ASB-A-457742426

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

ASB-A-454062218

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-416259739

In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Remote Code Execution (RCE)

mchange-commons-java is vulnerable to Remote Code Execution RCE. The vulnerability is due to its independent JNDI dereferencing implementation allowing remote factoryClassLocation values, which can cause the application to download and execute attacker-controlled code when processing a malicious...

com.qulice:qulice-ant (>=0.18, <=0.18.5), com.qulice:qulice-maven-plugin (>=0.18, <=0.18.5) +27 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.6.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.qulice:qulice-ant =0.18, =0.18, =0.18, =0.18.5 - net.sourceforge.pmd:pmd-apex 6.6.0 -...

net.sourceforge.pmd:pmd-apex (6.27.0), net.sourceforge.pmd:pmd-cpp (6.27.0) +32 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.27.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - net.sourceforge.pmd:pmd-apex 6.27.0 - net.sourceforge.pmd:pmd-cpp 6.27.0 - net.sourceforge.pmd:pmd-cs...

com.sap.cloud.sdk.quality:pmd-rules (>=3.42.0, <=3.43.0), com.zxytech.jurest:jurest-pmd (>=1.1.0, <=1.1.4) +33 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.32.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.sap.cloud.sdk.quality:pmd-rules =3.42.0, =1.1.0, =1.1.4 - net.sourceforge.pmd:pmd-apex 6.32.0 -...

com.sap.cloud.sdk.quality:pmd-rules (3.46.0), edu.hm.hafner:analysis-model (>=10.1.0, <=10.2.5) +35 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.34.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.sap.cloud.sdk.quality:pmd-rules 3.46.0 - edu.hm.hafner:analysis-model =10.1.0, =2021.12.0, =2022.1...

ch.acanda.maven:code-analysis-maven-plugin (0.16.0), edu.hm.hafner:analysis-model (10.17.0) +37 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.49.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.49.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - ch.acanda.maven:code-analysis-maven-plugin 0.16.0 - edu.hm.hafner:analysis-model 10.17.0 -...

com.qulice:qulice-ant (0.13), com.qulice:qulice-maven-plugin (0.13) +20 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.3.3)

net.sourceforge.pmd:pmd-core MAVEN version 5.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.qulice:qulice-ant 0.13 - com.qulice:qulice-maven-plugin 0.13 - com.qulice:qulice-pmd 0.13 -...

com.github.albfernandez:pmd-gds (2.14.1), net.sourceforge.pmd:pmd-cpp (5.3.8) +19 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.3.8)

net.sourceforge.pmd:pmd-core MAVEN version 5.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.github.albfernandez:pmd-gds 2.14.1 - net.sourceforge.pmd:pmd-cpp 5.3.8 - net.sourceforge.pmd:pmd-cs...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.4.2, <=1.7.1) +18 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.2.3)

net.sourceforge.pmd:pmd-core MAVEN version 5.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack =1.7.2, =1.4.2, =1.0.0, =1.0.1 -...

com.astutebits:jsquint-maven-plugin (>=0.1.0, <=0.3.0), com.astutebits:jsquint-pmd (>=0.1.0, <=0.3.0) +26 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.4.1)

net.sourceforge.pmd:pmd-core MAVEN version 5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.astutebits:jsquint-maven-plugin =0.1.0, =0.1.0, =0.15.4, =0.15.4, =0.15.4, =1.7, =0.0.1, =0.8.3,...

net.sourceforge.pmd:pmd-cpp (5.2.2), net.sourceforge.pmd:pmd-cs (5.2.2) +12 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.2.2)

net.sourceforge.pmd:pmd-core MAVEN version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - net.sourceforge.pmd:pmd-cpp 5.2.2 - net.sourceforge.pmd:pmd-cs 5.2.2 - net.sourceforge.pmd:pmd-dist 5.2...

OSV-2026-324 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488130836 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.StringBuilder.toString...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i ( CVE-2025-48734, CVE-2025-53057)

Summary IBM Rational Developer for i is affected by an improper access control vulnerability in Apache Commons CVE-2025-48734 and an improper access control vulnerability in Java CVE-2025-53057 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2025-48734...

Security Bulletin: IBM Enterprise Application Service for Java is affected by a remote code execution vulnerability in IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary IBM Enterprise Application Service for Java is affected by a remote code execution vulnerability in IBM WebSphere Application Server Liberty with the restConnector-1.0 or restConnector-2.0 feature enabled. Vulnerability Details CVEID:CVE-2025-14914 DESCRIPTION: IBM WebSphere Application...

Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms

Threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a remote access trojan RAT. "A malicious downloader staged a portable Java runtime and executed a malicious Java archive JAR file named...

net.snowflake:spark-snowflake_2.11 (>=2.5.6-spark_2.2, <=2.5.6-spark_2.4), net.snowflake:spark-snowflake_2.12 (2.5.6-spark_2.4) +1 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.11.0)

net.snowflake:snowflake-jdbc MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - net.snowflake:spark-snowflake2.11 =2.5.6-spark2.2, =2.5.6-spark2.4 - net.snowflake:spark-snowflake2.12...

org.apache.beam:beam-sdks-java-io-snowflake (>=2.25.0, <=2.60.0) potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.12.11)

net.snowflake:snowflake-jdbc MAVEN version 3.12.11 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.apache.beam:beam-sdks-java-io-snowflake =2.25.0, =2.60.0 Source cves: CVE-2026-3293 Source...