62759 matches found
CVE-2026-13506
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard. This issue could lead to a Denial of Service DoS, making the affected system or application...
CVE-2026-12817
A flaw was found in Bouncy Castle for Java. This vulnerability affects the OpenPGP Authenticated Encryption with Associated Data AEAD decryption process. Specifically, the system fails to verify the final authentication tag when processing data that is aligned in chunks. This oversight could allo...
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager
Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check ...
Security Bulletin: Multiple vulnerabilities in IBM SDK, Java technology affect IBM Tivoli Composite Application Manager for Transactions (Response Time)
Summary IBM SDK, Java Technology Edition is used by IBM Tivoli Composite Application Manager for Transactions Response Time. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performe...
CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...
EUVD-2026-66838
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864
Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request with Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is processed directly via r...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject. If an...
Nesting-Depth Guard Bypass
Bouncy Castle for Java is vulnerable to a nesting-depth guard bypass. The vulnerability is due to forcing a lazy ASN.1 sequence resetting the nesting-depth guard, which allows an attacker to exploit deeply nested ASN.1 structures...
Plaintext Exposure
Bouncy Castle for Java is vulnerable to plaintext exposure. The vulnerability is due to CCM-family modes writing decrypted plaintext to the caller-provided buffer before verifying the authentication tag, which allows an attacker to exploit unauthenticated or tampered ciphertext to access plaintex...
TencentOS Server 3: java-21-openjdk (TSSA-2026:0927)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0927 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
PT-2026-83117
Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An improper access control issue exists in the web management interface. Under specific conditions, unauthenticated remote requests targeting...
OPENSUSE-SU-2026:11621-1 java-25-openjdk-25.0.4.1-1.1 on GA media
These are all security issues fixed in the java-25-openjdk-25.0.4.1-1.1 package on the GA media of openSUSE Tumbleweed...
java-11-openjdk-11.0.32.1-1.1 on GA media (moderate)
java-11-openjdk-11.0.32.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11594-1 Rating: moderate Cross-References: CVE-2026-60589 CVE-2026-61308 CVE-2026-70907 CVSS scores: CVE-2026-60589 SUSE : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2026-61308 SUSE : 6.8...
TencentOS Server 3: java-17-openjdk (TSSA-2026:0928)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0928 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
MiracleLinux 9 : java-21-openjdk-21.0.12.1.1-1.2.el9.ML.1 (AXSA:2026-1672:10)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1672:10 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has...
TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0926)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0926 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
