CVE-2026-77423

A flaw was found in JLine. The built-in less viewer processes user-controlled search and display-filter patterns using Java's backtracking regular expression engine. A remote attacker could provide a specially crafted regular expression, leading to excessive CPU consumption and indefinitely...

CVE-2026-77422

A flaw was found in JLine, a Java library for handling console input. The built-in grep command accepts user-controlled regular expressions and automatically wraps them, which can amplify backtracking in the regular expression engine. A remote attacker could exploit this by providing a specially...

CVE-2026-96552 sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssmpro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without...

EUVD-2026-85626

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssmpro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without...

DEBIAN-CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77421

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

DEBIAN-CVE-2026-77420

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

UBUNTU-CVE-2026-77421

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

UBUNTU-CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-77422 JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-77421

The JLine Java library, used for handling console input, is vulnerable to a Denial of Service (DoS) condition in its built-in nano editor 's regex search mode. Specifically, the doSearch(String text) function in builtins/src/main/java/org/jline/builtins/Nano.java passes user-controlled search ter...

CVE-2026-86319

A flaw was found in java-json-tools json-patch. A remote attacker can exploit a vulnerability in the JsonPatch.apply function within the Patch Operation Handler component. By manipulating input, an attacker can cause excessive resource consumption, leading to a Denial of Service DoS condition...

CVE-2026-86512

A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality...

CVE-2026-95848

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-95846

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-75516

A flaw was found in the RabbitMQ Java client. A malicious AMQP Advanced Message Queuing Protocol server, or a man-in-the-middle attacker, can modify connection parameters and inject oversized frames. This can cause the client to allocate a large amount of memory, leading to memory exhaustion and...

CVE-2026-69219

A flaw was found in the RabbitMQ Java client library. A malicious AMQP Advanced Message Queuing Protocol peer can exploit this by sending a specially crafted message during the pre-authentication phase. This message can cause the client to allocate an excessively large amount of memory, leading t...

CVE-2026-63337

A flaw was found in the RabbitMQ Java client library. A remote attacker, by intercepting or answering a JsonRpcClient request, could provide a malicious javaReturnType value. This unvalidated input is then used in Class.forName, allowing the attacker to load an arbitrary class already present in...

CVE-2026-61634

A flaw was found in the RabbitMQ Java client library. A malicious or compromised broker can send a method frame larger than the negotiated Advanced Message Queuing Protocol AMQP framemax value. This inconsistent validation causes the client to allocate and decode a protocol-invalid frame, leading...