CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: elasticsearch, copybara, copybara-fips, opensearch, elasticsearch-fips, jbang, apache-hop-fips, scala, conductor, nextflow, apache-tika-fips, conductor-fips, apache-hop, metabase, gradle, apache-tika, spdx-tools-java, wazuh-indexer, opensearch-fips...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: nextflow, gradle, spdx-tools-java, opensearch, apache-tika...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: nextflow, gradle, spdx-tools-java, opensearch, apache-tika...

@rse/claudex (>=0.9.22, <=1.0.10), snyk-gradle-plugin (>=6.0.0, <=7.1.0) potentially affected by unknown CVE via shescape (>=2.1.11, <=2.1.12)

shescape NPM version =2.1.11, =0.9.22, =6.0.0, =7.1.0 Source cves: unknown CVE Source advisory: SNYK:JS-SHESCAPE-18319522...

@rse/claudex (>=0.9.22, <=1.0.10), snyk-gradle-plugin (>=6.0.0, <=7.1.0) potentially affected by CVE-2026-73413 via shescape (>=2.1.11, <=2.1.12)

shescape NPM version =2.1.11, =0.9.22, =6.0.0, =7.1.0 Source cves: CVE-2026-73413 Source advisory: OSV:GHSA-GM3R-Q2WP-HW87...

GHSA-R7WM-3CXJ-WFF9 vulnerabilities

Vulnerabilities for packages: infinispan, scala, opensearch, tez, logstash, akhq, sonarqube, apache-nifi, druid, dependency-track, flyway, spark, apache-nifi-registry, apicurio-registry, keycloak-config-cli, spdx-tools-java, strimzi-kafka-operator, wildfly, gradle, cass-config-builder...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: nacos-docker, nacos, elasticsearch, ruby3.3-jrjackson, confluent-kafka, airbyte-server-fips, hadoop-fips, seata, cassandra-fips, commercial-elasticsearch, opensearch, ruby3.2-jrjackson, knative-kafka-broker, elasticsearch-fips, apache-activemq, spark, thingsboard,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: nacos-docker, elasticsearch, ruby3.3-jrjackson, confluent-kafka, airbyte-server-fips, hadoop-fips, seata, cassandra-fips, commercial-elasticsearch, opensearch, ruby3.2-jrjackson, knative-kafka-broker, elasticsearch-fips, apache-activemq, spark, thingsboard, hono,...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: nacos-docker, nacos, elasticsearch, ruby3.3-jrjackson, confluent-kafka, airbyte-server-fips, hadoop-fips, seata, cassandra-fips, commercial-elasticsearch, opensearch, ruby3.2-jrjackson, knative-kafka-broker, elasticsearch-fips, apache-activemq, spark, thingsboard,...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: infinispan, scala, zookeeper, opensearch, tez, apache-tika, logstash, akhq, cassandra, jenkins-plugin-manager, sonarqube, apache-nifi, druid, flyway, spark, apache-nifi-registry, apicurio-registry, ruby3.3-jrjackson, wavefront-proxy, keycloak-config-cli,...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: infinispan, scala, zookeeper, opensearch, tez, apache-tika, logstash, akhq, cassandra, jenkins-plugin-manager, sonarqube, apache-nifi, druid, flyway, spark, apache-nifi-registry, apicurio-registry, ruby3.3-jrjackson, wavefront-proxy, keycloak-config-cli,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: infinispan, zookeeper, opensearch, tez, apache-tika, logstash, akhq, cassandra, jenkins-plugin-manager, sonarqube, druid, flyway, spark, ruby3.3-jrjackson, wavefront-proxy, keycloak-config-cli, thingsboard, gradle, confluent-kafka, ruby3.2-jrjackson...

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Summary Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which performs no escaping. An attacker can embed a closing brace to break out of the repositories blo...

PT-2026-60684

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the createGradleBuildScript function uses the Go text/template package to generate a...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049 jadx: RCE Via Groovy Code Injection in Gradle Export

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

CVE-2026-42049

CVE-2026-42049 affects jadx (Dex to Java decompiler). Before 1.5.6, exporting a decompiled APK as an Android Gradle project could cause the android:versionName from the manifest to be inserted into the generated app/build.gradle Groovy template without proper sanitization, enabling opening or bui...

CVE-2026-42049

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the generated app/build.gradle Groovy template without proper sanitization when exporting a decompiled APK as an Android Gradle project. A malicious APK can break out of the...

ai.timefold.solver:timefold-solver-migration (>=0.8.38, <=1.5.0), ai.tripl:arc-deltalake-pipeline-plugin_2.11 (>=1.2.0, <=1.6.0) +2812 more potentially affected by CVE-2026-13503 via org.antlr:antlr4 (>=4.0, <=4.13.2)

org.antlr:antlr4 MAVEN version =4.0, =0.8.38, =1.2.0, =1.2.0, =1.0.0-alpha01, =1.0.0-alpha1, =1.1.0-alpha02, =1.0.0-alpha01, =3.2.0-alpha12, =3.2.0-alpha12, =2.4.0-alpha01, =2.4.0-alpha01, =2.0.0-rc02, =2.0.0-alpha1, =2.2.6 and more Source cves: CVE-2026-13503 Source advisory:...