EUVD-2026-40084

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

CVE-2026-12856

The CVE-2026-12856 entry concerns the vscode-java extension for Visual Studio Code. The vulnerability arises because the extension trusts all Markdown content in JavaDoc hovers, enabling a malicious Java file to include hidden commands. When a user clicks a specially crafted link in a JavaDoc hov...

CVE-2026-12856

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...

ROOT-APP-MAVEN-CVE-2024-21634 CVE-2024-21634 in io.root.software.amazon.ion:ion-java - Patched by Root

Root has patched CVE-2024-21634 in the io.root.software.amazon.ion:ion-java package for Root:Maven. Multiple fixed versions available...

PYSEC-2026-352 H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connectionurl property with a...

Exploit for Improper Access Control in Widgetfactorylimited Jce

No d...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2026:0570)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0570 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

PT-2026-53259

Name of the Vulnerable Software and Affected Versions vscode-java affected versions not specified Description The vscode-java extension, which provides Java language support for Visual Studio Code, incorrectly trusts all Markdown content in JavaDoc hovers. This allows a malicious Java file to...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2025:1019)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1019 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2026:0569)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0569 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2025:1020)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1020 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

ai.timefold.solver:timefold-solver-migration (>=0.8.38, <=1.5.0), ai.tripl:arc-deltalake-pipeline-plugin_2.11 (>=1.2.0, <=1.6.0) +2812 more potentially affected by CVE-2026-13501 via org.antlr:antlr4 (>=4.0, <=4.13.2)

org.antlr:antlr4 MAVEN version =4.0, =0.8.38, =1.2.0, =1.2.0, =1.0.0-alpha01, =1.0.0-alpha1, =1.1.0-alpha02, =1.0.0-alpha01, =3.2.0-alpha12, =3.2.0-alpha12, =2.4.0-alpha01, =2.4.0-alpha01, =2.0.0-rc02, =2.0.0-alpha1, =2.2.6 and more Source cves: CVE-2026-13501 Source advisory:...

co.cask.re:dre-core (>=1.0.1, <=1.1.2), co.cask.re:dre-plugins (>=1.0.1, <=1.1.2) +53 more potentially affected by CVE-2026-13502 via org.antlr:antlr4-maven-plugin (>=4.1, <=4.13.2)

org.antlr:antlr4-maven-plugin MAVEN version =4.1, =1.0.1, =1.0.1, =1.0, =0.1, =1.5.2, =1.4.8, =1.6.5 and more Source cves: CVE-2026-13502 Source advisory: SNYK:JAVA-ORGANTLR-17753946...

EUVD-2026-39999

A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed fro...

CVE-2026-13501 antlr ANTLR4 gofmt GoTarget.java GoTarget command injection

A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed fro...

CVE-2026-13501

A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed fro...

CVE-2026-13500

The CVE-2026-13500 issue affects antlr ANTLR4 up to 4.13.2, specifically the Grammar Action Block Handler’s OutputFile.java in the tool. The underlying problem is a manipulation of OutputFile.java that can cause code injection. The vulnerability is described as exploitable remotely, with a public...

PT-2026-53112

Name of the Vulnerable Software and Affected Versions ANTLR4 versions prior to 4.13.3 Description Command injection is possible in the gofmt component via the GoTarget function located in the tool/src/org/antlr/v4/codegen/target/GoTarget.java file. This issue allows an attacker to execute arbitra...