SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-demo / etc (SUSE-SU-2026:3615-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3615-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycm...

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Fri Aug 14 20:25:19 CDT 2026 Updated: Fri Aug 21 10:35:27 CDT 2026 Update: Updated the summary to highlight the additional installation instructions. The most recent version of this document is available here:...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: direnv, fscrypt, witness, spire-controller-manager, cert-manager-istio-csr, grafana-agent-operator, sftpgo-plugin-auth, hubble, stakater-reloader, kubeflow, podinfo, src, vale, secrets-store-csi-driver-provider-aws, vault-secrets-webhook, openbao-k8s, aws-flb-firehos...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: fscrypt, witness, spire-controller-manager, cert-manager-istio-csr, grafana-agent-operator, hubble, stakater-reloader, src, secrets-store-csi-driver-provider-aws, vault-secrets-webhook, openbao-k8s, aws-flb-firehose, authservice, kubelet-csr-approver, cilium-cli,...

CVE-2026-56859 vulnerabilities

Vulnerabilities for packages: fscrypt, witness, spire-controller-manager, cert-manager-istio-csr, grafana-agent-operator, hubble, stakater-reloader, src, secrets-store-csi-driver-provider-aws, vault-secrets-webhook, openbao-k8s, aws-flb-firehose, authservice, kubelet-csr-approver, cilium-cli,...

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

EUVD-2026-41135

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"...

SUSE-SU-2026:3623-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Security issues fixed: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize bsc1272459. - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data bsc127222...

DEBIAN-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58667

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58660

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, aactl...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: timoni, apko, flux-kustomize-controller, tfsec, gptscript, zot, goreleaser, argo-events, snyk-cli, zarf, dagger, go-licenses, kubevela, k9s, flux-source-controller, k8sgpt, argocd-image-updater, pulumi-language-yaml, syft, crossplane, kots, grafana-alloy, scorecard,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: timoni, apko, flux-kustomize-controller, tfsec, gptscript, zot, goreleaser, argo-events, snyk-cli, zarf, dagger, go-licenses, kubevela, k9s, flux-source-controller, k8sgpt, argocd-image-updater, pulumi-language-yaml, syft, crossplane, kots, grafana-alloy, scorecard,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: apko, tfsec, gptscript, witness, zot, snyk-cli, argo-events, zarf, cerbos, dagger, kubevela, k9s, steampipe, flux-source-controller, pulumi-language-yaml, argocd-image-updater, syft, argo-cd, crossplane, kots, grafana-alloy, scorecard, teleport, gitaly, xeol, gomplat...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, kubernetes-event-exporter, jitsucom-bulker, spqr, flux-kustomize-controller, kubo, promxy, witness, dapr, fuse-overlayfs-snapshotter, goreleaser, octo-sts, snyk-cli, zarf, dask-gateway, k9s, kube-state-metrics,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, aactl...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, flux-kustomize-controller, fscrypt, witness, snyk-cli, zarf, k9s, docker-machine-driver-linode, ko, traefik, crossplane-provider-aws-route53, pulumi-language-yaml, falcoctl, k8sgpt, atlantis, fulcio, step, terragrunt,...