Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Serialization. The supported versions affected include Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. This easily exploitable...

CLSA-2026-1789387099 TuxCare security update for io.netty (9 CVEs)

TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.93.Final-tuxcare.4...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the parameter processing of message-based management requests sent by an authenticated client with MANAGE permission. An attacker can cause excessive computation and pin the processing thread by...

Security Bulletin: IBM MQ Java messaging is vulnerable to XML external entity injection (CVE-2026-12666)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the IBM MQ Classes for Java client's RFH2 header parser Vulnerability Details CVEID:CVE-2026-12666 DESCRIPTION: IBM MQ Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial ...

Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affecting Tivoli Netcool/OMNIbus

Summary Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 8 that is used by Tivoli Netcool/OMNIbus probes and/or gateways have been addressed. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-11729)

Summary IBM MQ has addressed a Java deserialization vulnerability in the IBM MQ Java client's internal command manager Vulnerability Details CVEID:CVE-2026-11729 DESCRIPTION: IBM MQ Java client library could allow an authenticated attacker to execute arbitrary code in client applications due to...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-12728)

Summary IBM MQ has addressed a deserialization filter bypass vulnerability in the IBM MQ Java client's distributed messaging component that could allow a remote authenticated attacker to execute arbitrary code by delivering crafted serialized messages that bypass the configured deserialization...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.2), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.2) +33 more potentially affected by CVE-2026-87785 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.2)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 and more Source cves: CVE-2026-87785https://vu...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. CVE-2026-16243: arraycmp SIMD...

SUSE-SU-2026:4153-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: - CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. - CVE-2026-16243: arraycmp SIMD...

CVE-2026-90584

A flaw was found in TooTallNate Java-WebSocket. A remote attacker can exploit a weakness in the processFrameContinuousAndNonFin function within the Fragmentation Handler component. This vulnerability allows for excessive allocation of resources, which can lead to a Denial of Service DoS condition...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite

Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-59949 DESCRIPTION: yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object a...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities disclosed in IBM Semeru Runtime. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2026-2153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2153 advisory. In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross- nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

Important: bouncycastle

Issue Overview: In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12. CVE-2026-12803 In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets...

CVE-2026-90819: Improper Neutralization of CRLF Sequences in HTTP Headers

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

PT-2026-91711

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header...

PT-2026-91712

Name of the Vulnerable Software and Affected Versions a2aproject a2a-java version 1.2.0 Description A remote attack can lead to missing authorization due to an issue in the AuthorizationRequestHandlerDecorator.onListTasks function located in the...

CVE-2026-50270: Allocation of Resources Without Limits or Throttling

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-90820: Missing Authorization

A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such...