The vulnerability of the JSE component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to trigger a service failure.

The vulnerability of the JSE component of Oracle Java SE software, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to a breach in data protection mechanisms. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the `tt_var_load_item_variation_store` function in the 2D component of the Oracle Java SE software platform, as well as in the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows a malicious actor to cause a service failure.

The vulnerability of the ttvarloaditemvariationstore function in the 2D component of the Oracle Java SE software platform, as well as in the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, relates to reading data beyond the allowed range of memory. Exploitation of...

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to cause service failures.

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

The vulnerability of the Security component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows a perpetrator to gain access to read, modify, and delete data.

The vulnerability of the Security component of the Oracle Java SE software platform, as well as of the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to...

The vulnerability of the Azure SDK for Java development software package lies in its authentication procedures’ flaws, which allow attackers to circumvent security restrictions.

The vulnerability of the Azure SDK for Java development software package is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions remotely...

codepoc

Java Goof This is a collection of Java demo apps that are vu...

CVE-2026-44257

efw4.X (Enterprise Framework for Web) contains a zip-slip path traversal in efw.file.FileManager.unZip prior to 4.08.010. Zip entries are extracted with new File(baseDir, zipEntry.getName()) without canonical-path validation, allowing a crafted entry such as ../../../pwned.jsp to escape the extra...

GHSA-97JF-46M3-8953 Security feature bypass vulnerability in Azure Key Vault Keys library for Java

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

Security feature bypass vulnerability in Azure Key Vault Keys library for Java

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

CVE-2026-33117

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

geronimo:geronimo-tomcat (>=1.0-m5, <=1.1.1), geronimo:geronimo-tomcat-builder (>=1.0-m5, <=1.1.1) +17 more potentially affected by CVE-2026-41293 via tomcat:tomcat-coyote (>=5.5.9, <=5.5.23)

tomcat:tomcat-coyote MAVEN version =5.5.9, =1.0-m5, =1.0-m5, =1.1.1 - geronimo:tomcat 1.0 - org.apache.geronimo.assemblies:geronimo-tomcat-minimal 1.2-beta - org.apache.geronimo.configs:ca-helper-tomcat 1.2-beta - org.apache.geronimo.configs:dojo-tomcat 1.2-beta -...

acegisecurity:acegi-security-catalina (>=0.7.0, <=0.9.0), ch.qos.logback:logback-access (>=${parent.version}, <=0.8) +40 more potentially affected by CVE-2026-43515 via tomcat:catalina (>=4.0.6, <=5.5.23)

tomcat:catalina MAVEN version =4.0.6, =0.7.0, =$parent.version, =0.6, =3.2.10-1-sp3seam2hibernate5, =1.5, =1.0-m5, =1.0-m5, =1.0.0-rc1, =4.7.1, =4.7.2 - org.apache.geronimo.assemblies:geronimo-tomcat-minimal 1.2-beta - org.apache.geronimo.configs:ca-helper-tomcat 1.2-beta -...

CVE-2026-33117

Azure SDK for Java is affected by CVE-2026-33117: improper authentication allows a remote attacker to bypass a security feature over the network. The issue has a CVSS v3.1 base score of 9.1 (CRITICAL) with high impact to confidentiality and integrity, no availability impact, and requires no privi...

CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability

...

CVE-2026-33117

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability

...

CVE-2026-33117

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

SUSE-SU-2026:21608-1 Security update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu

This update for ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu fixes the following issues: Changes in ongres-scram: - Version 3.2 Fix Timing Attack Vulnerability in SCRAM Authentication bsc1250399, CVE-2025-59432 Updated dependencies and maven plugins Use...

RCE (Remote Code Execution) at mchange-commons-java dependency in Bamboo Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.9 and a CVSS Vector of...

The vulnerability of the JavaFX (WebKitGTK) component of the Oracle Java SE software platform, which allows a hacker to trigger a system failure

The vulnerability of the JavaFX WebKitGTK component of the Oracle Java software platform is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...