AlmaLinux 9.2 [TuxCare] Security Update: guava / guava-javadoc / guava-testlib (ALMALINUX9.2:CLSA-2026:1793106858)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793106858 advisory. - Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1...

com.vaadin:vaadin (>=24.5.0, <=24.7.15), com.vaadin:vaadin-charts-flow-svg-generator (>=24.5.0, <=24.7.14) +8 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.5.0, <=24.7.14)

com.vaadin:vaadin-charts-flow MAVEN version =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.7.14 - com.vaadin:vaadin-testbench-unit 9.3.15 - com.vaadin:vaadin-testbench-unit-junit5 9.3.15 - com.vaadin:vaadin-testbench-unit-quarkus 9.3.15 - com.vaadin:vaadin-testbench-unit-share...

com.vaadin:vaadin-jandex (>=24.10.0, <=24.10.10), com.vaadin:vaadin-platform-javadoc (>=24.10.0, <=24.10.10) +5 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.10.0, <=24.10.10)

com.vaadin:vaadin MAVEN version =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.3 - io.github.adumeige.vaadin-reactflow:vaadin-reactflow-component 1.0.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin-jandex (>=22.0.0, <=23.6.15), com.vaadin:vaadin-platform-javadoc (>=22.0.0, <=23.6.15) +76 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=22.0.0, <=23.6.15)

com.vaadin:vaadin MAVEN version =22.0.0, =22.0.0, =22.0.0, =8.3.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.4 and more Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin-jandex (>=24.8.0, <=24.9.22), com.vaadin:vaadin-platform-javadoc (>=24.8.0, <=24.9.22) +4 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.8.0, <=24.9.22)

com.vaadin:vaadin MAVEN version =24.8.0, =24.8.0, =24.8.0, =9.4.4, =9.4.4, =9.4.4, =9.4.4, =9.5.8 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin (>=24.10.0, <=24.10.10), com.vaadin:vaadin-charts-flow-svg-generator (>=24.10.0, <=24.10.10) +9 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.10.0, <=24.10.10)

com.vaadin:vaadin-charts-flow MAVEN version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.3 - io.github.adumeige.vaadin-reactflow:vaadin-reactflow-component 1.0.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-2169157...

com.vaadin:vaadin (>=22.0.0, <=23.6.15), com.vaadin:vaadin-charts-flow-demo (>=22.0.0, <=23.0.16) +80 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=22.0.0, <=23.6.15)

com.vaadin:vaadin-charts-flow MAVEN version =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.0, =8.3.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.4 and more Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691578...

com.vaadin:vaadin-jandex (>=24.5.0, <=24.7.15), com.vaadin:vaadin-platform-javadoc (>=24.5.0, <=24.7.15) +4 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.5.0, <=24.7.15)

com.vaadin:vaadin MAVEN version =24.5.0, =24.5.0, =24.5.0, =24.7.15 - com.vaadin:vaadin-testbench-unit 9.3.15 - com.vaadin:vaadin-testbench-unit-junit5 9.3.15 - com.vaadin:vaadin-testbench-unit-quarkus 9.3.15 - com.vaadin:vaadin-testbench-unit-shared 9.3.15 Source cves: CVE-2026-107588 Source...

com.vaadin:vaadin-platform-javadoc (25.3.0), com.wontlost:zxing-vaadin (4.0.0) potentially affected by CVE-2026-107588 via com.vaadin:vaadin (25.3.0)

com.vaadin:vaadin MAVEN version 25.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-javadoc 25.3.0 - com.wontlost:zxing-vaadin 4.0.0 Source cves: CVE-2026-107588 Source advisory:...

CLEANSTART-2026-DM25674 Vulnerability in the Java SE product of Oracle Java SE (component: Javadoc)

Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE product of Oracle Java SE component: Javadoc...

PT-2026-122280

Security vulnerability affects the openjdk11 package. Vulnerability in the Java SE product of Oracle Java SE component: Javadoc...

io.github.aafc-bicoe:dina-base-api (>=0.168, <=0.183), net.tirasa.connid.bundles:net.tirasa.connid.bundles.rest (1.1.2) +7 more potentially affected by CVE-2026-86463 via org.apache.cxf:cxf-rt-rs-extension-search (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-rs-extension-search MAVEN version =4.2.0, =0.168, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =8.0.0-rc2, =8.1.0-rc2 Source cves: CVE-2026-86463 Source advisory: MEND:CVE-2026-86463...

Rocky Linux 8.8 [CIQ] Security Update: postgresql-jdbc / postgresql-jdbc-javadoc (ciqsa-2026_0305)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260305 advisory. This advisory aggregates security fixes for the postgresql-jdbc SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-1597. Tenable has extracted the preceding...

Rocky Linux 10.2 [CIQ] Security Update: assertj-core / assertj-core-javadoc (crlsa-2026_59372)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659372 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description block...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-annotations / pki-jackson-annotations-javadoc (ALMALINUX9.2:CLSA-2025:1764847045)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764847045 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2026-93547 Source advisory: MEND:CVE-2026-93547...

AlmaLinux 9.2 [TuxCare] Security Update: maven / maven-javadoc / maven-lib / maven-openjdk11 / etc (ALMALINUX9.2:CLSA-2026:1786433114)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786433114 advisory. - Apache Maven will follow repositories that are defined in a dependency's Project Object Model pom which may be surprising to some users,...

AlmaLinux 9.2 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.2:CLSA-2026:1788881384)

"The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788881384 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version 3.27....

CVE-2026-12856

The CVE-2026-12856 entry concerns the vscode-java extension for Visual Studio Code. The vulnerability arises because the extension trusts all Markdown content in JavaDoc hovers, enabling a malicious Java file to include hidden commands. When a user clicks a specially crafted link in a JavaDoc hov...

EUVD-2026-40084

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDo...