org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names

A flaw was found in jsoup, a Java library for working with HTML. The HTML parser incorrectly handles malformed tag names ending in a control character. When a custom Safelist allows certain raw-text elements, this misparsing can cause content that should be inert to be processed as active markup...

ROOT-APP-MAVEN-CVE-2022-41946 CVE-2022-41946 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2022-41946 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1789494210 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1...

CLSA-2026-1789427454 TuxCare security update for org.springframework (18 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1...

CLSA-2026-1789391519 TuxCare security update for org.bouncycastle (4 CVEs)

TuxCare rebuilt 38 org.bouncycastle packages to address 4 CVEs. Fixed in 1.77-tuxcare.2...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. Before version 1.4.16, XStream had a vulnerability that could allow a remote attacker to request data from internal resources that were not publicly available, by manipulating the processed input stream. No users are affecte...

Astra Linux – Vulnerability in libxstream-java

XStream is a Java library for serializing objects to XML and back again. Before version 1.4.16, XStream had a vulnerability that could allow a remote attacker to execute arbitrary code by manipulating the processed input stream. However, users who followed the recommendations to set up XStream’s...

CLSA-2026-1789387099 TuxCare security update for io.netty (9 CVEs)

TuxCare rebuilt 47 io.netty packages to address 9 CVEs. Fixed in 4.1.93.Final-tuxcare.4...

CLSA-2026-1789307500 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2...

DEBIAN-CVE-2026-90473

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

CVE-2026-90472

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CLSA-2026-1789206834 TuxCare security update for com.rabbitmq:amqp-client (3 CVEs)

TuxCare rebuilt com.rabbitmq:amqp-client to address 3 CVEs. Fixed in 5.21.0-tuxcare.1...

CLSA-2026-1789166016 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.7-tuxcare.9...

CLSA-2026-1789142484 TuxCare security update for io.netty (4 CVEs)

TuxCare rebuilt 47 io.netty packages to address 4 CVEs. Fixed in 4.1.94.Final-tuxcare.2...

CVE-2026-85228

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

CVE-2026-85228

An integer overflow in the tensor buffer validation component of Amazon Deep Java Library (DJL) versions 0.13.0 through 0.36.0 (all platforms) allows a remote unauthenticated actor to read information from adjacent process memory or trigger a denial of service by submitting a crafted tensor paylo...

CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

CLEANSTART-2026-AM39668 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...