CVE-2026-18490 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint BrmRMISSLServerSocketFactory.java:95, EP8. An adjacent-network attacker can deliver a crafted...

CVE-2026-18490

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution due to a Java native deserialization flaw. The issue resides in the PayDir Business Rules Manager RMI SSL endpoint, specifically within BrmRMISSLServerSocketFactory.java:95, EP8. An...

EUVD-2026-85352

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint BrmRMISSLServerSocketFactory.java:95, EP8. An adjacent-network attacker can deliver a crafted...

RHLW-2026-6DD67008E326A981 Lightwell Security Advisory: avro 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042. CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema Java SDK CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network...

vulnerabilities in Adobe Experience Manager Forms JEE

Adobe has identified 6 vulnerabilities in Adobe Experience Manager AEM Forms for Java Enterprise Edition JEE, including AEM 6.5 Forms and AEM 6.5 LTS Forms. These vulnerabilities concern various security issues, such as improper authorization, inadequate input validation, Server-Side Request...

CLSA-2026-1785266060 java-1.8.0-openjdk: Fix of 11 CVEs

Update to shenandoah-jdk8u502-b07 - Security fixes from OpenJDK 8u502-b07: - CVE-2026-47057: improve Nashorn index handling - CVE-2026-47063: enhance jar handling - CVE-2026-47058: enhance DataView implementation - CVE-2026-47027: enhance jar file processing - CVE-2026-47021: enhance XBM image...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

A flaw was found in OpenJDK. This vulnerability leads to information disclosure because the java.net.HttpURLConnection networking component does not remove Proxy-Authorization headers during cross-host HTTP Hypertext Transfer Protocol redirects. A remote attacker controlling a web server can...

OpenJDK: Enhance TLS server (2026-08 Security Update)

A flaw was found in OpenJDK. An unauthenticated remote attacker can cause a Denial of Service DoS by repeatedly sending replayed handshake initiation messages ClientHello to a Transport Layer Security TLS server. Because the server fails to properly restrict the negotiation loop, it emits an...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

A flaw was found in OpenJDK. The XML cryptographic component does not properly utilize the base Uniform Resource Identifier URI when resolving external references during data retrieval. A remote attacker could exploit this flaw by providing crafted XML input to induce the application to fetch...

Moderate: Red Hat Security Advisory: java-1.8.0-ibm security update

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +12911 more potentially affected by CVE-2026-87022 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-87022 Source advisory: MEND:CVE-2026-87022...

CLSA-2026-1790151363 java-1.7.0-openjdk: Fix of CVE-2026-47010

CVE-2026-47010: Enhance JPEG handling JDK-8374058, JDK-8388811...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...

CVE-2026-12816

A flaw was found in Bouncy Castle for Java. This vulnerability allows for Message Authentication Code MAC forgery in the IESEngine stream-mode. The issue arises from a length-dependent Key Derivation Function KDF split, which an attacker could exploit to bypass integrity checks. This could lead t...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +35261 more potentially affected by CVE-2026-91776 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.6)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...

CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...