CVE-2026-90584 TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...

EUVD-2026-77090

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...

CVE-2026-90584

TooTallNate Java-WebSocket versions up to 1.6.1 are affected by a resource allocation flaw in the Fragmentation Handler , specifically the processFrameContinuousAndNonFin function in Draft_6455.java. A remote attacker with no authentication can trigger the weakness, resulting in low availability ...

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CLSA-2026-1789307500 TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)

TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.3-tuxcare.2...

CVE-2026-90522

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

CVE-2026-90520

A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization...

CVE-2026-90584: Allocation of Resources Without Limits or Throttling

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...

PT-2026-90968

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft 6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be...

PT-2026-90854

A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerability affects unknown code of the file AuthorizationInterceptor.java of the component Authorization Interceptor. The manipulation leads to improper authorization...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the Snappy.uncompressByteBuffer, ByteBuffer method in org/xerial/snappy/Snappy.java. An attacker can trigger JVM termination by supplying valid compressed input that expands beyond the destination ByteBuffer...

CVE-2026-90559

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

CVE-2026-90559 snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

CVE-2026-90559

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in the Snappy.uncompress(ByteBuffer, ByteBuffer) method. The root cause is that the destination buffer capacity is never validated against the decompressed size, allowing an attacker to supply valid compressed data that de...

CVE-2026-90560

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read in the ZstdDictDecompress constructor. The root cause is that offset and length arguments are never validated against the dictionary array bounds, allowing an attacker to supply arbitrary values to read memory past the end of ...

CVE-2026-90559 snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

EUVD-2026-76904

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

CVE-2026-90559 snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

Security Bulletin: IBM ApplinX is vulnerable to issues like Memory allocation, verification and validation issues due to the use of Bouncy Castle for Java (CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860 are some of the example CVEs).

Summary IBM ApplinX is vulnerable to issues like Memory allocation, verification and validation issues due to the use of Bouncy Castle for Java CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860 are some of the example CVEs. The affected versions have been updated within IBM ApplinX i...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via MessageUnpacker.skipValue in msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java. An attacker can desynchronize the parser and cause attacker-controlled data to be returned in place of lat...