EUVD-2026-75247

When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not...

CVE-2026-57822 Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not...

CVE-2026-57822

Apache Artemis and Apache ActiveMQ Artemis are vulnerable to a Denial of Service (DoS) via unsafe Java deserialization. When the broker processes management requests from an authenticated client with MANAGE permissions, the JsonUtil.fromJsonArray() method uses ObjectInputStream.readObject() to de...

ROOT-APP-MAVEN-CVE-2026-33701 CVE-2026-33701 in io.opentelemetry.javaagent:opentelemetry-javaagent - Patched by Root

Root has patched CVE-2026-33701 in the io.opentelemetry.javaagent:opentelemetry-javaagent package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-AM39668 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-HL20029 JLine is a Java library for handling console input

Multiple security vulnerabilities affect the kafka package. JLine is a Java library for handling console input. See references for individual vulnerability details...

CVE-2026-85228: Integer Overflow or Wraparound

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

PT-2026-89271

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.3.0 through 2.44.0 Description When processing message-based management requests from an authenticated client with MANAGE permissions, the broker may trigger Java...

Linux Distros Unpatched Vulnerability : CVE-2026-89044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the...

CVE-2026-88032: Use After Free

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

CVE-2026-88033: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

PT-2026-89546

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver affected versions not specified Description A use-after-free issue exists in the reactive client-side encryption component. This occurs when an encrypted operation is cancelled, causing native resources to be freed while th...

PT-2026-89547

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver affected versions not specified Description Improper neutralization of special elements in the data query logic within the GridFS component allows a structured file identifier provided by a caller to be interpreted as a que...

DEBIAN-CVE-2026-87824

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...

UBUNTU-CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. CVE-2026-16243: arraycmp SIMD...

SUSE-SU-2026:4107-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: - CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. - CVE-2026-16243: arraycmp SIMD...

CVE-2026-73334

A flaw was found in Apache Parquet Hadoop. When processing a Parquet file, if the Key Management Service KMS Uniform Resource Locator URL is controlled by the file and not explicitly set by the application, a vulnerability can arise. An attacker could craft a malicious Parquet file to direct a KM...

CVE-2026-59643

A flaw was found in Bouncy Castle for Java and Bouncy Castle for Java FIPS BC-FJA. This vulnerability allows an attacker to bypass OpenPGP inline-signature policy failures, which are silently ignored by the software. This silent disregard of policy failures can lead to a compromise of data...

CVE-2026-65181 Apache Impala: RCE via External Data Source Class Loading

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...