CVE-2025-69600

RayVentory Scan Engine versions 12.6 Update 8 and previous are vulnerable to command injection in the rvia component. The root cause is the improper neutralization of special elements used in system calls, where the application fails to sanitize inputs passed directly to specific options. Attacke...

CVE-2026-38945

Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path that matches the improperly terminated search criteria of rvia's Java search using the find command...

RayVentory Scan Engine security vulnerability

RayVentory Scan Engine is a network scanning engine developed by the German company RayVentory, designed for automatically discovering and collecting IT asset information. Version 12.6.4392.49 of the RayVentory Scan Engine contains a security vulnerability. This vulnerability stems from parameter...

CVE-2026-38945

Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path that matches the improperly terminated search criteria of rvia's Java search using the find command...

CVE-2026-38945

RayVentory Scan Engine (referred to as rvia ) versions 12.6 Update 8 and earlier are vulnerable to a command injection flaw. The root cause is the improper termination of search criteria within the rvia Java search mechanism when executing the find command. An adversary can exploit this by provid...

RHEL 9 : jmc (RHSA-2026:20568)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:20568 advisory. JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis o...

EUVD-2026-32001

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker on the network path between the ePA service and the Konnektor can present any TLS certificate self-signed, expired, wrong CN and intercept all SOAP traffic. This includes patient...

EUVD-2026-32000

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. Prior to 1.2.2, an attacker who can MITM the TLS connection between the client and the IDP within the TI network can substitute a forged discovery document. The forged document redirects uripukidpenc and...

Security Bulletin: Due to the use of mchange-commons-java, IBM webMethods BPM is vulnerable to malicious code execution (CVE-2026-27727).

Summary IBM webMethods BPM includes the standalone utility which includes the vulnerable component mchange-commons-java. The tool operates as a standalone utility and is not part of the main runtime environments. Vulnerability Details CVEID:CVE-2026-27727 DESCRIPTION: mchange-commons-java, a...

Security Bulletin: Due to the use of c3p0, IBM webMethods BPM is vulnerable to attack via maliciously crafted Java-serialized objects (CVE-2026-27830)

Summary IBM webMethods BPM includes the standalone utility which includes the vulnerable component c3p0. The tool operates as a standalone utility and is not part of the main runtime environments. Vulnerability Details CVEID:CVE-2026-27830 DESCRIPTION: c3p0, a JDBC Connection pooling library, is...

CVE-2026-42785

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system command...

CVE-2026-41917

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

GHSA-VR35-JM2F-8WG2 Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries

Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access User-related...

org.apache.syncope.core.am:syncope-core-am-logic (>=4.1.0-m0, <=4.1.0), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=4.1.0-m0, <=4.1.0) +33 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=4.1.0-m0, <=4.1.0)

org.apache.syncope.core:syncope-core-spring MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0 and more Source cves: CVE-2026-42782https://vu...

org.apache.syncope.core.am:syncope-core-am-logic (>=3.0.0-m0, <=3.0.16), org.apache.syncope.core.am:syncope-core-am-rest-cxf (>=3.0.0-m0, <=3.0.16) +30 more potentially affected by CVE-2026-42782 via org.apache.syncope.core:syncope-core-spring (>=3.0.0-m0, <=3.0.16)

org.apache.syncope.core:syncope-core-spring MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0, =3.0.16 and more Source cves:...

CLSA-2026-1779740981 java-1.8.0-openjdk: Fix of 8 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u492-b09 GA. That fixes following CVEs: - CVE-2026-22003: hotspot DoS via sandboxed Java Web Start/applets with untrusted code resource exhaustion - CVE-2026-22007: Security component, local high-complexity low-impact info disclosure -...

lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing

A flaw was found in lz4-java. This vulnerability allows disclosure of sensitive data via crafted compressed input due to insufficient clearing of the output buffer in Java-based decompressor implementations...

Important: Red Hat Security Advisory: jmc security update

An update for jmc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0365)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0365 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: java-21-openjdk (TSSA-2026:0396)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0396 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...