EUVD-2026-58667

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58660

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, aactl...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: bom, kargo, syft, argo-events, argocd-image-updater, crossplane, trivy, timoni, skaffold, zot, flux-source-controller, k9s, flux-kustomize-controller, dagger, gitsign, zarf, pulumi-language-java, argo-workflows, flux-image-automation-controller, scorecard, kubescape,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: bom, kargo, syft, argo-events, argocd-image-updater, crossplane, trivy, timoni, skaffold, zot, flux-source-controller, k9s, flux-kustomize-controller, dagger, gitsign, zarf, pulumi-language-java, argo-workflows, flux-image-automation-controller, scorecard, kubescape,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: bom, kargo, xeol, syft, argo-events, argocd-image-updater, crossplane, steampipe, trivy, snyk-cli, skaffold, zot, teleport, gomplate, flux-source-controller, cerbos, trivy-operator, k9s, dagger, gitsign, external-secrets-operator, pulumi-language-java, argo-workflows...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: rancher-helm, argocd-image-updater, spicedb-operator, cluster-autoscaler, kubescape-operator, witness, slsa-verifier, victoriametrics-cluster, k9s, volume-modifier-for-k8s, kube-vip, nri-discovery-kubernetes, external-secrets-operator, kube-logging-operator,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, aactl...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: syft, argocd-image-updater, docker-compose, witness, slsa-verifier, k9s, dagger, external-secrets-operator, pulumi-language-java, tkn, docker, glab, tw, flux-image-automation-controller, nuclei, crossplane-provider-family-aws, osv-scanner, argo-cd,...

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation

A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...

CVE-2026-18511

IBM i 7.3–7.6 is affected by CVE-2026-18511. The vulnerability arises in the Native IBM i JSSE provider during TLS session establishment due to improper bounds checking, allowing a local authenticated attacker to overflow a fixed-length buffer and potentially execute arbitrary code or crash the J...

EUVD-2026-58468

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249

IBM i 7.3–7.6 is vulnerable to privilege escalation via improper pointer validation from Java-controlled addresses (CWE-269), requiring a remote authenticated attacker with low privileges. IBM provides PTFs for all affected releases (e.g., SJ11037 for 7.6); no workarounds are available. No exploi...

CVE-2026-18193 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses...

CVE-2026-18193

CVE-2026-18193 affects IBM i versions 7.3, 7.4, 7.5, and 7.6, specifically the IBM SDK Java Technology Edition and IBM Runtime Environment Java components. The root cause is improper validation of user-controlled addresses (CWE-269: Improper Privilege Management), allowing a remote attacker to by...

CVE-2026-18086 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...

CVE-2026-18086

IBM i 7.3–7.6 is affected by CVE-2026-18086 in Java Secure Sockets Extension where improper bounds checking could allow a local attacker to execute arbitrary code or cause a denial of service. The NVD/NVD IBM bulletin describe the root cause as bounds-checking issues in JSSE, with a base CVSS v3....

CVE-2026-18086 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...