Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

CLSA-2026-1786594683 TuxCare security update for com.mchange:mchange-commons-java (1 CVE)

TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.19-tuxcare.2...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

UBUNTU-CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

PT-2026-71861

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

java-17-openjdk security update

1:17.0.20.0.8-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.0.8-1.1 - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Add .0 to prelease 1:17.0.20.0.8-1.1 - Sync NEWS from private-gnuandrew-rhel-8.5-vanilla 1:17.0.20.0.8-1.1 - Set tzdata requires and build...

Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2026-42887)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42887 advisory. 1:17.0.20.0.8-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.0.8-1.1 - Sync java-17-openjdk-portable.specfile from...

Alibaba Cloud Linux 3 : 0249: java-1.8.0-openjdk (ALINUX3-SA-2026:0249)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0249 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-66293: LIBPNG is a reference...

Alibaba Cloud Linux 3 : 0248: java-17-openjdk (ALINUX3-SA-2026:0248)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0248 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-66293: LIBPNG is a reference...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Linux Distros Unpatched Vulnerability : CVE-2026-48791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor ent...

CVE-2026-48791

CVE-2026-48791 affects dev.sigstore:sigstore-java:2.0.0. The vulnerability arises from missing verification of the integratedTime (Rekor) against the Fulcio certificate during bundle verification, later re-added with fixes in 2.1.0. The issue is limited to users verifying bundles with 2.0.0; 2.1....

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791 Sigstore Java has a vulnerability with bundle verification of integratedTime

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-17029, CVE-2026-18511, CVE-2026-18068, CVE-2026-18086 in Java Secure Sockets Extension JSSE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17029 DESCRIPTION: IBM i could allow a local attacke...

Security Bulletin: IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

Summary IBM i is vunlerable to multiple vulnerabilities CVE-2026-18193, CVE-2026-18249, CVE-2026-17476 in IBM SDK Java Technology Edition and IBM Runtime Environment Java to support the building and running of Java applications as described in the vulnerability details section. Vulnerability...

Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management

A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer...

MINI-22XJ-7W64-CQGC

Bulletin has no description...

K000162892: OpenJDK vulnerability CVE-2026-60526

Security Advisory Description Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to...