EUVD-2026-53854

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

Security Bulletin: Multiple Vulnerabilities in Java affecting IBM Knowledge Catalog Neo4j On Cloud Pak for Data

Summary Multiple Vulnerabilities in Java affecting IBM Knowledge Catalog Neo4j On Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successfu...

MiracleLinux 8 : java-21-openjdk-21.0.12.0.8-1.1.el8.ML.1 (AXSA:2026-1475:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1475:08 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

TencentOS Server 3: java-17-openjdk (TSSA-2026:0808)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0808 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: java-21-openjdk (TSSA-2026:0807)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0807 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0809)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0809 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

CVE-2026-8400

CVE-2026-8400 affects IBM WebSphere Application Server 8.5, 9.0, and WebSphere Application Server Liberty Continuous Delivery. The issue is in the ORB component of IBM SDK, Java Technology Edition, where a malicious IIOP server could cause loading and instantiation of arbitrary classes, enabling ...

EUVD-2026-53438

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

CVE-2026-8400 Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-18903

A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This issue affects some unknown processing of the file src/main/java/com/yeqifu/sys/controller/FileController.java. This manipulation of the argument path causes path traversal. It is possible to...

CVE-2026-66277 Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version...

CVE-2026-66277 Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version...

CVE-2026-66276 Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the...

CVE-2026-68073

CVE-2026-68073 describes an issue in Apache Qpid Broker-J up to version 10.0.1 where unbounded type nesting can be triggered pre-authentication to cause a StackOverflowError, potentially leading to a denial of service. The affected component is the Broker-J product (up to 10.0.1). The underlying ...

EUVD-2026-53083

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...

EUVD-2026-53055

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

MiracleLinux 8 : java-17-openjdk-17.0.20.0.8-1.1.el8 (AXSA:2026-1403:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1403:11 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...