GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

EUVD-2026-50331

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-9177

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-16308

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3406-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when...

OSV-2026-1092 Security exception in com.github.javaparser.ast.expr.Name.accept

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=539142495 Crash type: Security exception Crash state: com.github.javaparser.ast.expr.Name.accept com.github.javaparser.ast.visitor.VoidVisitorAdapter.lambda$visit$133 java.base/java.util.Optional.ifPresent...

cve-2026-47873 - HIGH - CVE-2026-47873: Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback...

PT-2026-65816

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

CVE-2026-9177: Improper Neutralization of Special Elements Used in a Template Engine

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

SUSE SLES16: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2026:22944-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22944-1 advisory. This update for java-17-openjdk fixes the following issues - Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU - CVE-2026-41254:...

TencentOS Server 2: java-1.8.0-openjdk (TSSA-2026:0781)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0781 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 4: java-8-konajdk (TSSA-2026:0760)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0760 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Apache Camel JIRA Java Framework Unauthorized Access

The vulnerability of the Apache Camel JIRA Java framework involves bypassing authentication using a user-controlled key. Exploiting this vulnerability can allow an intruder to gain unauthorized access to read, modify, add, and delete objects in the target JIRA system...

TencentOS Server 4: java-11-konajdk (TSSA-2026:0745)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0745 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

SUSE SLED15: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (SUSE-SU-2026:3331-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3331-1 advisory. Update to upstream tag jdk-25.0.4+7 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information...

TencentOS Server 4: java-17-konajdk (TSSA-2026:0758)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0758 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 4: java-8-konajdk (TSSA-2026:0744)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0744 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...