org.ow2.asm/asm: OW2 ASM: Denial of Service via excessive memory allocation

A flaw was found in OW2 ASM. An attacker could cause a Denial of Service DoS by providing a specially crafted, invalid Java class file. Due to improper validation of subroutine instructions, processing the file triggers excessive memory allocation, causing the Java Virtual Machine JVM to crash...

CVE-2026-111623

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...

EUVD-2026-103045

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...

CVE-2026-111623

The Xiaozhi-esp32-server-java software (versions through 6.1.0 ) is vulnerable to an authentication bypass (CWE-290) in the OTA endpoint . An unauthenticated attacker can obtain valid device WebSocket tokens by requesting /api/device/ota using any arbitrary MAC address. Successful exploitation al...

CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...

CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role...

CVE-2026-64610 Apache Kylin: Redis unsafe Java deserialization

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-64610

Apache Kylin versions 4 through 5.0.4 are vulnerable to a Deserialization of Untrusted Data vulnerability. The root cause is unsafe Java deserialization occurring from a broken external cache service. This issue could lead to significant security impacts, including high confidentiality, integrity...

OESA-2026-4274 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4275 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4273 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4246 bouncycastle security update

The package is organised so that it contains a light-weight API suitable for use in any environment including the newly released J2ME with the additional infrastructure to conform the algorithms to the JCE framework. Security Fixes: In Bouncy Castle for Java before 1.86, the streaming CMS...

OESA-2026-4245 bouncycastle security update

The package is organised so that it contains a light-weight API suitable for use in any environment including the newly released J2ME with the additional infrastructure to conform the algorithms to the JCE framework. Security Fixes: In Bouncy Castle for Java before 1.86, the streaming CMS...

OESA-2026-4243 bouncycastle security update

The package is organised so that it contains a light-weight API suitable for use in any environment including the newly released J2ME with the additional infrastructure to conform the algorithms to the JCE framework. Security Fixes: In Bouncy Castle for Java before 1.86, the streaming CMS...

OESA-2026-4244 bouncycastle security update

The package is organised so that it contains a light-weight API suitable for use in any environment including the newly released J2ME with the additional infrastructure to conform the algorithms to the JCE framework. Security Fixes: In Bouncy Castle for Java before 1.86, the streaming CMS...

CLEANSTART-2026-EV52382 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

CVE-2026-106123 affects multiple packages. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. See references for individual vulnerability details...

CLEANSTART-2026-VZ71675 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106453 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-JZ50665 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

CVE-2026-106122 affects multiple packages. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. See references for individual vulnerability details...

CLEANSTART-2026-HX04785 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106452 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-HP65010 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

CVE-2026-106121 affects multiple packages. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. See references for individual vulnerability details...