Linux Distros Unpatched Vulnerability : CVE-2026-90473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts...

Linux Distros Unpatched Vulnerability : CVE-2026-90472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting...

PT-2026-90719

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

CVE-2026-90472: Uncontrolled Recursion

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CVE-2026-90473: Integer Overflow or Wraparound

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and...

CVE-2026-90559: Out-of-bounds Write

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompressByteBuffer, ByteBuffer because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer,...

PT-2026-90635

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger...

CLSA-2026-1789166016 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.7-tuxcare.9...

CLSA-2026-1789142484 TuxCare security update for io.netty (4 CVEs)

TuxCare rebuilt 47 io.netty packages to address 4 CVEs. Fixed in 4.1.94.Final-tuxcare.2...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.1...

CVE-2026-70906 vulnerabilities

Vulnerabilities for packages: openjdk-jipher-fips...

GHSA-X2CM-PMMM-V6XC vulnerabilities

Vulnerabilities for packages: openjdk-jipher-fips, liberica...

ROOT-APP-MAVEN-CVE-2025-66021 CVE-2025-66021 in com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer - Patched by Root

Root has patched CVE-2025-66021 in the com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-88032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted...

Linux Distros Unpatched Vulnerability : CVE-2026-88033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file...

Oracle Linux 10 / 8 / 9 : java-21-openjdk (ELSA-2026-42895)

The remote Oracle Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42895 advisory. 1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625...

Apache Artemis 1.3.0 < 2.45.0 / 2.50.0 < 2.57.0 Denial of Service (CVE-2026-57822)

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by a vulnerability: - When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java (CVE-2026-41586)

Summary IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java Vulnerability Details CVEID:CVE-2026-41586 DESCRIPTION: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the getFrameContentSizebyte, int, int, boolean bounds check in src/main/java/com/github/luben/zstd/Zstd.java. An attacker can trigger a JVM crash or read past the start of the input buffer by supplying a negative...