exception in jaz.Zer.<clinit>

Project: https://github.com/apache/tomcat.git Detailed Report: https://oss-fuzz.com/testcase?key=4839550299537408 Project: tomcat Fuzzing Engine: libFuzzer Fuzz Target: ELEvaluationFuzzer Job Type: libfuzzerasantomcat Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

guice:InjectorFuzzer: Uncaught exception in jaz.Zer.<clinit>

Project: https://github.com/google/guice.git Detailed Report: https://oss-fuzz.com/testcase?key=5750316273893376 Project: guice Fuzzing Engine: libFuzzer Fuzz Target: InjectorFuzzer Job Type: libfuzzerasanguice Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: jaz.Zer...

xmlpull:PullParserFactoryFuzzer: Uncaught exception in jaz.Zer.<clinit>

Project: https://github.com/xmlpull-org/xmlpull-api-v1.git Detailed Report: https://oss-fuzz.com/testcase?key=5118590539399168 Project: xmlpull Fuzzing Engine: libFuzzer Fuzz Target: PullParserFactoryFuzzer Job Type: libfuzzerasanxmlpull Platform Id: linux Crash Type: Uncaught exception Crash...

apache-commons-jxpath:JXPathFuzzer: Uncaught exception in jaz.Zer.<clinit>

Detailed Report: https://oss-fuzz.com/testcase?key=4854085561483264 Project: apache-commons-jxpath Fuzzing Engine: libFuzzer Fuzz Target: JXPathFuzzer Job Type: libfuzzerasanapache-commons-jxpath Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: jaz.Zer...

xmlpull:PullParserFactoryFuzzer: Uncaught exception in jaz.Zer.<clinit>

Detailed Report: https://oss-fuzz.com/testcase?key=6215041596129280 Project: xmlpull Fuzzing Engine: libFuzzer Fuzz Target: PullParserFactoryFuzzer Job Type: libfuzzerasanxmlpull Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash State: jaz.Zer...

Eclipse OpenJ9 安全漏洞

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. A security vulnerability exists in Eclipse Openj9 version 0.25, which stems from the fact that the jdk.internal.reflect.ConstantPool API causes the JVM to pre-parse...

Security update for java-11-openjdk (important)

openSUSE Security Update: Security update for java-11-openjdk Announcement ID: openSUSE-SU-2019:0161-1 Rating: important References: 1120431 1122293 1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilitie...