Oracle WebLogic Server Multiple Vulnerabilities (July 2026 CPU) (12.2.1.4.0 / 14.1.1.0.0 / 15.1.1.0.0)

The 12.2.1.4.0, 14.1.1.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Easily...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 8.0.9-IF0002 Vulnerability Details CVEID:CVE-2026-5598 DESCRIPTION: Covert timing channel vulnerability in Legion of the...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...

Covert timing channel vulnerability at Bouncy Castle dependency at Crucible Server

This High severity Covert timing channel vulnerability was introduced in version 4.9.0 of Crucible Server. Atlassian recommends that Crucible Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crucible Da...

bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...

CVE-2026-5598

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...

EUVD-2026-22872

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all core modules. Non-constant time comparisons risk private key leakage in FrodoKEM. This issue affects BC-JAVA: from 2.17.3 before 1.84...

SUSE CVE-2026-5598

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all core modules. This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84...

CVE-2026-5598

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all core modules. This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84...

CVE-2026-5598

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all core modules. This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.80.1, from 1.82 before 1.84...

CVE-2026-5598

CVE-2026-5598 affects BC-JAVA (Legion of the BC) where non-constant time comparisons in FrodoKEM can create a covert timing channel that risks private-key leakage. Affected line: BC-JAVA from 2.17.3 before 1.84. The issue is rated as CRITICAL (CVSSv4-like metrics shown: NETWORK, LOW ATTACK, no us...

CVE-2026-5598

Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all core modules. This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84...

com.palantir.conjure.java:conjure-java-core (8.25.0), com.palantir.conjure.java:conjure-java-undertow-runtime (8.25.0) +8 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (2.2.34.final)

io.undertow:undertow-core MAVEN version 2.2.34.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.palantir.conjure.java:conjure-java-core 8.25.0 -...

com.palantir.conjure.java:conjure-java-core (>=3.8.1, <=3.9.1), com.palantir.conjure.java:conjure-java-undertow-runtime (>=3.0.0, <=3.9.1) +4 more potentially affected by CVE-2026-3260 via io.undertow:undertow-core (2.0.18.final)

io.undertow:undertow-core MAVEN version 2.0.18.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.palantir.conjure.java:conjure-java-core =3.8.1, =3.0.0, =3.0.0, =3.9.1 - io.undertow:karaf...

com.github.housepower:clickhouse-native-jdbc (2.6.0), org.apache.beam:beam-sdks-java-core (>=2.29.0, <=2.72.0) +1 more potentially affected by CVE-2025-67721 via io.airlift:aircompressor (0.18)

io.airlift:aircompressor MAVEN version 0.18 is affected by a known vulnerability. The following packages have a transitive dependency on io.airlift:aircompressor and may be impacted: - com.github.housepower:clickhouse-native-jdbc 2.6.0 - org.apache.beam:beam-sdks-java-core =2.29.0, =0.4.0, =0.4.1...

cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

An XML External Entity XXE injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM XML is validated, external XML entities can be processed XXE, allowing an attacker to...