CVE-2026-53916 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM hea...

CVE-2026-53434

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details...

CVE-2026-49434

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used...

IBM MQ 9.1 < 9.1.0.37 LTS / 9.2 < 9.2.0.43 LTS / 9.3 < 10.0.0.0 CD / 9.3 < 9.3.0.41 LTS / 9.4 < 9.4.0.25 LTS (7277718)

The version of IBM MQ Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7277718 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions tha...

PT-2026-53843

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ Web Console versions prior to 5.19.8 Apache ActiveMQ Web Console versions 6.0.0 through 6.2.6 Description An issue exists where the browse pa...

PT-2026-54439

Name of the Vulnerable Software and Affected Versions sigstore-java version 2.0.0 Description A regression occurred where the verification of the integrated time Rekor entry time against the Fulcio certificate was erroneously removed. This allows a malicious actor who has exfiltrated a temporary...

PT-2026-54435

Name of the Vulnerable Software and Affected Versions c3p0 versions prior to 0.14.0 Description c3p0, a JDBC Connection pooling library, can act as a sink for deserialization gadgets when used with other libraries. The DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection...

com.navercorp.pinpoint:pinpoint-batch (3.1.0), com.navercorp.pinpoint:pinpoint-hbase2-web (>=2.5.1-p1, <=2.5.4) +3 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-basic-login (>=2.5.1, <=3.1.0)

com.navercorp.pinpoint:pinpoint-basic-login MAVEN version =2.5.1, =2.5.1-p1, =3.0.0, =2.5.1, =2.5.1, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755930...

com.navercorp.pinpoint:pinpoint-batch (>=2.3.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-flink (>=2.3.0, <=3.0.5) +6 more potentially affected by CVE-2026-57948 via com.navercorp.pinpoint:pinpoint-web (>=2.3.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-web MAVEN version =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =3.0.0, =3.0.0, =2.5.0, =3.1.0 Source cves: CVE-2026-57948 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755931...

com.navercorp.pinpoint:pinpoint-batch (>=3.0.0, <=3.1.0), com.navercorp.pinpoint:pinpoint-batch-alarmsender (>=3.0.0, <=3.1.0) +5 more potentially affected by CVE-2026-57947 via com.navercorp.pinpoint:pinpoint-webhook (>=3.0.0, <=3.1.0)

com.navercorp.pinpoint:pinpoint-webhook MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.1.0 Source cves: CVE-2026-57947 Source advisory: SNYK:JAVA-COMNAVERCORPPINPOINT-17755929...

com.github.manosbatsis.kmm.converters:kmm-converters-elide (1.0.0-alpha.2), com.github.manosbatsis.kmm.converters:kmm-converters-elide-autoconfigure (1.0.0-alpha.2) +42 more potentially affected by CVE-2026-57954 via com.yahoo.elide:elide-core (>=1.0.0.1, <=7.1.17)

com.yahoo.elide:elide-core MAVEN version =1.0.0.1, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.0.0-alpha.3, =0.0.1, =2.3.0, =5.0.0, =5.0.0, =1.0.0.8, =1.0.0.6, =5.1.2 and more Source cves: CVE-2026-57954 Source advisory: SNYK:JAVA-COMYAHOOELIDE-17755935...

com.github.manosbatsis.kmm.converters:kmm-converters-elide-starter (1.0.0-alpha.2), com.github.manosbatsis.kmp.converters:kmp-converters-elide-starter (>=1.0.0-alpha.3, <=1.0.0-alpha.8) +19 more potentially affected by CVE-2026-57954 via com.yahoo.elide:elide-graphql (>=4.0-beta-2, <=7.1.17)

com.yahoo.elide:elide-graphql MAVEN version =4.0-beta-2, =1.0.0-alpha.3, =5.0.0, =5.0.0, =6.0.0, =4.7.2, =7.0.3, =7.0.3, =4.5.7, =4.0-beta-4, =1.0.17, =1.14.0, =0.2.0, =2.5.0 and more Source cves: CVE-2026-57954 Source advisory: SNYK:JAVA-COMYAHOOELIDE-17755934...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Multiple vulnerabilities are resolved: CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268 Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

EUVD-2026-40084

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856

The CVE-2026-12856 entry concerns the vscode-java extension for Visual Studio Code. The vulnerability arises because the extension trusts all Markdown content in JavaDoc hovers, enabling a malicious Java file to include hidden commands. When a user clicks a specially crafted link in a JavaDoc hov...