66200 matches found
org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...
org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...
org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification
A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...
org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification
A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...
org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names
A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...
CVE-2026-94301 Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
The fix for CVE-2026-47065/ZDRES-232 "resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy", released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance...
Security Bulletin: Multiple Vulnerabilities affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.
Summary Due to the use of IBM® Runtime Environment Java™, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to multiple vulnerabilities. CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have updated the...
Security Bulletin: Multiple Vulnerabilities affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.
Summary Due to the use of IBM® Runtime Environment Java™, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to multiple vulnerabilities. CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have updated the...
log4j-shell-poc-azure
log4j-shell-poc A Proof-Of-Concept for the recently found CVE-...
Spring AI and TypeSafe Jev: Fast, Cheap, Structured Decisions
Reference documentation and GitHub repository We often need quick decision-making components in our AI applications: to pick the next step in a multi-agent system, to evaluate the inputs and outputs of a complex reasoning task, to route a request, to do input ranking and reordering. Those decisio...
CVE-2026-76898: Server-Side Request Forgery (SSRF)
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...
PT-2026-96160
Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.3.8 Description An issue exists where the application fails to properly block IPv6 Unique Local Addresses ULA because the check in Utils.sanitizeUrl compares text prefixes fc00:: and fd00:: while the JDK returns...
SUSE SLED15: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (SUSE-SU-2026:4006-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4006-1 advisory. Security issues fixed: - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308:...
SUSE SLES15: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2026:4002-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4002-1 advisory. Upgrade to upstream tag jdk-17.0.20.1+1 August 2026 CSPU. - CVE-2026-60589: unauthenticated attacker with network access via multip...
Linux Distros Unpatched Vulnerability : CVE-2026-93561
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead ...
SUSE SLES15: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2026:3998-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3998-1 advisory. Update to version jdk8u504 icedtea 3.40.1. - CVE-2026-60589: unauthenticated attacker with network access via multiple protocols ca...
Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16751)
The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16751 advisory. - In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and UR...
SUSE SLES12: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2026:4054-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4054-1 advisory. Update to version jdk8u504 icedtea 3.40.1. - CVE-2026-60589: unauthenticated attacker with network access via multiple protocols ca...
SUSE SLED15: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (SUSE-SU-2026:3999-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3999-1 advisory. - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308: OpenJDK: Enhance HTTP...