CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425

The FasterXML jackson-core library contains a vulnerability in the UTF8DataInputJsonParser._reportInvalidToken() method. The root cause is that this specific parser fails to honor ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) when building error messages, unlike other sibling im...

CVE-2026-77423: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77421: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

CVE-2026-95848: Not Failing Securely

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-18490: Deserialization of Untrusted Data

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint BrmRMISSLServerSocketFactory.java:95, EP8. An adjacent-network attacker can deliver a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-89425

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier...

PT-2026-97353

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description An unauthenticated adjacent-network attacker can achieve remote code execution by delivering a crafted serialized payload to the PayDir...

RHEL 8 : java-1.8.0-ibm (RHSA-2026:70630)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70630 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. Security Fixes: OpenJDK: Improve...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615

The openEQUELLA software prior to version 2026.1.0 is vulnerable to authenticated remote code execution (RCE) via Java deserialization in the HTTP invoker endpoint at /invoker/*. An authenticated non-guest user can bypass the PluginAwareObjectInputStream class-name denylist by nesting a serialize...

EUVD-2026-84866

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

java-html-sanitizer v20260921.1

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The existing dependency is on JSR 305. The other jars are only needed by the test suite. The JSR 305...

ai.covia:covia-sql (>=0.9.8, <=0.10.0), cn.benma666:druid (1.2.22) +1476 more potentially affected by CVE-2026-70410 via org.apache.calcite.avatica:avatica-core (>=1.9.0, <=1.28.0)

org.apache.calcite.avatica:avatica-core MAVEN version =1.9.0, =0.9.8, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.7.0, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.6.1, =0.7.1 and more Source cves: CVE-2026-70410 Source advisory: SNYK:JAVA-ORGAPACHECALCITEAVATICA-20186819...