bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy ...

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The GOSTCTR implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the G3413CTRBlockCiphe...

bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The LDAPStoreHelper implementation fails to properly neutralize special elements in user-supplied input before incorporating them into LDAP queries. This allows a remote attacker to execute an LDAP injection attack by supplying...

Security Bulletin: IBM Transformation Extender Advanced is affected by multiple Java vulnerabilities.

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is affected by multiple vulnerabilities because it is dependent on Java. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with netwo...

RHSA-2026:52949 Red Hat Security Advisory: java-1.8.0-ibm security update

Bulletin has no description...

RHSA-2026:52948 Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk security update

Bulletin has no description...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple critical vulnerabilities in OpenSSL, Java SE, and Jetty

Summary IBM Cloud Pak for Data System 1x uses OpenSSL, Java SE, and Eclipse Jetty to provide cryptographic, runtime, and web application server functionality. This security update addresses multiple critical vulnerabilities affecting these components, including ASN.1 decoding flaws, CMS/PKCS7...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node. Mitigation To reduce the risk, enable th...

K000162864: Oracle Java SE vulnerability CVE-2026-22018

Security Advisory Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26...

Security Bulletin: Vulnerability in Java affects IBM Netezza Appliance

Summary The Java package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-34282 Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CLSA-2026-1786423284 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 2 org.springframework packages to address 1 CVE. Fixed in 5.2.13.RELEASE-tuxcare.8...

CVE-2026-24330

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

CVE-2026-24330

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

This Week in Spring - August 11th, 2026

Hi, Spring fans! Welcome back to another lively edition of This Week in Spring! So much is always happening in the Spring world, and that’s part of what makes it so fun to follow. One of my favorite things is how much the community contributes and how great it is to connect with everyone. In earl...

CVE-2026-58235: Dependency on Vulnerable Third-Party Component

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

java-11-openj9-11.0.32.0-1.1 on GA media (moderate)

java-11-openj9-11.0.32.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11485-1 Rating: moderate Cross-References: CVE-2026-16439 CVE-2026-16441 CVE-2026-41254 CVE-2026-46968 CVE-2026-47010 CVE-2026-47027 CVE-2026-47057 CVE-2026-47059 CVSS scores: CVE-2026-16439 SUSE : 7.7...

java-25-openj9-25.0.4.0-1.1 on GA media (moderate)

java-25-openj9-25.0.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11489-1 Rating: moderate Cross-References: CVE-2026-16439 CVE-2026-16441 CVE-2026-41254 CVE-2026-46968 CVE-2026-47010 CVE-2026-47027 CVE-2026-47059 CVSS scores: CVE-2026-16439 SUSE : 7.7...

PT-2026-70938

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 2.0.0 Description An issue exists where the http function in HttpFunction.java passes a user-controlled URI argument to URI.create and the server-side HTTP client. Because the system does not restrict private, loopback...

java-1_8_0-openj9-1.8.0.502-1.1 on GA media (moderate)

java-180-openj9-1.8.0.502-1.1 on GA media Announcement ID: openSUSE-SU-2026:11487-1 Rating: moderate Cross-References: CVE-2026-16439 CVE-2026-16441 CVE-2026-46968 CVE-2026-47021 CVE-2026-47058 CVE-2026-47063 CVE-2026-60147 CVSS scores: CVE-2026-16439 SUSE : 7.7...