Security Bulletin: IBM i is Affected by Security Control Bypass and Uncontrolled Resource Consumption Vulnerabilities in IBM Java SDK and IBM Java Runtime [CVE-2026-21925, CVE-2026-21933, CVE-2026-21932, CVE-2026-21945]

Summary IBM SDK Java Technology Edition and IBM Runtime Environment Java used by IBM i to support the building and running of Java applications are vulnerable to denial-of-service CVE-2026-21945 and bypassing security controls to read and change data CVE-2026-21932, CVE-2026-21933, CVE-2026-21925...

org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25860 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)

org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...

Security Bulletin: Multiple vulnerabilities in IBM SDK, Java technology affect IBM Tivoli Composite Application Manager for Transactions (Response Time)

Summary IBM SDK, Java Technology Edition is used by IBM Tivoli Composite Application Manager for Transactions Response Time Vulnerability Details CVEID:CVE-2025-53066 DESCRIPTION: An unspecified vulnerability in Java SE related to the JAXP component could allow a remote attacker to cause high...

CVE-2026-25204: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=4935339847516160 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

DNS Rebinding

MCP Java SDK is vulnerable to DNS Rebinding. The vulnerability is due to lack of Origin Validation, allowing a malicious website to bypass same-origin restrictions and access a local or network-private MCP server via the victim’s browser, enabling unauthorized tool invocation...

ch.cern:cerndb-sw-zkpolicy (1.0.1-21), cloud.metaapi.sdk:metaapi-common-java (>=1.0.0, <=1.0.1) +259 more potentially affected by CVE-2026-34478 via org.apache.logging.log4j:log4j-core (>=3.0.0-beta1, <=3.0.0-beta3)

org.apache.logging.log4j:log4j-core MAVEN version =3.0.0-beta1, =1.0.0, =0.0.2, =00.00.03, =1.0.6, =1.0.7, =1.0.0, =2.0.21, =1.0, =1.0.2 - com.frostphyr:customappender 1.1.0 and more Source cves: CVE-2026-34478 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-15967739...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +7688 more potentially affected by CVE-2026-34478 via org.apache.logging.log4j:log4j-core (>=2.21.0, <=2.25.3)

org.apache.logging.log4j:log4j-core MAVEN version =2.21.0, =0.27.0, =0.26.0, =3.10.0.5, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =2.6.0-looktech.1, =1.12.0, =1.12.0, =1.13.8 and more Source cves: CVE-2026-34478 Source...

Security Bulletin: Multiple vulnerabilities in IBM SDK, Java technology affect IBM Tivoli Composite Application Manager for Transactions (Response Time)

Summary IBM SDK, Java Technology Edition is used by IBM Tivoli Composite Application Manager for Transactions Response Time Vulnerability Details CVEID:CVE-2026-1188 DESCRIPTION: In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 — Log4Shell PoC Lab DISCLAIMER Este...

Apache Log4j 安全漏洞

Apache Log4j is an open-source logging tool based on Java, developed by the Apache Foundation in the United States. Versions of Apache Log4j 2.21.0 to 2.25.3 contain security vulnerabilities. These vulnerabilities stem from CRLF sequence log injection in the RFC5424Layout, which may lead to CRLF...

Security Bulletin: IBM Operations Analytics – Log Analysis is affected by a security feature bypass due to Azure SDK for Java

Summary Azure SDK for Java is used by IBM Operations Analytics – Log Analysis as part of secure, asynchronous messaging and event streaming over AMQP Advanced Message Queuing Protocol. CVE‑2020‑16971. Vulnerability Details CVEID:CVE-2020-16971 DESCRIPTION: Azure SDK for Java Security Feature Bypa...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, crossplane-provider-aws-cloudwatchlogs, distribution, docker, kubeflow-pipelines, gitlab-kas, goreleaser, prometheus, guac, haproxy-ingress, knative-serving, slsa-verifier, kube-arangodb, crossplane-provider-aws-kms, snyk-cli,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: cyberark-secrets-provider-for-k8s-fips, jaeger-fips, cilium, db-operator-fips, docker-compose-fips, apm-server-fips, external-secrets-operator, blob-csi-fips, chainctl-fips, jaeger, spire-server, gitlab-workhorse-ce, trivy-operator-fips, amazon-cloudwatch-agent,...

openjdk: Improved Arena allocations (Oracle CPU 2026-04)

Vulnerability in Oracle Java SE component: Libraries. The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

openjdk: Improved Arena allocations (Oracle CPU 2026-04)

Vulnerability in Oracle Java SE component: Libraries. The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

Arbitrary Command Injection

Overview @idachev/mcp-javadc is a Model Context Protocol MCP server for Java decompilation Affected versions of this package are vulnerable to Arbitrary Command Injection via the HTTP Interface component when processing the jarFilePath argument. An attacker can execute arbitrary operating system...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +8565 more potentially affected by CVE-2026-24880 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.52)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-24880 Source advisory:...

Security Bulletin: Due to the use of Apache Tomcat and mchange-commons-java, IBM ApplinX is vulnerable to Improper Input Validation vulnerablities (CVE-2025-66614, CVE-2026-24733, CVE-2026-24734) and an 'Injection' vulnerability (CVE-2026-27727).

Summary Due to the use of Apache Tomcat and mchange-commons-java, IBM ApplinX is vulnerable to Improper Input Validation vulnerablities CVE-2025-66614, CVE-2026-24733, CVE-2026-24734 and an Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection'...

MCP Java Decompiler Server 操作系统命令注入漏洞

MCP Java Decompiler Server is a Java bytecode decompilation server developed by Ivan Dachev. Versions of MCP Java Decompiler Server 1.2.4 and earlier had a vulnerability related to operating system command injection. This vulnerability stemmed from the handling of the parameter jarFilePath in the...