vulnerabilities in Adobe Experience Manager Forms JEE

Adobe has identified 6 vulnerabilities in Adobe Experience Manager AEM Forms for Java Enterprise Edition JEE, including AEM 6.5 Forms and AEM 6.5 LTS Forms. These vulnerabilities concern various security issues, such as improper authorization, inadequate input validation, Server-Side Request...

CLSA-2026-1785266060 java-1.8.0-openjdk: Fix of 11 CVEs

Update to shenandoah-jdk8u502-b07 - Security fixes from OpenJDK 8u502-b07: - CVE-2026-47057: improve Nashorn index handling - CVE-2026-47063: enhance jar handling - CVE-2026-47058: enhance DataView implementation - CVE-2026-47027: enhance jar file processing - CVE-2026-47021: enhance XBM image...

Moderate: Red Hat Security Advisory: java-1.8.0-ibm security update

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

A flaw was found in OpenJDK. The XML cryptographic component does not properly utilize the base Uniform Resource Identifier URI when resolving external references during data retrieval. A remote attacker could exploit this flaw by providing crafted XML input to induce the application to fetch...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

A flaw was found in OpenJDK. This vulnerability leads to information disclosure because the java.net.HttpURLConnection networking component does not remove Proxy-Authorization headers during cross-host HTTP Hypertext Transfer Protocol redirects. A remote attacker controlling a web server can...

OpenJDK: Enhance TLS server (2026-08 Security Update)

A flaw was found in OpenJDK. An unauthenticated remote attacker can cause a Denial of Service DoS by repeatedly sending replayed handshake initiation messages ClientHello to a Transport Layer Security TLS server. Because the server fails to properly restrict the negotiation loop, it emits an...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +12910 more potentially affected by CVE-2026-87022 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-87022 Source advisory: MEND:CVE-2026-87022...

CLSA-2026-1790151363 java-1.7.0-openjdk: Fix of CVE-2026-47010

CVE-2026-47010: Enhance JPEG handling JDK-8374058, JDK-8388811...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...

CVE-2026-12816

A flaw was found in Bouncy Castle for Java. This vulnerability allows for Message Authentication Code MAC forgery in the IESEngine stream-mode. The issue arises from a length-dependent Key Derivation Function KDF split, which an attacker could exploit to bypass integrity checks. This could lead t...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +35100 more potentially affected by CVE-2026-91776 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.6)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...

CVE-2026-12803

A flaw was found in Bouncy Castle for Java. The cryptographic module responsible for authenticated encryption does not correctly link a unique random value nonce with the message authentication code when no additional authenticated data is provided. This oversight could allow an attacker to forge...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425 jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser,...

CVE-2026-89425

The FasterXML jackson-core library contains a vulnerability in the UTF8DataInputJsonParser._reportInvalidToken() method. The root cause is that this specific parser fails to honor ErrorReportConfiguration.getMaxErrorTokenLength() (default 256) when building error messages, unlike other sibling im...

Linux Distros Unpatched Vulnerability : CVE-2026-89425

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UTF8DataInputJsonParser.reportInvalidToken in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier...

CVE-2026-77421: Inefficient Regular Expression Complexity

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

CVE-2026-18490: Deserialization of Untrusted Data

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint BrmRMISSLServerSocketFactory.java:95, EP8. An adjacent-network attacker can deliver a crafted...