io.zipkin:benchmarks (2.22.1) potentially affected by CVE-2026-82265 via io.zipkin:zipkin-server (2.22.1)

io.zipkin:zipkin-server MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.zipkin:zipkin-server and may be impacted: - io.zipkin:benchmarks 2.22.1 Source cves: CVE-2026-82265 Source advisory: SNYK:JAVA-IOZIPKIN-19477049...

CVE-2026-83497 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

CVE-2026-83497 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

CVE-2026-83497

CVE-2026-83497 is an unrestricted Java deserialization vulnerability in the cursor pagination component of the OpenSearch SQL plugin . A remote authenticated user with basic read/search permissions can execute arbitrary code on the server by sending a crafted cursor parameter to the /_plugins/_sq...

DoS (Denial of Service) at com.mchange:mchange-commons-java Dependency in Crucible Server

This High severity DoS Denial of Service vulnerability was introduced in version 4.9.0 of Crucible Server. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H allows an authenticated attacker to cause a resource to b...

CLSA-2026-1788196519 TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.3...

SUSE-SU-2026:23591-1 Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308: OpenJDK: Enhance HTTP Connections bsc1275778. - CVE-2026-70906: OpenJDK: Improve font loading bsc1275763. - CVE-2026-70907: OpenJDK: Enhance TLS server...

CLSA-2026-1788193903 TuxCare security update for io.netty (2 CVEs)

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.48.Final-tuxcare.3...

OPENSUSE-SU-2026:21714-1 Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308: OpenJDK: Enhance HTTP Connections bsc1275778. - CVE-2026-70906: OpenJDK: Improve font loading bsc1275763. - CVE-2026-70907: OpenJDK: Enhance TLS server...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-47027, CVE-2026-47063, CVE-2026-60147 Vulnerability Details CVEID:CVE-2026-47063 DESCRIPTION: Easily exploitable vulnerabilit...

RHLW-2026-36BDDA9F7CE1C5CB Lightwell Security Advisory: logback-classic 1.2.12.rhlw-00005

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.2.12.rhlw-00005 with backported fixes for CVE-2023-6378 and CVE-2024-12801. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12801: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to...

offsec-lab

OffSec Lab — Classic CVE Exploitation Labs + Knowledge Base A...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

Security Bulletin: Maximo AI Service uses java 17.0.13 which is vulnerable to CVE-2025-21502.

Summary Maximo AI Service uses java 17.0.13 which is vulnerable to CVE-2025-21502. This bulletin contains information regarding the vulnerability and its fix. Vulnerability Details CVEID:CVE-2025-21502 DESCRIPTION: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM...

Improper Certificate Validation

Bouncy Castle for Java is vulnerable to Improper Certificate Validation. The vulnerability is due to improper hostname verification behavior, which allows an attacker to exploit certificate validation by relying on the certificate’s Common Name CN when the hostname does not properly match the...

Improper Verification Of Cryptographic Signature

Bouncy Castle for Java is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to RSA PKCS1 signature verification skipping the last two hash bytes when processing the NULL-omitted path, which allows an attacker to forge or bypass RSA signature verification by...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to IBM Semeru Runtime. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

Security Bulletin: Multiple Vulnerabilities in Java affecting IBM Knowledge Catalog and IBM Master Data Management Neo4j On Cloud Pak for Data

Summary Multiple Vulnerabilities in Java affecting IBM Knowledge Catalog Neo4j On Cloud Pak for Data Multiple Vulnerabilities in Java affectingIBM Master Data Management Neo4j On Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an intege...