PT-2026-73348

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM...

MINI-MP4J-789V-2RH8

Bulletin has no description...

DoS (Denial of Service) at com.mchange:mchange-commons-java Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H allows an...

SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2026:3614-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3614-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIM...

CVE-2026-73635: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-demo / etc (SUSE-SU-2026:3615-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3615-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycm...

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Fri Aug 14 20:25:19 CDT 2026 Updated: Fri Aug 21 10:35:27 CDT 2026 Update: Updated the summary to highlight the additional installation instructions. The most recent version of this document is available here:...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, skaffold, opentofu, rancher-fleet, tailscale, kubernetes-csi-external-health-monitor, kubernetes-dashboard-metrics-scraper, nri-kubernetes, kubernetes-event-exporter, falcosidekick, kubernetes-csi-node-driver-registrar, swagger, nri-prometheus, k8sgp...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, skaffold, opentofu, rancher-fleet, kubernetes-csi-external-health-monitor, kubernetes-dashboard-metrics-scraper, kubernetes-event-exporter, falcosidekick, nri-prometheus, k8sgpt, bank-vaults, flyte, metrics-server, kubewatch, sftpgo-plugin-pubsub,...

CVE-2026-56859 vulnerabilities

Vulnerabilities for packages: step-kms-plugin, skaffold, opentofu, rancher-fleet, kubernetes-csi-external-health-monitor, kubernetes-dashboard-metrics-scraper, kubernetes-event-exporter, falcosidekick, nri-prometheus, k8sgpt, bank-vaults, flyte, metrics-server, kubewatch, sftpgo-plugin-pubsub,...

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

GHSA-H84G-69H7-MW6V mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

EUVD-2026-41135

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"...

SUSE-SU-2026:3623-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Security issues fixed: - CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize bsc1272459. - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data bsc127222...

Directory Traversal

Overview ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java. Affected versions of this package are vulnerable to Directory Traversal in MDCBasedDiscriminator, used by SiftingAppender, which takes an MDC value as the discriminating key without removin...

DEBIAN-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

UBUNTU-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

EUVD-2026-58667

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...