CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

hibernate__hibernate-validator_CVE-2019-10219_6-0-17-Final

Hibernate Validator Version: 6.0.17.Final - 13-06-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

hibernate__hibernate-validator_CVE-2019-10219_6_0_18_Final_fixed

Hibernate Validator Version: 6.0.18.Final - 25-10-2019 What is it? This is the reference implementation of JSR-380 - Bean Validation 2.0. Bean Validation defines a metadata model and API for JavaBean as well as method validation. The default metadata source are annotations, with the ability to...

CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injection ★ CVE-2026-0603 Hibernate SQL Injection PoC ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Overview CVE-2026-0603 is a Second-Order SQL Injection vulnerability in Hibernate ORM , a widely used Ja...

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.4 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.6 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

cve-2021-44228--spring-hibernate

CVE-2021-44228 POC - Spring / Hibernate This POC uses Spring / Hibernate, however a similar approach of rmi - deserialization could be used to trigger any deserialization vulnerability TL;DR $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-binary...

hibernate-orm

Hibernate ORM is a library providing Object/Relational Mapping ORM support to applications, libraries, and frameworks. It also provides an implementation of the JPA specification, which is the standard Java specification for ORM. This is the repository of its source code: see Hibernate.org for...

CVE-2026-90290

A flaw was found in the Linux kernel's hibernate functionality for arm64 architectures. When the system attempts to save memory tags during hibernation, a failure in this process can prevent the proper restoration of the Disable Asynchronous Interrupts and Fast interrupts DAIF state. This leaves...

CVE-2026-93879

A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be...

CVE-2026-94451

The Quarkus REST Data Panache component is vulnerable to information disclosure and denial of service (DoS) due to an unvalidated sort parameter . An attacker can exploit this flaw on certain endpoints to gain unauthorized access to information or force the database to perform complex tasks, pote...

CVE-2026-94451 Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

com.hazelcast:hazelcast-client (3.1.7), com.hazelcast:hazelcast-cloud (3.1.7) +8 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.1.7)

com.hazelcast:hazelcast MAVEN version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.1.7 - com.hazelcast:hazelcast-cloud 3.1.7 - com.hazelcast:hazelcast-hibernate...

com.hazelcast:hazelcast-client (3.1.2), com.hazelcast:hazelcast-cloud (3.1.2) +8 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.1.2)

com.hazelcast:hazelcast MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.1.2 - com.hazelcast:hazelcast-cloud 3.1.2 - com.hazelcast:hazelcast-hibernate...

com.hazelcast:hazelcast-all (1.9.4.5), com.hazelcast:hazelcast-client (1.9.4.5) +5 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (1.9.4.5)

com.hazelcast:hazelcast MAVEN version 1.9.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 1.9.4.5 - com.hazelcast:hazelcast-client 1.9.4.5 - com.hazelcast:hazelcast-cloud...

com.hazelcast:hazelcast-client (3.3-ea), com.hazelcast:hazelcast-cloud (3.3-ea) +9 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.3-ea)

com.hazelcast:hazelcast MAVEN version 3.3-ea is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.3-ea - com.hazelcast:hazelcast-cloud 3.3-ea - com.hazelcast:hazelcast-hibernate...

com.hazelcast:hazelcast-all (1.9.4.3), com.hazelcast:hazelcast-client (1.9.4.3) +5 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (1.9.4.3)

com.hazelcast:hazelcast MAVEN version 1.9.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-all 1.9.4.3 - com.hazelcast:hazelcast-client 1.9.4.3 - com.hazelcast:hazelcast-cloud...

com.hazelcast:hazelcast-client (3.0.2), com.hazelcast:hazelcast-cloud (3.0.2) +7 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.0.2)

com.hazelcast:hazelcast MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.0.2 - com.hazelcast:hazelcast-cloud 3.0.2 - com.hazelcast:hazelcast-hibernate...

com.hazelcast:hazelcast-client (3.2.2), com.hazelcast:hazelcast-cloud (3.2.2) +9 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.2.2)

com.hazelcast:hazelcast MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-client 3.2.2 - com.hazelcast:hazelcast-cloud 3.2.2 - com.hazelcast:hazelcast-hibernate...