io.github.skylot:jadx-core (>=1.5.2, <=1.5.5), io.github.skylot:jadx-java-input (>=1.5.2, <=1.5.5) +5 more potentially affected by CVE-2026-54684 via io.github.skylot:jadx-zip (>=1.5.2, <=1.5.5)

io.github.skylot:jadx-zip MAVEN version =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.5 Source cves: CVE-2026-54684 Source advisory: SNYK:JAVA-IOGITHUBSKYLOT-17980835...

Joern 4.0.581

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

maven:3.9 security update

aopalliance 0:1.0-49 - Update javapackages test plan to f42 0:1.0-40 - Rebuilt for https://fedoraproject.org/wiki/Fedora41MassRebuild 0:1.0-39 - Rebuilt for java-21-openjdk as system jdk 0:1.0-38 - bump of release for for java-21-openjdk as system jdk 0:1.0-37 - Rebuilt for...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +21492 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (>=2.21.0, <=2.21.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.21.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.3, =0.4.0, =0.4.0, =1.2.2, =1.2.2, =1.2.2, =1.3.0 and more Source cves: CVE-2026-59889 Source advisory:...

io.github.skylot:jadx-core (>=1.5.2, <=1.5.5), io.github.skylot:jadx-java-input (>=1.5.2, <=1.5.5) +5 more potentially affected by CVE-2026-54684 via io.github.skylot:jadx-zip (>=1.5.2, <=1.5.5)

io.github.skylot:jadx-zip MAVEN version =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.2, =1.5.5 Source cves: CVE-2026-54684 Source advisory: MEND:CVE-2026-54684...

io.github.ifeng113:debug4j-core (>=0.0.1, <=0.2.3), io.github.ifeng113:debug4j-daemon (>=0.0.1, <=0.2.3) +7 more potentially affected by CVE-2026-42049 via io.github.skylot:jadx-core (>=1.5.1, <=1.5.5)

io.github.skylot:jadx-core MAVEN version =1.5.1, =0.0.1, =0.0.1, =0.0.1, =1.5.1, =1.5.1, =1.5.2, =1.5.1, =1.5.1, =1.5.1, =1.5.5 Source cves: CVE-2026-42049 Source advisory: MEND:CVE-2026-42049...

Security Bulletin: IBM Sterling Connect:Direct FTP+ is impacted by vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct FTP+ in product configuration and data transmission. IBM Sterling Connect:Direct FTP+ is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct FTP+ has upgraded IBM Java 17 to address the issues CVE-2026-34282,...

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct for UNIX in product configuration and data transmission. IBM Sterling Connect:Direct for UNIX is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct for UNIX has upgraded IBM Java 17 to address the issues CVE-2026-3428...

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

UBUNTU-CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

CVE-2026-59888 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

Security Bulletin: Vulnerability affect cryptography-46.0.5, and bcprov-jdk18on-1.82.jar IBM COS Systems (July 2026)

Summary Vulnerability with cryptography-46.0.5 CVE-2026-39892, and bcprov-jdk18on-1.82.jar CVE-2025-14813, CVE-2026-5598 . This vulnerability has been addressed in the latest ClevOS release. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION: cryptography is a package designed to expose...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

EUVD-2026-43635

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...