IBM Java 7.1 < 7.1.5.31 / 8.0 < 8.0.8.70 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.31 / 8.0 prior to 8.0.8.70. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Update July 2026 advisory. - In Eclipse OpenJ9 versions up to 0.60, when executing class files where a...

Joern 4.0.592

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-66364

Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Spring Tools for VSCode / Cursor / Theia versions prior to 2.2.1 Description Starting Spring Boot applications in Spring Tools with the live information mode enabled allows for remote code...

PT-2026-66568

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description A remote code execution issue exists in the SOAP/JMX connector. SOAP Simple Object Access Protocol is a messaging protocol specification for...

TLS-Attacker v7.8.0

TLS-Attacker TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS...

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

EUVD-2026-41152

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the RMI context propagation process. An attacker can cause excessive memory allocation by sending an oversized context propagation payload to a network-reachable RMI endpoint on an...

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

EUVD-2026-50331

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-9177

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-16308

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3406-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when...

OSV-2026-1092 Security exception in com.github.javaparser.ast.expr.Name.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539142495 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.Name.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.lambda$visit$133 java.base/java.util.Optional.ifPresent...

cve-2026-47873 - HIGH - CVE-2026-47873: Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2026:0781)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0781 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...