Linux Distros Unpatched Vulnerability : CVE-2026-85718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12, a...

Linux Distros Unpatched Vulnerability : CVE-2026-85717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and fr...

Linux Distros Unpatched Vulnerability : CVE-2026-93451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompress...

Linux Distros Unpatched Vulnerability : CVE-2026-85716

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3.0.8 until 3.0.12,...

Linux Distros Unpatched Vulnerability : CVE-2026-93452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compressByteBuffer, ByteBuffer that writes past the end of the destination buffe...

CVE-2026-76898

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

CVE-2026-76898 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

CVE-2026-76898

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

EUVD-2026-84009

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...

org.bouncycastle/bc-java: Bouncy Castle for Java: Denial of Service via quadratic-time escaping of X.500 distinguished names

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

CVE-2026-94301 Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

The fix for CVE-2026-47065/ZDRES-232 "resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy", released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance...

Security Bulletin: Multiple Vulnerabilities affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.

Summary Due to the use of IBM® Runtime Environment Java™, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to multiple vulnerabilities. CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have updated the...

Security Bulletin: Multiple Vulnerabilities affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.

Summary Due to the use of IBM® Runtime Environment Java™, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to multiple vulnerabilities. CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have updated the...

log4j-shell-poc-azure

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-...

CVE-2026-76898: Server-Side Request Forgery (SSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the...

PT-2026-96160

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.3.8 Description An issue exists where the application fails to properly block IPv6 Unique Local Addresses ULA because the check in Utils.sanitizeUrl compares text prefixes fc00:: and fd00:: while the JDK returns...