CLEANSTART-2026-CZ82044 jackson-databind's deserializer for java

CVE-2026-19032 affects multiple packages. jackson-databind's deserializer for java. See references for individual vulnerability details...

CLEANSTART-2026-UF96774 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the kafka package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-EN44130 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

CVE-2026-45292 affects multiple packages. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. See references for individual vulnerability details...

CLEANSTART-2026-GN57450 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...

CLEANSTART-2026-RU43979 snappy-java through 1

Security vulnerability affects the elasticsearch package. snappy-java through 1...

CLEANSTART-2026-MH58992 snappy-java through 1

Security vulnerability affects the elasticsearch package. snappy-java through 1...

CLEANSTART-2026-GD87503 snappy-java through 1

Security vulnerability affects the elasticsearch package. snappy-java through 1...

CLEANSTART-2026-RP19895 Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4

Security vulnerability affects the elasticsearch package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

CVE-2026-97666: Use of Externally-Controlled Input to Select Classes or Code

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

A Bootiful Podcast: Can Java be more performant than Rust? Andrew Lombardi has the numbers

Hi, Spring fans! What happens when a longtime Kotlin and JVM fan - my friend Andrew Lombardi - decides to take on the latest “rewrite everything in Rust” hype with AI in the driver’s seat? In this episode, Josh sits down with community legend Andrew Lombardi for a fast, funny, and deeply technica...

PT-2026-122698

Security vulnerability affects the strimzi-kafka-operator package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

PT-2026-122731

Security vulnerability affects the elasticsearch package. snappy-java through 1...

PT-2026-122835

Security vulnerability affects the kafka package. yawkat LZ4 Java provides LZ4 compression for Java...

PT-2026-122785

Security vulnerability affects the elasticsearch package. snappy-java through 1...

PT-2026-122813

Security vulnerability affects the elasticsearch package. snappy-java through 1...

PT-2026-115298

crmeb java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/orderId or /api/front/order/apply/refund/orderId to view victims' tracking numbers...

PT-2026-122810

Security vulnerability affects the elasticsearch package. Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4...

Rocky Linux 9 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2026_82013)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202682013 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

OpenJDK 7 <= 7u291 / 8 <= 8u282 / 11.0.0 <= 11.0.10 / 13.0.0 <= 13.0.6 / 15.0.0 <= 15.0.2 / 16.0.0 <= 16.0.0 Multiple Vulnerabilities (2021-04-20)

The version of OpenJDK installed on the remote host is 7 prior to 7u291 / 8 prior to 8u282 / 11.0.0 prior to 11.0.10 / 13.0.0 prior to 13.0.6 / 15.0.0 prior to 15.0.2 / 16.0.0 prior to 16.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021-04-20 advisory. Please...

CVE-2026-108395

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...