69712 matches found
K000162892: OpenJDK vulnerability CVE-2026-60526
Security Advisory Description Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to...
CLSA-2026-1786547487 TuxCare security update for org.springframework.pulsar (3 CVEs)
TuxCare rebuilt 6 org.springframework.pulsar packages to address 3 CVEs. Fixed in 1.2.13-tuxcare.1...
CLSA-2026-1786542819 TuxCare security update for com.mchange:mchange-commons-java (1 CVE)
TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.20-tuxcare.2...
CLSA-2026-1786540569 TuxCare security update for org.apache.avro:avro-compiler (1 CVE)
TuxCare rebuilt org.apache.avro:avro-compiler to address 1 CVE. Fixed in 1.11.3-tuxcare.5...
CLSA-2026-1786534533 TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 3 CVEs. Fixed in 6.1.20-tuxcare.8...
CLSA-2026-1786518146 TuxCare security update for commons-io:commons-io (2 CVEs)
TuxCare rebuilt commons-io:commons-io to address 2 CVEs. Fixed in 2.2-tuxcare.1...
CLSA-2026-1786515016 TuxCare security update for org.springframework (17 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 17 CVEs. Fixed in 6.2.1-tuxcare.1...
Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2026-42877)
The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42877 advisory. 1:1.8.0.502.b07-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.502.b07-1.1 - Update to 8u502-b07 GA. - Update release notes for...
Linux Distros Unpatched Vulnerability : CVE-2026-13505
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and...
PT-2026-80117
TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.20-tuxcare.2...
cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext
Detailed Report: https://oss-fuzz.com/testcase?key=5126226298339328 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...
CVE-2026-73246
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...
bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...
bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...
bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The LDAPStoreHelper implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying...
bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD Authenticated Encryption with Associated Data message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory...
bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft CompositeVerifier implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially...
bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The GOSTCTR implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the G3413CTRBlockCiphe...