PT-2026-67229

In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.0.2 2.0.X series and 2.1.3 2.1.X series...

Linux Distros Unpatched Vulnerability : CVE-2026-12816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS befo...

Linux Distros Unpatched Vulnerability : CVE-2026-13506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67340

ArcadeDB (a Java multi-model database) versions before 26.7.2 allow post-authentication remote code execution via JavaScript trigger scripts. The ScriptTriggerExecutor includes java.lang.* in the GraalVM polyglot host-class allow-list, so an authenticated user with only the UPDATE_SCHEMA permissi...

CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

EUVD-2026-51813

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

Oracle Linux 10 / 9 : java-25-openjdk (ELSA-2026-42899)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42899 advisory. 25.0.4.0.7-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:25.0.4.0.7-1.0 - Update to jdk-25.0.4+7 GA - Update release notes to 25.0.4+7 -...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect Client and Virtual Environments includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in the IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partia...

Security Bulletin: IBM Storage Protect for Space Management is affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM Storage Protect for Space Management includes IBM SDK, Java Technology Edition to support Java-based components. Multiple vulnerabilities in IBM SDK, Java Technology Edition could allow an attacker to obtain unauthorized access to sensitive information or cause a partial denial of...

RHSA-2026:42899 Red Hat Security Advisory: java-25-openjdk security update

Bulletin has no description...

K000162704: Oracle Java vulnerability CVE-2026-62574

Security Advisory Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Install. Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for...

Joern 4.0.593

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

The vulnerability of Java Cryptography Libraries Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS lies in their uncontrolled resource consumption, which allows attackers to cause service failures.

The vulnerability of Java Cryptographic Libraries, specifically Bouncy Castle for Java FIPS and Bouncy Castle for Java LTS, is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the FrodoEngine.Java file in the Bouncy Castle cryptographic library for the Java platform allows a hacker to disclose protected information.

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library relates to the use of hidden time channels for data transmission. Exploiting this vulnerability allows a remote attacker to disclose the protected information...

openSUSE 16: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (openSUSE-SU-2026:21467-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21467-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...

RockyLinux 9 : java-25-openjdk (RLSA-2026:42899)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42899 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance...

SUSE SLES15: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2026:3406-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3406-1 advisory. Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and deni...

The vulnerability of the bcprov cryptographic library for the Java platform, Bouncy Castle, allows a perpetrator to disclose protected information.

The vulnerability of the bcprov cryptographic library for the Java platform, Bouncy Castle, is related to the failure to take measures to neutralize special elements in LDAP requests. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by...

openSUSE 16: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (openSUSE-SU-2026:21470-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21470-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...