CVE-2026-57898: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

PT-2026-57990

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12 Description Deployments using the MongoDB backend are subject to an unauthenticated arbitrary file write via the AAS thumbnail API. The issue occurs because t...

PT-2026-58288

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.15.0 through 2.18.7 jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.1.0 through 3.1.3 Description Java Records using a PropertyNamingStrategy can bypass the @JsonIgnore annotation. This...

PT-2026-57938

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

CVE-2026-59888: Improperly Controlled Modification of Dynamically-Determined Object Attributes

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

Joern 4.0.580

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-44752: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

This Week in Spring - July 14th, 2026

This Week in Spring - July 14th, 2026 In two short months, on this date in September, Java 27 will be here! Who's excited? I'm excited! I'm in delightful Denver, CO, for the amazing UberConf. I just delivered a workshop that was scheduled from 09:00 to 17:00, but it went into overtime, and we jus...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55771 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55771 Source advisory: MEND:CVE-2026-55771...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55773 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55773 Source advisory: MEND:CVE-2026-55773...

CVE-2026-55772 CedarJava has a type confusion vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

EUVD-2026-43522

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-55772 CedarJava has a type confusion vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-55772

CVE-2026-55772 affects CedarJava prior to versions 4.9 (and older 2.3.6, 3.4.1) where improper input handling can cause Record-to-Entity type confusion across the Java–Rust FFI boundary. CedarJava serializes authorization requests to the Rust cedar-policy evaluator as JSON, and the CedarMap miss-...

com.primust:primust-cedar (>=1.0.2, <=1.0.3), io.github.devnico:cedar4s-client_2.13 (>=0.1.0, <=0.1.6) +12 more potentially affected by CVE-2026-55772 via com.cedarpolicy:cedar-java (>=4.3.0, <=4.8.0)

com.cedarpolicy:cedar-java MAVEN version =4.3.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 Source cves: CVE-2026-55772 Source advisory: MEND:CVE-2026-55772...

CVE-2026-55772 CedarJava has a type confusion vulnerability

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

CVE-2026-55772

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI...

EUVD-2026-43487

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution RCE vulnerability. The flaw is located in the endpoint “/index.cfm/api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion...

CVE-2026-55773: Improper Control of Generation of Code

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

CVE-2026-55771: Improper Control of Generation of Code

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals meth...