Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Java SE

Summary Java SE is used by IBM Cloud Pak for Data System 1x to provide core runtime functionality for Java applications. Multiple vulnerabilities affect Java SE, including CVE-2026-21932, which allows remote attackers to bypass security controls and create, delete, or modify critical data through...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=4790812572188672 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

EUVD-2026-54278

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-62293: Improper Input Validation

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

Joern 4.0.598

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-43622

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-70640

The CVE-2026-70640 issue affects llama.cpp builds b1886–b7445, with a race condition in the LLaMA-Android JNI wrapper: bench_1model() and free_1context() lack synchronization, allowing a thread to operate on freed llama_context memory. Attackers could perform heap spray using attacker-controlled ...

CVE-2026-70639 llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639

CVE-2026-70639 affects llama.cpp builds b1886–b7445, specifically the LLaMA-Android JNI wrapper. The vulnerability arises because bench_1model() does not validate the model context pointer before dereferencing it, causing a null pointer dereference. An attacker can supply a malformed, corrupt, or...

CVE-2026-70638

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

com.axonivy.ivy.tool.soap:cxf-client-codegen (2.0.0), com.codbex.atlas:codbex-atlas-application (>=2.98.0, <=2.116.0) +338 more potentially affected by CVE-2026-64958 via org.apache.cxf:cxf-core (>=4.2.0, <=4.2.2)

org.apache.cxf:cxf-core MAVEN version =4.2.0, =2.98.0, =4.0.0-beta.1, =4.0.0-beta.1, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.4 - io.camelbee:camelbee-quarkus-core 3.2.1 - io.camelbee:camelbee-quarkus-dependencies 3.2.1 - io.camelbee:camelbee-quarkus-security 3.2.1 and more Source cve...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), io.github.martinhickson:picketlink-oidc (>=3.0.8, <=5.2.6) +17 more potentially affected by CVE-2026-63687 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0, <=4.1.7)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =3.0.8, =1.0.0-rc1, =1.0.0-rc1, =1.0.0-rc1, =4.7.0, =4.0.0-m1, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =4.0.0, =4.0.0, =4.0.0, =4.1.7 and more Source cves: CVE-2026-63687 Source advisory: SNYK:JAVA-ORGAPACHECXF-19341995...

CVE-2026-46581

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

CVE-2026-57818

A Time-of-check Time-of-use (TOCTOU) race condition exists in the JCacheCodeDataProvider component of Apache CXF (specifically within cxf-rt-rs-security-oauth2). This flaw allows a remote attacker to perform an authorization code replay by submitting concurrent requests to redeem a single authori...

CVE-2026-66909

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

EUVD-2026-53854

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage

Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or,...

CLSA-2026-1785501342 java-1.8.0-openjdk: Fix of 21 CVEs

Update to shenandoah-jdk8u502-b07 - Security fixes from OpenJDK 8u502-b07: - CVE-2026-41254: update LittleCMS to 2.19.1 - CVE-2026-47057: improve Nashorn index handling - CVE-2026-47063: enhance jar handling - CVE-2026-47058: enhance DataView implementation - CVE-2026-47027: enhance jar file...

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, an...