Linux Distros Unpatched Vulnerability : CVE-2026-13506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

PT-2026-67239

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bctls-fips versions prior to 1.0.24 Bouncy Castle for Java FIPS BC-FJA bctls-fips versions prior to 2.0.24...

PT-2026-67019

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Description The MLS wire decoder allocates memory based on an opaque length declared by an attacker before performing a bounds check. This behavior can lead to excessive memory allocation...

PT-2026-67234

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Bouncy Castle for Java FIPS BC-FJA bcmail-fips and bcjmail-fips versions prior to 1.0.7 Bouncy Castle for Java FIPS BC-FJA bcmail-fips and...

PT-2026-67237

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Description The MLS hash-ratchet mechanism accepts an arbitrary 32-bit generation counter provided by the sender. A hash-ratchet is a cryptographic process used to derive new keys for each message ...

CVE-2026-59641: Insufficient Verification of Data Authenticity

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

Linux Distros Unpatched Vulnerability : CVE-2026-59638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle fo...

Linux Distros Unpatched Vulnerability : CVE-2026-59651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS...

Linux Distros Unpatched Vulnerability : CVE-2026-58062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the checked certificate. This issue also affects Bouncy Castle for Java...

Linux Distros Unpatched Vulnerability : CVE-2026-59640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS...

Linux Distros Unpatched Vulnerability : CVE-2026-13586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before...

Linux Distros Unpatched Vulnerability : CVE-2026-59641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java L...

PT-2026-67236

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java FIPS BC-FJA versions prior to bcpg-fips 2.0.13 Description OpenPGP inline-signature policy failures are silently ignored, which may lead to security policy bypasses during...

Linux Distros Unpatched Vulnerability : CVE-2026-59652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper. CVE-2026-59652 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2026-59649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LT...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=6092688160784384 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

EUVD-2026-51813

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67340

ArcadeDB (a Java multi-model database) versions before 26.7.2 allow post-authentication remote code execution via JavaScript trigger scripts. The ScriptTriggerExecutor includes java.lang.* in the GraalVM polyglot host-class allow-list, so an authenticated user with only the UPDATE_SCHEMA permissi...

CVE-2026-67340 ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...

CVE-2026-67340

ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...