69683 matches found
EUVD-2026-66838
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864
Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request with Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is processed directly via r...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
Nesting-Depth Guard Bypass
Bouncy Castle for Java is vulnerable to a nesting-depth guard bypass. The vulnerability is due to forcing a lazy ASN.1 sequence resetting the nesting-depth guard, which allows an attacker to exploit deeply nested ASN.1 structures...
Plaintext Exposure
Bouncy Castle for Java is vulnerable to plaintext exposure. The vulnerability is due to CCM-family modes writing decrypted plaintext to the caller-provided buffer before verifying the authentication tag, which allows an attacker to exploit unauthenticated or tampered ciphertext to access plaintex...
androidReverse v20
Android Reverse A reverse engineering suite that runs entirely on Android. No PC, no ADB, no desktop tools — everything from APK extraction to native binary analysis happens on-device. MCP Server androidReverse includes a built-in Model Context Protocol server, allowing MCP-compatible AI clients ...
TencentOS Server 3: java-21-openjdk (TSSA-2026:0927)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0927 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
OPENSUSE-SU-2026:11621-1 java-25-openjdk-25.0.4.1-1.1 on GA media
These are all security issues fixed in the java-25-openjdk-25.0.4.1-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-83117
Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An improper access control issue exists in the web management interface. Under specific conditions, unauthenticated remote requests targeting...
...[ More ]
Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a...
java-11-openjdk-11.0.32.1-1.1 on GA media (moderate)
java-11-openjdk-11.0.32.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11594-1 Rating: moderate Cross-References: CVE-2026-60589 CVE-2026-61308 CVE-2026-70907 CVSS scores: CVE-2026-60589 SUSE : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2026-61308 SUSE : 6.8...
MiracleLinux 9 : java-21-openjdk-21.0.12.1.1-1.2.el9.ML.1 (AXSA:2026-1672:10)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1672:10 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has...
TencentOS Server 3: java-17-openjdk (TSSA-2026:0928)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0928 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0926)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0926 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
CLSA-2026-1787788030 java-21-openjdk: Fix of 3 CVEs
Update to jdk-21.0.12.1+1 GA - CVE-2026-60589: Improve Resource Resolving - CVE-2026-61308: Enhance HTTP Connections - CVE-2026-70907: Enhance TLS server...
CLSA-2026-1787786503 java-1.8.0-openjdk: Fix of 3 CVEs
Update to shenandoah-jdk8u504-b01 - Security fixes from OpenJDK 8u504-b01: - CVE-2026-60589: improve resource resolving - CVE-2026-61308: enhance HTTP connections - CVE-2026-70907: enhance TLS server...
CLSA-2026-1787785077 java-17-openjdk: Fix of 3 CVEs
Update to jdk-17.0.20.1+1 GA - CVE-2026-60589: Improve Resource Resolving - CVE-2026-61308: Enhance HTTP Connections - CVE-2026-70907: Enhance TLS server...
