65336 matches found
CVE-2024-14041
Bouncy Castle for Java versions 1.73 to before 1.78 is affected by a timing-side-channel in ML-KEM (CRYSTALS-Kyber) decapsulation. Three routines divide secret-derived polynomial coefficients by the modulus q: Poly.toMsg (decoding the decrypted message) and the ciphertext compression routines Pol...
CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...
CVE-2024-14041
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...
OSV-2026-1071 Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=537183300 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.FieldAccessExpr.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.visit java.base/java.nio.ByteBuffer.position...
Exploit for CVE-2026-16723
Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disc...
CVE-2026-43910: Unintended Proxy or Intermediary
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
CVE-2024-14041: Observable Timing Discrepancy
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...
PT-2026-65496
Name of the Vulnerable Software and Affected Versions Apache Axis2/Java versions prior to 2.0.1 Description An issue exists in the Tribes-based clustering component when running on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the...
This Week in Spring - July 28th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring! The title says in Spring , but here in the northern hemisphere, it's clearly the middle of summer. Hot! I'm sitting here on my laptop on a warm summer day, and my laptop is indeed hot because I've spent so much time outside...
PT-2026-65408
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions 1.73 through 1.77 Description Three ML-KEM CRYSTALS-Kyber routines perform non-constant-time division of secret-derived polynomial coefficients by the modulus q. The affected routines are Poly.toMsg, which decod...
CVE-2026-66713: Deserialization of Untrusted Data
Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...
Joern 4.0.590
Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...
PT-2026-65502
Name of the Vulnerable Software and Affected Versions Appium Java Client versions 8.2.1 through 10.1.0 Description When directConnecttrue is enabled, the setDirectConnect function in AppiumCommandExecutor.java reads the directConnectHost, directConnectPort, and directConnectPath fields from the...
Linux Distros Unpatched Vulnerability : CVE-2024-14041
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret- derived polynomial coefficients by the modulus q:...
Linux Distros Unpatched Vulnerability : CVE-2026-45112
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0...
Oracle Java Critical Patch Update Advisory April 2026
CVE-2026-22007 - Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...
Azul Zulu Java Multiple Vulnerabilities (Oct 2025)
The version of Azul Zulu installed on Brocade SANnav has been updated to receive security updates to multiple vulnerabilities as referenced in the 2025-10-21 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE...
SUSE SLES12: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2026:3284-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3284-1 advisory. This update for java-11-openjdk fixes the following issues Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: -...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle [CVE-2025-14813] [CVE-2026-0636] [CVE-2026-5598]
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in bouncycastle, due to flaws in BC-JAVA on all core modules. CVE-2025-14813 CVE-2026-0636 CVE-2026-5598. Bouncy castle BC-JAVA is used in our speech microservices. This vulnerability has been addressed. Please read the...
