Oracle Java SE Unauthorized Access

The vulnerability of the components of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...

Oracle Java SE Unauthorized Access

The vulnerability of Oracle Java SE’s scripting components is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-85716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12,...

PT-2026-97046

Name of the Vulnerable Software and Affected Versions openEQUELLA versions prior to 2026.1.0 Description An authenticated non-guest user can execute arbitrary code via Java deserialization at the '/invoker/' HTTP invoker endpoint. The issue occurs because the class-name denylist enforced by...

CVE-2026-67615: Deserialization of Untrusted Data

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by...

Oracle Critical Patch Update Advisory - July 2026

This Critical Patch Update contains 19 new security patches, plus additional third party patches noted below, for Oracle Java SE. 17 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. CVE-2026-6257...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091360 advisory. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled either globally or for a specific property f...

Linux Distros Unpatched Vulnerability : CVE-2026-85718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a...

Linux Distros Unpatched Vulnerability : CVE-2026-93452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compressByteBuffer, ByteBuffer that writes past the end of the destination buffe...

Linux Distros Unpatched Vulnerability : CVE-2026-93451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompress...

APSB26-151 : Security updates available for Adobe Experience Manager (AEM) Forms

Adobe has released a security update for Adobe Experience Manager Forms on Java Enterprise Edition JEE. This update addresses critical vulnerabilities that could result in arbitrary code execution, privilege escalation, and security feature bypass. Adobe is not aware of any exploits in the wild f...

Linux Distros Unpatched Vulnerability : CVE-2026-85717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and fr...

CVE-2026-76898

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

EUVD-2026-84009

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

CVE-2026-76898 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...

org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...