Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3301 (ALAS-2026-3301)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.492.b09-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3301 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

java-webauthn-server security vulnerability

java-webauthn-server is a Java server-side web authentication library developed by Yubico. There were security vulnerabilities in versions of java-webauthn-server from 2.8.0 to 2.8.2. These vulnerabilities stemmed from incorrect check functions that accessed return values during the second-factor...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalV...

PT-2026-41161

Name of the Vulnerable Software and Affected Versions opentelemetry-java versions prior to 1.62.0 Description A flaw in the baggage propagation implementation within opentelemetry-api and opentelemetry-extension-trace-propagators allows for unbounded memory allocation and CPU consumption when...

Oracle Java SE Heap Buffer Overflow DoS

The vulnerability of the ttvarloaditemvariationstore function in the 2D component of the Oracle Java SE software platform, as well as in the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, relates to reading data beyond the allowed range of memory. Exploitation of...

Oracle Java SE DoS

The vulnerability of the JSE component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to a breach in data protection mechanisms. Exploiting this vulnerability can allow an attacker to cause service failures...

Oracle JAXP Unauthenticated Access

The vulnerability of the JAXP component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to the lack of protection for application data. Exploiting this vulnerability can allow an attacker, operati...

Security Component Data Read Modify Delete

The vulnerability of the Security component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

Security Component Data Read Modify Delete

The vulnerability of the Security component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

Oracle Java SE Code Execution

The vulnerability of the Libraries component of the Oracle Java software platform relates to reading data beyond the buffer boundaries of memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Joern 4.0.538

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Oracle Java SE JGSS Unauthorized Access

The vulnerability of the JGSS component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to a breach of data protection mechanisms. Exploiting this vulnerability can allow an attacker, operating...

Oracle Java SE Libraries DoS

The vulnerability of the Libraries component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause servi...

Oracle Java SE Networking DoS

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

Azure SDK for Java Authentication Bypass

The vulnerability of the Azure SDK for Java development software package is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions remotely...

codepoc

Java Goof This is a collection of Java demo apps that are vu...

CVE-2026-44257

efw4.X (Enterprise Framework for Web) contains a zip-slip path traversal in efw.file.FileManager.unZip prior to 4.08.010. Zip entries are extracted with new File(baseDir, zipEntry.getName()) without canonical-path validation, allowing a crafted entry such as ../../../pwned.jsp to escape the extra...

GHSA-97JF-46M3-8953 Security feature bypass vulnerability in Azure Key Vault Keys library for Java

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

Security feature bypass vulnerability in Azure Key Vault Keys library for Java

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13637 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.117)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-43512 Source advisory: OSV:GHSA-H6FC-48RJ-7QQH...