GO-2026-5039 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, paranoia, addon-resizer, terraform-provider-acme, temporal-server, calico, rancher-fleet, grafana-alloy, temporal-ui-server, cluster-proportional-autoscaler, glab, dgraph, litestream, descheduler, dynamic-localpv-provisioner,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: aactl, pulumi-language-java...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, terraform-provider-acme, glab, chezmoi, crossplane-provider-aws-rds, gh, opentelemetry-collector, fscrypt, fulcio, podman, traefik, scorecard, cloudflared, cloud-provider-aws, snyk-cli, syft, terraform-provider-tls, gitlab-runner,...

CVE-2026-19880: Improper Limitation of a Pathname to a Restricted Directory

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

PT-2026-72028

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.2 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. This allows an attacker who can...

PT-2026-80164

Name of the Vulnerable Software and Affected Versions NLTK Stanford Wrappers affected versions not specified Description An issue exists that allows for JVM Argument Injection Bypass. This occurs when an attacker can inject arbitrary arguments into the Java Virtual Machine JVM, which is the engin...

thrift: Apache Thrift: Denial of Service due to uncontrolled resource allocation

A flaw was found in Apache Thrift Java bindings. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or thrott...

CVE-2026-18511

IBM i 7.3–7.6 is affected by CVE-2026-18511. The vulnerability arises in the Native IBM i JSSE provider during TLS session establishment due to improper bounds checking, allowing a local authenticated attacker to overflow a fixed-length buffer and potentially execute arbitrary code or crash the J...

CVE-2026-18249

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

EUVD-2026-58468

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249

IBM i 7.3–7.6 is vulnerable to privilege escalation via improper pointer validation from Java-controlled addresses (CWE-269), requiring a remote authenticated attacker with low privileges. IBM provides PTFs for all affected releases (e.g., SJ11037 for 7.6); no workarounds are available. No exploi...

CVE-2026-18193 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses...

CVE-2026-18193

CVE-2026-18193 affects IBM i versions 7.3, 7.4, 7.5, and 7.6, specifically the IBM SDK Java Technology Edition and IBM Runtime Environment Java components. The root cause is improper validation of user-controlled addresses (CWE-269: Improper Privilege Management), allowing a remote attacker to by...

CVE-2026-18193 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses...

CVE-2026-18086

IBM i 7.3–7.6 is affected by CVE-2026-18086 in Java Secure Sockets Extension where improper bounds checking could allow a local attacker to execute arbitrary code or cause a denial of service. The NVD/NVD IBM bulletin describe the root cause as bounds-checking issues in JSSE, with a base CVSS v3....

CVE-2026-18086 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...

CVE-2026-18086 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...

CVE-2026-18068 IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion...