CLEANSTART-2026-XU20448 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-RY43720 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-RK76789 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-JR63274 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-WQ77811 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-LA60535 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-DU85767 In Bouncy Castle for Java before 1

Security vulnerability affects the sonarqube package. In Bouncy Castle for Java before 1...

CLEANSTART-2026-IX22317 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

Security vulnerability affects the sonarqube package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...

CLEANSTART-2026-FO52414 jackson-databind's deserializer for java

Security vulnerability affects the trino package. jackson-databind's deserializer for java...

CLEANSTART-2026-BM76577 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...

Apache Ratis 3.3.1 Java Deserialization

Apache Ratis versions 3.3.0 and 3.3.1 contain an unsafe Java deserialization vulnerability in RPC reply error handling that can allow remote code execution on a client with a suitable gadget chain. !/usr/bin/env python Apache Ratis 3.3.1 Java Deserialization Vendor: The Apache Software Foundation...

PT-2026-106753

Name of the Vulnerable Software and Affected Versions Kiota versions 0.5.0 through 1.34.1 Description Kiota is an OpenAPI based HTTP Client code generator. The Java and PHP documentation-comment sanitizers delete block-comment terminators instead of neutralizing them. This allows overlapping...

PT-2026-106842

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.37.0 Description A denial of service issue exists in the com.rabbitmq.tools.json.JSONReader.read function. The problem occurs when input ends inside a quoted string or a line comment, as the...

CVE-2026-106123: Generation of Error Message Containing Sensitive Information

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

CVE-2026-106121: Loop with Unreachable Exit Condition

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

CVE-2026-106449: Uncontrolled Recursion

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106450: Allocation of Resources Without Limits or Throttling

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

PT-2026-107240

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions 1.7.0 through 1.11.3 Description The net.jpountz.util.Native.load function creates an exclusive temporary .lck file using File.createTempFile but derives the native-library path by removing the suffix. Subsequently,...

Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization

Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...

PT-2026-107259

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...