com.qulice:qulice-ant (>=0.18, <=0.18.5), com.qulice:qulice-maven-plugin (>=0.18, <=0.18.5) +27 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.6.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.qulice:qulice-ant =0.18, =0.18, =0.18, =0.18.5 - net.sourceforge.pmd:pmd-apex 6.6.0 -...

com.sap.cloud.sdk.quality:pmd-rules (3.46.0), edu.hm.hafner:analysis-model (>=10.1.0, <=10.2.5) +35 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.34.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.sap.cloud.sdk.quality:pmd-rules 3.46.0 - edu.hm.hafner:analysis-model =10.1.0, =2021.12.0, =2022.1...

ch.acanda.maven:code-analysis-maven-plugin (0.16.0), edu.hm.hafner:analysis-model (10.17.0) +37 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.49.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.49.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - ch.acanda.maven:code-analysis-maven-plugin 0.16.0 - edu.hm.hafner:analysis-model 10.17.0 -...

com.sap.cloud.sdk.quality:pmd-rules (>=3.42.0, <=3.43.0), com.zxytech.jurest:jurest-pmd (>=1.1.0, <=1.1.4) +33 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (6.32.0)

net.sourceforge.pmd:pmd-core MAVEN version 6.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.sap.cloud.sdk.quality:pmd-rules =3.42.0, =1.1.0, =1.1.4 - net.sourceforge.pmd:pmd-apex 6.32.0 -...

com.github.albfernandez:pmd-gds (2.14.1), net.sourceforge.pmd:pmd-cpp (5.3.8) +19 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.3.8)

net.sourceforge.pmd:pmd-core MAVEN version 5.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.github.albfernandez:pmd-gds 2.14.1 - net.sourceforge.pmd:pmd-cpp 5.3.8 - net.sourceforge.pmd:pmd-cs...

com.astutebits:jsquint-maven-plugin (>=0.1.0, <=0.3.0), com.astutebits:jsquint-pmd (>=0.1.0, <=0.3.0) +26 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.4.1)

net.sourceforge.pmd:pmd-core MAVEN version 5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.astutebits:jsquint-maven-plugin =0.1.0, =0.1.0, =0.15.4, =0.15.4, =0.15.4, =1.7, =0.0.1, =0.8.3,...

net.sourceforge.pmd:pmd-cpp (5.2.2), net.sourceforge.pmd:pmd-cs (5.2.2) +12 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.2.2)

net.sourceforge.pmd:pmd-core MAVEN version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - net.sourceforge.pmd:pmd-cpp 5.2.2 - net.sourceforge.pmd:pmd-cs 5.2.2 - net.sourceforge.pmd:pmd-dist 5.2...

com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack (>=1.7.2, <=1.8.2), com.groupon.jenkins.plugins:dotci-plugins-starter-pack (>=1.4.2, <=1.7.1) +18 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.2.3)

net.sourceforge.pmd:pmd-core MAVEN version 5.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci-plugins-starter-pack =1.7.2, =1.4.2, =1.0.0, =1.0.1 -...

com.qulice:qulice-ant (0.13), com.qulice:qulice-maven-plugin (0.13) +20 more potentially affected by CVE-2026-28338 via net.sourceforge.pmd:pmd-core (5.3.3)

net.sourceforge.pmd:pmd-core MAVEN version 5.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on net.sourceforge.pmd:pmd-core and may be impacted: - com.qulice:qulice-ant 0.13 - com.qulice:qulice-maven-plugin 0.13 - com.qulice:qulice-pmd 0.13 -...

OSV-2026-324 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488130836 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.StringBuilder.toString...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i ( CVE-2025-48734, CVE-2025-53057)

Summary IBM Rational Developer for i is affected by an improper access control vulnerability in Apache Commons CVE-2025-48734 and an improper access control vulnerability in Java CVE-2025-53057 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2025-48734...

Security Bulletin: IBM Enterprise Application Service for Java is affected by a remote code execution vulnerability in IBM WebSphere Application Server Liberty (CVE-2025-14914)

Summary IBM Enterprise Application Service for Java is affected by a remote code execution vulnerability in IBM WebSphere Application Server Liberty with the restConnector-1.0 or restConnector-2.0 feature enabled. Vulnerability Details CVEID:CVE-2025-14914 DESCRIPTION: IBM WebSphere Application...

Trojanized Gaming Tools Spread Java-Based RAT via Browser and Chat Platforms

Threat actors are luring unsuspecting users into running trojanized gaming utilities that are distributed via browsers and chat platforms to distribute a remote access trojan RAT. "A malicious downloader staged a portable Java runtime and executed a malicious Java archive JAR file named...

net.snowflake:spark-snowflake_2.11 (>=2.5.6-spark_2.2, <=2.5.6-spark_2.4), net.snowflake:spark-snowflake_2.12 (2.5.6-spark_2.4) +1 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.11.0)

net.snowflake:snowflake-jdbc MAVEN version 3.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - net.snowflake:spark-snowflake2.11 =2.5.6-spark2.2, =2.5.6-spark2.4 - net.snowflake:spark-snowflake2.12...

org.apache.beam:beam-sdks-java-io-snowflake (>=2.25.0, <=2.60.0) potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.12.11)

net.snowflake:snowflake-jdbc MAVEN version 3.12.11 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - org.apache.beam:beam-sdks-java-io-snowflake =2.25.0, =2.60.0 Source cves: CVE-2026-3293 Source...

net.snowflake:spark-snowflake_2.11 (>=2.7.2-spark_2.2, <=2.7.2-spark_2.4), net.snowflake:spark-snowflake_2.12 (2.7.2-spark_2.4) +1 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.12.7)

net.snowflake:snowflake-jdbc MAVEN version 3.12.7 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - net.snowflake:spark-snowflake2.11 =2.7.2-spark2.2, =2.7.2-spark2.4 - net.snowflake:spark-snowflake2.12...

CVE-2026-3293 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos

A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts...

CVE-2026-3293

CVE-2026-3293 affects snowflake-bdb snowflake-jdbc up to 4.0.1, specifically the SdkProxyRoutePlanner (src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java) in the JDBC URL Handler. The vulnerability arises from manipulating the nonProxyHosts argument, which can cause ineffi...

SUSE CVE-2026-27727

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote factoryClassLocation values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an...

SUSE CVE-2026-27830

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and javax.naming.Reference instances. Several c3p0 ConnectionPoolDataSource implementations have a property called userOverridesAsString which conceptually represents a Map. Prior to...