CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58667

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58660

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, aactl...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: task, bom, dagger, osv-scanner, argo-events, flux-kustomize-controller, apko, grafana-alloy, k8sgpt, pulumi-language-yaml, scorecard, src-fingerprint, zarf, crossplane, kots, kargo, pulumi-kubernetes-operator, flux, argocd-image-updater,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: task, bom, dagger, osv-scanner, argo-events, flux-kustomize-controller, apko, grafana-alloy, k8sgpt, pulumi-language-yaml, scorecard, src-fingerprint, zarf, crossplane, kots, kargo, pulumi-kubernetes-operator, flux, argocd-image-updater,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: cerbos, gomplate, bom, dagger, osv-scanner, teleport, argo-events, grafana-alloy, apko, pulumi-language-yaml, gitaly, scorecard, src-fingerprint, zarf, crossplane, kots, kargo, rancher-fleet, trivy-operator, pulumi-kubernetes-operator, flux, argocd-image-updater,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kube-bench, falco-no-driver, bank-vaults, jitsucom-bulker, gke-gcloud-auth-plugin, nri-apache, kubescape-operator, descheduler, zarf, runc, dapr, newrelic-infra-operator, traefik, kubernetes-event-exporter, kubernetes-replicator, docker-machine-driver-harvester,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: aactl, pulumi-language-java...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, falco-no-driver, dagger, podman, zarf, prometheus-operator, traefik, trivy-operator, flux-image-automation-controller, slsa-verifier, glab, hcloud, kubescape, pulumi-language-dotnet, gitlab-pages, act, kaf, trivy,...

PT-2026-80164

Name of the Vulnerable Software and Affected Versions NLTK Stanford Wrappers affected versions not specified Description An issue exists that allows for JVM Argument Injection Bypass. This occurs when an attacker can inject arbitrary arguments into the Java Virtual Machine JVM, which is the engin...

PT-2026-72028

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.2 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. This allows an attacker who can...

CVE-2026-19880: Improper Limitation of a Pathname to a Restricted Directory

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation

A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...

CVE-2026-18511

IBM i 7.3–7.6 is affected by CVE-2026-18511. The vulnerability arises in the Native IBM i JSSE provider during TLS session establishment due to improper bounds checking, allowing a local authenticated attacker to overflow a fixed-length buffer and potentially execute arbitrary code or crash the J...

CVE-2026-18249

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249

IBM i 7.3–7.6 is vulnerable to privilege escalation via improper pointer validation from Java-controlled addresses (CWE-269), requiring a remote authenticated attacker with low privileges. IBM provides PTFs for all affected releases (e.g., SJ11037 for 7.6); no workarounds are available. No exploi...

CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...