PT-2026-109174

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-108104: Double Free

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared...

CVE-2026-71884: Reusing a Nonce, Key Pair in Encryption

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

Linux Distros Unpatched Vulnerability : CVE-2026-107726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of dat...

CVE-2026-108106: Memory Allocation with Excessive Size Value

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or...

PT-2026-108937

Name of the Vulnerable Software and Affected Versions xerial snappy-java versions prior to 1.1.10.9 Description An unbounded memory allocation issue exists where attackers can exhaust JVM memory by declaring a large uncompressed length in compressed input. By providing crafted bytes to the...

PT-2026-108806

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

fastjson

fastjson Fastjson es una librería de Java que se puede usar para convertir objetos Java a su representación JSON. También se puede usar para convertir una cadena JSON en un objeto Java equivalente. Fastjson puede trabajar con objetos Java arbitrarios, incluyendo objetos preexistentes de los cuale...

GHSA-6V25-8WQ6-XQ4J Hazelcast allows arbitrary member memory access by low-privileged client

Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member including Java heap memory, off-heap data, and JVM process address space. Additionally, such a client ma...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726

Hazelcast is vulnerable to an arbitrary memory access flaw in versions prior to 5.4.5, 5.5.10, 5.6.1, and 5.7.0 . The root cause is improper validation of data supplied by a malicious client capable of connecting to a cluster. An attacker can perform arbitrary reads from a cluster member's Java h...

Exploit for Cleartext Transmission of Sensitive Information in Apache Jmeter

Apache JMeter RMI Deserialization RCE CVE-2018-1297 Vulhub...

Exposure Of Sensitive Information

RabbitMQ Java client is vulnerable to Exposure of Sensitive Information. The vulnerability is due to inclusion of raw AMQP URIs containing plaintext usernames and passwords in wrapped exceptions when URI parsing fails, which allows an attacker with access to application logs, monitoring systems, ...

Insecure Temporary File Handling

lz4-java is vulnerable to Insecure Temporary File Handling. The vulnerability is due to the way net.jpountz.util.Native.load extracts the native library: it creates a lock file with File.createTempFile and then derives the library path by stripping the .lck suffix, opening the resulting file with...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: confluent-kafka-jre-bcfips, akhq, traccar, apicurio-registry-fips, datahub-gms-fips, opensearch-fips, apache-hop-fips, datahub-frontend, cassandra-reaper, cruise-control-fips, conductor, hono, cassandra-fips, elasticsearch, spark-fips, pinot-fips, kayenta, pinot,...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: confluent-kafka-jre-bcfips, akhq, traccar, apicurio-registry-fips, datahub-gms-fips, opensearch-fips, apache-hop-fips, datahub-frontend, cassandra-reaper, cruise-control-fips, conductor, hono, cassandra-fips, elasticsearch, spark-fips, pinot-fips, kayenta, pinot,...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: confluent-kafka-jre-bcfips, akhq, traccar, apicurio-registry-fips, datahub-gms-fips, opensearch-fips, apache-hop-fips, datahub-frontend, cassandra-reaper, cruise-control-fips, conductor, hono, cassandra-fips, elasticsearch, spark-fips, pinot-fips, kayenta, pinot,...