CVE-2026-77421

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

CVE-2026-86512

A flaw was found in java-json-tools json-patch. This vulnerability, located in the CopyOperation.apply and MoveOperation.apply functions, allows for improper access controls. A remote attacker could exploit this to potentially perform unauthorized operations, leading to impacts on confidentiality...

CVE-2026-86319

A flaw was found in java-json-tools json-patch. A remote attacker can exploit a vulnerability in the JsonPatch.apply function within the Patch Operation Handler component. By manipulating input, an attacker can cause excessive resource consumption, leading to a Denial of Service DoS condition...

CVE-2026-95848

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-95846

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2020-17533

I. Recientemente, se descubrió una vulnerabilidad de ejecución remota de código en Apache Struts2 ID CVE: CVE-2020-17530. Apache Struts2 es un framework web para desarrollar aplicaciones web Java EE. Tiene un amplio rango de aplicaciones, por lo que el alcance de la amenaza es grande. II...

CVE-2026-75516

A flaw was found in the RabbitMQ Java client. A malicious AMQP Advanced Message Queuing Protocol server, or a man-in-the-middle attacker, can modify connection parameters and inject oversized frames. This can cause the client to allocate a large amount of memory, leading to memory exhaustion and...

CVE-2026-69219

A flaw was found in the RabbitMQ Java client library. A malicious AMQP Advanced Message Queuing Protocol peer can exploit this by sending a specially crafted message during the pre-authentication phase. This message can cause the client to allocate an excessively large amount of memory, leading t...

CVE-2026-63337

A flaw was found in the RabbitMQ Java client library. A remote attacker, by intercepting or answering a JsonRpcClient request, could provide a malicious javaReturnType value. This unvalidated input is then used in Class.forName, allowing the attacker to load an arbitrary class already present in...

CVE-2026-61634

A flaw was found in the RabbitMQ Java client library. A malicious or compromised broker can send a method frame larger than the negotiated Advanced Message Queuing Protocol AMQP framemax value. This inconsistent validation causes the client to allocate and decode a protocol-invalid frame, leading...

CVE-2026-13505

A flaw was found in Bouncy Castle for Java FIPS BC-FJA. Sensitive cryptographic key material, intended to be securely erased from memory zeroised upon garbage collection, may persist longer than expected. This occurs because the zeroisation process relies on a deprecated Java finalization...

CVE-2026-95848 Moquette fails open when configured authentication or authorization classes cannot load

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-95848

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

EUVD-2026-85418

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-95848 Moquette fails open when configured authentication or authorization classes cannot load

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

joern

Joern Query Database "Joern-Scan" This is the central query database for the open-source code analysis platform Joern. It has two purposes: It provides the batteries required to turn Joern into a ready-to-run code scanning tool. Its queries serve as examples useful for those looking to write thei...

CVE-2026-18490

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint BrmRMISSLServerSocketFactory.java:95, EP8. An adjacent-network attacker can deliver a crafted...

CVE-2026-75935

A flaw was found in Amazon ion-java. This uncontrolled memory allocation vulnerability in the binary Ion stream cursor allows remote attackers to cause a denial of service DoS by sending a specially crafted Ion binary document. The crafted document contains a declared-length field that triggers...

CVE-2026-18490

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution due to a Java native deserialization flaw. The issue resides in the PayDir Business Rules Manager RMI SSL endpoint, specifically within BrmRMISSLServerSocketFactory.java:95, EP8. An...