Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protoco...

Security Bulletin: Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2026 - Includes Oracle April 2026 CPU

Summary Db2 Query Management Facility is vulnerable to IBM SDK, Java Technology Edition Quarterly CPU - Apr 2026 - Includes Oracle April 2026 CPU plus CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, and CVE-2026-22007 Vulnerability Details CVEID:CVE-2026-22016...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41729 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41728 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41837 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

net.blugrid:blugrid-java-core (>=2.0.1, <=2.0.4-1), net.blugrid:blugrid-java-core-resources (>=2.0.3, <=2.0.3-7) +4 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (2.4.2.release)

org.springframework.data:spring-data-rest-core MAVEN version 2.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-rest-core and may be impacted: - net.blugrid:blugrid-java-core =2.0.1, =2.0.3, =2.0.4,...

CVE-2026-50076

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via...

CVE-2026-35568

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, o...

GHSA-8F39-V287-78JF Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via...

CVE-2026-50076

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via...

PT-2026-46269

Name of the Vulnerable Software and Affected Versions Apache Fory fory-core versions prior to 1.1.0 Description Deserialization of untrusted data in the Java replace-resolve path on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks. B...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Service Registry and Repository due to April 2026 CPU

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, used by WebSphere Service Registry and Repository. These issues were disclosed as part of the IBM Java SDK updates in April 2026. These issues are also addressed by WebSphere Application Server shipped with WebSphere...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK

Summary There are multiple vulnerabilities in IBM Java SDK, Java Technology Edition used by IBM App Connect Enterprise and IBM Integration Bus for z/OS . Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access vi...

io.debezium:debezium-platform-conductor (>=3.5.0.cr1, <=3.7.0.beta1), io.jenkins.plugins:jobcacher-oras-storage (>=8.vc4686b_899f53, <=144.vb_727c9b_7d229) +10 more potentially affected by unknown CVE via land.oras:oras-java-sdk (>=0.2.0, <=0.6.1)

land.oras:oras-java-sdk MAVEN version =0.2.0, =3.5.0.cr1, =8.vc4686b899f53, =0.2.0-4.vc50576b371f6, =7.v5b3e89ff2fca, =8.v5d229eba22c5, =5.v2bc0b458b8b2, =0.0.1, =0.0.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: SNYK:JAVA-LANDORAS-17279583...

io.debezium:debezium-platform-conductor (>=3.5.0.cr1, <=3.7.0.beta1), io.jenkins.plugins:jobcacher-oras-storage (>=8.vc4686b_899f53, <=144.vb_727c9b_7d229) +10 more potentially affected by unknown CVE via land.oras:oras-java-sdk (>=0.2.0, <=0.6.1)

land.oras:oras-java-sdk MAVEN version =0.2.0, =3.5.0.cr1, =8.vc4686b899f53, =0.2.0-4.vc50576b371f6, =7.v5b3e89ff2fca, =8.v5d229eba22c5, =5.v2bc0b458b8b2, =0.0.1, =0.0.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XM96-GFJX-JCRC...

io.debezium:debezium-platform-conductor (>=3.5.0.cr1, <=3.7.0.beta1), io.jenkins.plugins:jobcacher-oras-storage (>=8.vc4686b_899f53, <=144.vb_727c9b_7d229) +10 more potentially affected by unknown CVE via land.oras:oras-java-sdk (>=0.2.0, <=0.6.1)

land.oras:oras-java-sdk MAVEN version =0.2.0, =3.5.0.cr1, =8.vc4686b899f53, =0.2.0-4.vc50576b371f6, =7.v5b3e89ff2fca, =8.v5d229eba22c5, =5.v2bc0b458b8b2, =0.0.1, =0.0.1, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: GHSA-XM96-GFJX-JCRC...

CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability

...

BIT-HYPERLEDGER-FABRIC-ORDERER-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...

CVE-2026-7411

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an...

CVE-2026-7412

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to execute blind HTTP POST requests to...