openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The DTLS implementation is open to two different DoS attacks...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

CLEANSTART-2026-JL16166 Security fixes in spark-sc212-jdk17-py311 4.0.2-r1

Package spark-sc212-jdk17-py311 version 4.0.2-r1 fixes 1 vulnerabilities: ghsa-c3fc-8qff-9hwx...

CLEANSTART-2026-VE13985 Security fixes in openjdk8 8.302.08-r0

Package openjdk8 version 8.302.08-r0 fixes 3 vulnerabilities: CVE-2021-2341, CVE-2021-2369, CVE-2021-2388...

CVE-2026-47873

The Boots Dashboard Docker integration in Spring Tools exposes container control ports on all host interfaces (0.0.0.0) instead of restricting to loopback, affecting Spring Tools for Eclipse (version 5.2.0 and earlier). The CVE-2026-47873 entry indicates a high-severity issue with CVSS 3.1: AV Ad...

EUVD-2026-50970

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

PT-2026-66364

Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Spring Tools for VSCode / Cursor / Theia versions prior to 2.2.1 Description Starting Spring Boot applications in Spring Tools with the live information mode enabled allows for remote code...

PT-2026-66568

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description A remote code execution issue exists in the SOAP/JMX connector. SOAP Simple Object Access Protocol is a messaging protocol specification for...

IBM Java 7.1 < 7.1.5.31 / 8.0 < 8.0.8.70 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.31 / 8.0 prior to 8.0.8.70. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 21 2026 CPU advisory. - Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c...

IBM Java 7.1 < 7.1.5.31 / 8.0 < 8.0.8.70 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.31 / 8.0 prior to 8.0.8.70. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update July 2026 advisory. - In Eclipse OpenJ9 versions up to 0.60, when executing class files where a...

Security update for java-25-openjdk (important)

openSUSE security update: security update for java-25-openjdk ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21467-1 Rating: important References: bsc1264994 bsc1272223 bsc1272224 bsc1272225 bsc1272227 bsc1272228 bsc1272235 bsc1272236 bsc1272237...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

EUVD-2026-41152

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion...

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

EUVD-2026-50331

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-16308

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3406-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...