57664 matches found
GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...
EUVD-2026-41135
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"...
SUSE-SU-2026:3623-1 Security update for java-1_8_0-openjdk
This update for java-180-openjdk fixes the following issues: Security issues fixed: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize bsc1272459. - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data bsc127222...
DEBIAN-CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...
CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...
EUVD-2026-58667
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...
EUVD-2026-58660
A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...
GO-2023-1765 vulnerabilities
Vulnerabilities for packages: aactl, pulumi-language-java...
GO-2025-3367 vulnerabilities
Vulnerabilities for packages: gptscript, kaniko, flux-kustomize-controller, snyk-cli, nuclei, trivy, bom, src-fingerprint, scorecard, wolfictl, chezmoi, pulumi-language-dotnet, flux-image-automation-controller, gitea, argo-events, kargo, zot, apko, argo-workflows, grafana-alloy,...
GO-2025-3368 vulnerabilities
Vulnerabilities for packages: gptscript, kaniko, flux-kustomize-controller, snyk-cli, nuclei, trivy, bom, src-fingerprint, scorecard, wolfictl, chezmoi, pulumi-language-dotnet, flux-image-automation-controller, gitea, argo-events, kargo, zot, apko, argo-workflows, grafana-alloy,...
GO-2026-4910 vulnerabilities
Vulnerabilities for packages: argo-cd, gptscript, kaniko, snyk-cli, steampipe, nuclei, trivy, bom, src-fingerprint, xeol, teleport, scorecard, wolfictl, chezmoi, pulumi-language-dotnet, flux-image-automation-controller, gitea, argo-events, gitlab-runner, kargo, gomplate, apko, zot, argo-workflows...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: envconsul, temporal-ui-server, promxy, prometheus, flux-kustomize-controller, cortex, crossplane-provider-aws-cloudfront, cilium, traefik, crossplane-provider-aws-memorydb, nri-haproxy, trino, kube-logging-operator-custom-runner, kube-bench, kubeflow-pipelines,...
GO-2023-1765 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, aactl...
GO-2026-5013 vulnerabilities
Vulnerabilities for packages: argo-cd, prometheus, flux-kustomize-controller, crossplane-provider-aws-cloudfront, nuclei, cilium, traefik, crossplane-provider-aws-memorydb, chezmoi, nerdctl, sealed-secrets, argo-events, crossplane-provider-keycloak, pulumi-language-yaml,...
thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation
A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...
CVE-2026-18511
IBM i 7.3–7.6 is affected by CVE-2026-18511. The vulnerability arises in the Native IBM i JSSE provider during TLS session establishment due to improper bounds checking, allowing a local authenticated attacker to overflow a fixed-length buffer and potentially execute arbitrary code or crash the J...
CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...
CVE-2026-18249
IBM i 7.3–7.6 is vulnerable to privilege escalation via improper pointer validation from Java-controlled addresses (CWE-269), requiring a remote authenticated attacker with low privileges. IBM provides PTFs for all affected releases (e.g., SJ11037 for 7.6); no workarounds are available. No exploi...