Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition (CVE-2026-61308, CVE-2026-71054, CVE-2026-70907, CVE-2026-60589)

Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their August 2026 Critical Security Patch Update. For more information please refer to Oracle's August 2026 CSPU Advisory and the CVE links referenced below. Vulnerability...

CLSA-2026-1788238245 TuxCare security update for com.mchange:mchange-commons-java (1 CVE)

TuxCare rebuilt com.mchange:mchange-commons-java to address 1 CVE. Fixed in 0.2.15-tuxcare.2...

PT-2026-84162

An Apache-proxied Dogtag CA REST endpoint exposed by IdM POST /ca/rest/certrequests returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification...

CVE-2026-4813: Improper Control of Generation of Code

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...

MiracleLinux 9 : java-17-openjdk-17.0.20.1.1-1.2.el9.ML.1 (AXSA:2026-1721:17)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1721:17 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has...

java-1_8_0-openj9-1.8.0.504-1.1 on GA media (moderate)

java-180-openj9-1.8.0.504-1.1 on GA media Announcement ID: openSUSE-SU-2026:11641-1 Rating: moderate Cross-References: CVE-2026-70906 CVE-2026-70907 CVSS scores: CVE-2026-70906 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-70907 SUSE : 5.3...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2026:0938)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0938 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

java-17-openj9-17.0.20.1-1.1 on GA media (moderate)

java-17-openj9-17.0.20.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11640-1 Rating: moderate Cross-References: CVE-2026-70906 CVE-2026-70907 CVSS scores: CVE-2026-70906 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-70907 SUSE : 5.3...

CLSA-2026-1788215347 TuxCare security update for org.apache.logging.log4j (7 CVEs)

TuxCare rebuilt 23 org.apache.logging.log4j packages to address 7 CVEs. Fixed in 2.11.0-tuxcare.1...

io.zipkin:benchmarks (2.22.1) potentially affected by CVE-2026-82265 via io.zipkin:zipkin-server (2.22.1)

io.zipkin:zipkin-server MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.zipkin:zipkin-server and may be impacted: - io.zipkin:benchmarks 2.22.1 Source cves: CVE-2026-82265 Source advisory: SNYK:JAVA-IOZIPKIN-19477049...

CVE-2026-83497 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

CVE-2026-83497 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

CVE-2026-83497

CVE-2026-83497 is an unrestricted Java deserialization vulnerability in the cursor pagination component of the OpenSearch SQL plugin . A remote authenticated user with basic read/search permissions can execute arbitrary code on the server by sending a crafted cursor parameter to the /_plugins/_sq...

DoS (Denial of Service) at com.mchange:mchange-commons-java Dependency in Crucible Server

This High severity DoS Denial of Service vulnerability was introduced in version 4.9.0 of Crucible Server. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H allows an authenticated attacker to cause a resource to b...

CLSA-2026-1788196519 TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.3...

SUSE-SU-2026:23591-1 Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308: OpenJDK: Enhance HTTP Connections bsc1275778. - CVE-2026-70906: OpenJDK: Improve font loading bsc1275763. - CVE-2026-70907: OpenJDK: Enhance TLS server...

CLSA-2026-1788193903 TuxCare security update for io.netty (2 CVEs)

TuxCare rebuilt 40 io.netty packages to address 2 CVEs. Fixed in 4.1.48.Final-tuxcare.3...

OPENSUSE-SU-2026:21714-1 Security update for java-25-openjdk

This update for java-25-openjdk fixes the following issues: - CVE-2026-60589: OpenJDK: Improve Resource Resolving bsc1275777. - CVE-2026-61308: OpenJDK: Enhance HTTP Connections bsc1275778. - CVE-2026-70906: OpenJDK: Improve font loading bsc1275763. - CVE-2026-70907: OpenJDK: Enhance TLS server...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in the IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs: CVE-2026-47027, CVE-2026-47063, CVE-2026-60147 Vulnerability Details CVEID:CVE-2026-47063 DESCRIPTION: Easily exploitable vulnerabilit...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...