258 matches found
EUVD-2026-114899
Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...
CVE-2026-84172
Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...
CVE-2026-84172
Apache Wicket is vulnerable to a file disclosure issue where component markup is served as a package resource. The root cause lies in org.apache.wicket.markup.html.PackageResourceGuard; when wicket-core is loaded by a class loader that cannot see the application's classes (e.g., in shared library...
spring-shell-vuln
spring-shell-vuln Spring4Shell: Spring core RCE vulnerability Spring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965. Some information about the Spring4She...
log4j-CVE-2021-44228-workaround
log4j-CVE-2021-44228-workaround A. Solution Description This project provides a general purpose workaround for the log4j CVE-2021-44228 vulnerability, which can be used in case you do not have the alternative in short term to re-build your respective project or to patch the log4j-core jars. The...
cve-2022-22965
Minimal CVE-2022-22965 example At the time of writing, spring-web request params binding WebDataBinder, by default allows accessing object's getClass method. This is an internal jvm specific implementation detail imho shouldn't be exposed. As such, its features may change and be expanded with...
SUSE CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
DEBIAN-CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
AZL-111112 CVE-2026-116486 affecting package objenesis 3.3-1
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
UBUNTU-CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
CVE-2026-116486
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
EUVD-2026-109813
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
PT-2026-123336
Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...
SUSE CVE-2026-55543
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...
Linux Distros Unpatched Vulnerability : CVE-2026-55543
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive,...
DEBIAN-CVE-2026-55543
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...
CVE-2026-55543
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...
CVE-2026-55543
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...