Exploit for CVE-2026-16723

FastJson 1.2.83 GenProbe2 Purpose: Used to reproduce the...

CVE-2026-111440

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-111440

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-111440 JDBC LogFactory 任意类加载/构造导致潜在 RCE

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-111440 JDBC LogFactory 任意类加载/构造导致潜在 RCE

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

EUVD-2026-104058

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-111440

The openGauss-connector-jdbc driver is vulnerable to unsafe reflection in the LogFactory.java component. The LogFactory uses Class.forName to load a logger class based on the logger class name provided in JDBC connection parameters. Because it lacks an asSubclass(Log.class) check, it reflects and...

PT-2026-117217

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-111440: Use of Externally-Controlled Input to Select Classes or Code

在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclassLog.class 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath...

CVE-2026-97666

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

EUVD-2026-102153

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

CVE-2026-97666 Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

CVE-2026-97666

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

CVE-2026-97666: Use of Externally-Controlled Input to Select Classes or Code

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-19032, CVE-2026-83557 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. ...

Medium: jackson-databind

Issue Overview: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throw...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3208)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3208 advisory. jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string...

java-remote-class-loader

Esta herramienta te permite enviar bytecode de Java en forma de archivos de clase a tus clientes o potenciales objetivos para cargarlos y ejecutarlos usando ClassLoader de Java junto con la API Reflect. El cliente recibe el archivo de clase del servidor y devuelve la salida de ejecución...

Security Bulletin: Vulnerability jackson-databind, golang.org/x/mod, image-size, bcprov-jdk18on, bcpkix-jdk18on, pyasn, setuptools, Mako, paramiko, http2-common Oct 2026v1

Summary jackson-databind CVE-2026-19032, CVE-2026-83557,CVE-2026-19032, golang.org/x/mod CVE-2026-56864, CVE-2026-56865, image-size CLEVOS-111792, bcprov-jdk18on CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055,...

CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...