CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...

CVE-2026-9828 Logback deserialization whitelist bypass for java.lang and java.util

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer c...

CVE-2026-9828

CVE-2026-9828 is a deserialization whitelist bypass in Logback Core’s HardenedObjectInputStream. In affected builds up to 1.5.32, an attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer could instantiate objects from java.lang and java.util that are not b...

Amazon Corretto Java 8.x < 8.372.07.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.372.07.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2023-Apr-18 advisory. - security-libs/javax.net.ssl CVE-2023-21930, CVE-2023-21967 - core-libs/java.net CVE-2023-21937 -...

Oracle OpenJDK Multiple Vulnerabilities (Apr 2023)

Oracle OpenJDK is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:openjdk"; ifdescripti...

Amazon Corretto Java 8.x < 8.332.08.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 8 8.332.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2022-Apr-19 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has...

Amazon Corretto Java 17.x < 17.0.3.6.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 17 17.0.3.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2022-Apr-17 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has...

Amazon Corretto Java 18.x < 18.0.1.10.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 18 18.0.1.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-18-2022-Apr-19 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input ha...

Amazon Corretto Java 17.x < 17.0.2.8.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 17 17.0.2.8.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2022-Jan-18 advisory. - core-libs/java.io:serialization CVE-2022-21248, CVE-2022-21341 - client-libs/javax.imageio...

CVE-2009-2724: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks."...