538 matches found
CVE-2026-93994: Missing Critical Step in Authentication
Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...
CVE-2026-94052
A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for...
CVE-2026-94053
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey...
CLEANSTART-2026-KE95640 JLine is a Java library for handling console input
CVE-2026-77420 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details...
CLEANSTART-2026-YI14989 JLine is a Java library for handling console input
CVE-2026-77422 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details...
CLEANSTART-2026-JE20809 JLine is a Java library for handling console input
CVE-2026-77421 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details...
SUSE CVE-2026-77423
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...
CVE-2026-77422
A flaw was found in JLine, a Java library for handling console input. The built-in grep command accepts user-controlled regular expressions and automatically wraps them, which can amplify backtracking in the regular expression engine. A remote attacker could exploit this by providing a specially...
org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...
ROOT-APP-MAVEN-CVE-2022-41946 CVE-2022-41946 in org.postgresql:postgresql - Patched by Root
Root has patched CVE-2022-41946 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...
CLSA-2026-1789494210 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1...
CLSA-2026-1789427454 TuxCare security update for org.springframework (18 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1...
CLSA-2026-1789391519 TuxCare security update for org.bouncycastle (4 CVEs)
TuxCare rebuilt 38 org.bouncycastle packages to address 4 CVEs. Fixed in 1.77-tuxcare.2...
Astra Linux – Vulnerability in libxstream-java
XStream is a Java library for serializing objects to XML and back again. Before version 1.4.16, XStream had a vulnerability that could allow a remote attacker to request data from internal resources that were not publicly available, by manipulating the processed input stream. No users are affecte...
Astra Linux – Vulnerability in libxstream-java
XStream is a Java library for serializing objects to XML and back again. Before version 1.4.16, XStream had a vulnerability that could allow a remote attacker to execute arbitrary code by manipulating the processed input stream. However, users who followed the recommendations to set up XStream’s...
CLSA-2026-1789387099 TuxCare security update for io.netty (9 CVEs)
TuxCare rebuilt 47 io.netty packages to address 9 CVEs. Fixed in 4.1.93.Final-tuxcare.4...
CLSA-2026-1789307500 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2...
DEBIAN-CVE-2026-90473
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...
CVE-2026-90472
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...