Lucene search
+L

57503 matches found

NVD
NVD
added 2026/07/01 10:16 p.m.17 views

CVE-2026-54704

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text...

6.5CVSS0.00224EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/01 9:17 p.m.50 views

CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...

5.3CVSS0.00263EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/01 9:17 p.m.10 views

CVE-2026-54712 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.27.0, the RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the...

5.3CVSS5.9AI score
SaveExploits0References3
CVE
CVE
added 2026/07/01 9:17 p.m.62 views

CVE-2026-54712

OpenTelemetry Java Instrumentation prior to 2.27.0 is affected. The issue resides in the RMI context propagation payload reader, which limits the number of context entries but does not limit the aggregate size of strings read, allowing an attacker who can reach a network-reachable RMI endpoint to...

7.5CVSS5.8AI score0.00263EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/07/01 9:17 p.m.15 views

CVE-2026-55153

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS0.00327EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/01 9:17 p.m.9 views

UBUNTU-CVE-2026-55153

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS5.9AI score0.00327EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/07/01 9:17 p.m.14 views

CVE-2026-55153

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS6.2AI score0.00327EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/01 9:15 p.m.53 views

CVE-2026-54704 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text...

6.5CVSS0.00224EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/01 9:15 p.m.70 views

CVE-2026-54704

OpenTelemetry Java Instrumentation contains a vulnerability in JDBC auto-instrumentation prior to version 2.28.0 where passwords in SQL CONNECT statements may not be sanitized if the password is double-quoted. This can cause clear-text database passwords to be added to trace spans and exported to...

6.5CVSS5.7AI score0.00224EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2026/07/01 8:31 p.m.11 views

GHSA-J6HM-V3X2-QV6J land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

Summary ArchiveUtils.untarInputStream, Path and ArchiveUtils.unzipInputStream, Path in land.oras:oras-java-sdk create symbolic-link entries from an archive without validating the symlink target. A malicious tar or zip shipped as an OCI layer blob can place a symlink under the extraction directory...

6AI score
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/01 8:2 p.m.9 views

CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS6AI score0.00327EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/01 8:2 p.m.53 views

CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS0.00327EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/01 8:2 p.m.68 views

CVE-2026-55153

CVE-2026-55153 affects mchange-commons-java before 0.6.0, where the JNDI ObjectFactory (com.mchange.v2.naming.JavaBeanObjectFactory) constructs arbitrary JavaBean properties, enabling JNDI injection and deserialization gadget abuse in some classes. An example is setting a Swing JEditorPane’s cont...

7.1CVSS5.9AI score0.00327EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/01 8:2 p.m.19 views

CVE-2026-55153 mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS6AI score
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/01 8:2 p.m.9 views

CVE-2026-55153

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory will construct objects of arbitrary classes and initialize...

7.1CVSS5.9AI score0.00327EPSS
SaveExploits0References2Affected Software1
RedHat Linux
RedHat Linux
added 2026/07/01 5:32 p.m.14 views

com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...

9.8CVSS8AI score0.00812EPSS
SaveExploits1References8
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/01 5:11 p.m.14 views

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Tivoli Business Service Manager and IBM Tivoli Netcool Impact. Information about security vulnerabilities affecting IBM® SDK, Java™ Technology Edition has been published in a security bulletin. Vulnerability Details...

7.5CVSS5.8AI score0.00702EPSS
SaveExploits1Affected Software1
GithubExploit
GithubExploit
added 2026/07/01 2:5 p.m.69 views

Exploit for Improper Access Control in Widgetfactorylimited Jce

No d...

10CVSS7.5AI score0.6883EPSS
SaveExploits25
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/01 1:54 p.m.12 views

Security Bulletin: Vulnerabilities in IBM Semeru SDK (CVE-2026-34282, CVE-2026-22016, CVE-2026-23865, CVE-2026-22021, CVE-2026-22018, CVE-2026-22008, CVE-2026-34268, CVE-2026-22007) affect Power HMC.

Summary The IBM Semeru SDK library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to...

7.5CVSS6.5AI score0.00702EPSS
SaveExploits2Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/01 12:58 p.m.11 views

Security Bulletin: IBM B2B Advanced Communications is vulnerable to issues due to Java SDK (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in Java SDK shipped with product. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE...

7.5CVSS6.3AI score0.00702EPSS
SaveExploits1Affected Software1
Rows per page
Query Builder