mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

EUVD-2026-41135

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58667

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58660

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: aactl, pulumi-language-java...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitea, zarf, pulumi-language-yaml, goreleaser, snyk-cli, argocd-image-updater, melange, pulumi-language-dotnet, pulumi, crossplane, flux-kustomize-controller, apko, kubescape, src-fingerprint, zot, task, argo-workflows,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitea, zarf, pulumi-language-yaml, goreleaser, snyk-cli, argocd-image-updater, melange, pulumi-language-dotnet, pulumi, crossplane, flux-kustomize-controller, apko, kubescape, src-fingerprint, zot, task, argo-workflows,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: flux, tfsec, osv-scanner, wolfictl, gitsign, gitaly, gitea, zarf, gomplate, argo-cd, pulumi-language-yaml, kyverno, snyk-cli, argocd-image-updater, melange, witness, cerbos, nfpm, pulumi, pulumi-language-dotnet, crossplane, apko, kubescape, src-fingerprint, zot,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: buildah, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, spire-server, cloud-sql-proxy, tetragon, trino, cloud-provider-azure, delve, polaris, ingress-nginx-controller, actions-runner-controller, zarf, kubo, kubernetes-csi-livenessprobe,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, aactl...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, crossplane-provider-family-aws, vault-benchmark, pulumi, terraform-provider-tls, rancher-machine, gitlab-runner, k3s, src, crossplane-provider-aws-firehose, dagger, docker-compose, grype, telegraf, slsa-verifie...

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

CData Sync < 23.4.8843 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Sync CData - Sync' - r...

ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization

Zoho ManageEngine OpManager Stable build before 125203 and Released build before 125233 allows Remote Code Execution via the Smart Update Manager SUM servlet. id: CVE-2020-28653 info: name: ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization author: iamnoooob,pdresearch severity:...

XStream <1.4.18 - Server-Side Request Forgery

XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify...

Tiny Java Web Server - Cross-Site Scripting

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. id: CVE-2021-37573 info: name: Tiny Java Web Server - Cross-Site Scripting author:...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

Apache Unomi <1.5.2 - Remote Code Execution

Apache Unomi allows conditions to use OGNL and MVEL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process. This vulnerability affects all versions of Apache Unomi prior to 1.5.2. id:...