SAP NetWeaver AS Java Apache Log4j Vulnerability (3726899)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a vulnerability in the Apache Log4j library as referenced in SAP Security Note 3726899: - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname...

Security Bulletin: Multiple security vulnerabilities may affect IBM Java that is shipped with TXSeries for Multiplatforms

Summary Multiple security vulnerabilities may affect IBM Java that is shipped with TXSeries for Multiplatforms CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007. An update to TXSeries for Multiplatforms has been released to address these vulnerabilitie...

Security Bulletin: Multiple security vulnerabilities may affect IBM Java that is shipped with IBM CICS TX Advanced

Summary Multiple security vulnerabilities may affect IBM Java that is shipped with IBM CICS TX Advanced CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007. An update to IBM CICS TX Advanced has been released to address these vulnerabilities. Vulnerabili...

GHSA-G628-R368-6VH7 GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution RCE. Impact If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code. Details Authenticated users can access Vector Data Sources page to...

CVE-2026-49495

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential stri...

GHSA-32HF-8JW3-V4QQ netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

The netty-incubator-codec-ohttp library implements Oblivious HTTP RFC 9458 using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations, provides a fallback path for direct ByteBufs that do not expose their memory address through hasMemoryAddress...

RLSA-2026:24348 Important: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fixes: jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authenticati...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-41000 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-41000 Source advisory: GHSA-8QQ9-R6CC-QJV9...

com.graphql-java-generator.graphql-gradle-plugin:com.graphql-java-generator.graphql-gradle-plugin.gradle.plugin (>=2.0rc1, <=2.0), com.graphql-java-generator:graphql-gradle-plugin (>=2.0rc1, <=2.0) +42 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.0.6)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

com.graphql-java-generator.graphql-gradle-plugin:com.graphql-java-generator.graphql-gradle-plugin.gradle.plugin (>=2.0rc1, <=2.0), com.graphql-java-generator:graphql-gradle-plugin (>=2.0rc1, <=2.0) +42 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.0.6)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40996 Source advisory: OSV:GHSA-P7QJ-2Q5W-F9R7...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40997 Source advisory: GHSA-5X25-C2RF-F2JX...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.8.0-alpha4.1) +7 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.0.13)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40997 Source advisory: OSV:GHSA-5X25-C2RF-F2JX...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.webapp.modules:cloud-altemistafwk-webapp-jsf-conf (>=3.0.0.release, <=3.1.0.release) +733 more potentially affected by CVE-2026-40986 via org.springframework.webflow:spring-webflow (>=2.0.6.release, <=2.5.1.release)

org.springframework.webflow:spring-webflow MAVEN version =2.0.6.release, =3.0.0.release, =3.0.0.release, =2.0.0, =2.3.0, =2.1.0, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =0.0.1, =5.1.3, =5.3.4 and more Source cves: CVE-2026-40986 Source advisory: GHSA-HW5C-XM3...

Security Bulletin: IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities in Eclipse Paho Java client library

Summary A vulnerability has been identified in Eclipse Paho Java client library, which is used in IBM Engineering Lifecycle Management - Engineering Workflow Management . Vulnerability Details CVEID:CVE-2019-11777 DESCRIPTION: In the Eclipse Paho Java client library version 1.2.0, when connecting...

Authentication Bypass

Yubico java-webauthn-server is vulnerable to Authentication Bypass. The vulnerability is due to incorrect validation of a function's return value during the second-factor authentication flow, allowing attackers to bypass the intended authentication checks and impersonate legitimate users...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2026-9682)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-9682 advisory. - Update to 8u492-b09 GA Orabug: 39247147CVE-2026-22007CVE-2026-22013 CVE-2026-22016CVE-2026-22018CVE-2026-22021CVE-2026-23865CVE-2026-34268 - Fixes...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data. The Kryo-based persistence serializers KryoStateMachineSerialisationService / AbstractKryoStateMachineSerialisationService deserialise persisted state-machine contexts without enabling...

Security update for java-17-openj9 (important)

openSUSE Security Update: Security update for java-17-openj9 Announcement ID: openSUSE-SU-2025:0067-1 Rating: important References: 1204468 1204471 1204472 1204473 1204475 1204480 1204703 1206549 1207246 1207248 1207922 1210628 1210631 1210632 1210634 1210635 1210636 1210637 1211615 1213470 12134...

Security update for java-11-openj9 (important)

openSUSE Security Update: Security update for java-11-openj9 Announcement ID: openSUSE-SU-2025:0066-1 Rating: important References: 1181239 1185055 1185056 1188564 1188565 1188566 1191901 1191903 1191904 1191906 1191909 1191910 1191911 1191912 1191913 1191914 1194925 1194926 1194927 1194928 11949...