fastjson-1.2.58-rce

fastjson-1.2.58-rce need: fastjson autoType is enabled h2 database and some jar . ├── fastjson-1.2.58.jar ├── h2-1.4.199.jar ├── jackson-annotations-2.9.8.jar ├── jackson-core-2.9.8.jar ├── jackson-databind-2.9.8.jar └── logback-core-1.3.0-alpha4.jar Download fastjson-1.2.58.jar...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.328 Vulnerability Details CVEID:CVE-2026-6368 DESCRIPTION: Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in QOS.CH logback-core (CVE-2026-13006)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in QOS.CH logback-core. Logback-core is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-13006...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic (CVE-2026-19880)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic due to a flaw in an MDC-based discriminator value that flows unsanitized into a nested FileAppender path. The logback-classic module is used in our Speech microservices. This vulnerabilit...

Security Bulletin: Security vulnerabilities in Logback affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-10532 , CVE-2026-9828)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-10532 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core module...

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), com.atomgraph:linkeddatahub (>=5.5.0, <=5.5.2) +95 more potentially affected by CVE-2026-88041 via org.apache.tomcat:tomcat-coyote (>=10.1.28, <=10.1.60)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.28, =2.0.7, =5.5.0, =1.0.0, =5.1.1, =5.1.1, =3.5.0, =20260429, =20260429, =2.12.0, =0.2.2, =3.0.0-rc-1, =3.6.0 and more Source cves: CVE-2026-88041 Source advisory: MEND:CVE-2026-88041...

Atlassian Confluence 6.6.x < 9.2.24 / 9.3.x < 10.2.17 / 11.0.0 (CONFSERVER-104474)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104474 advisory. - ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications,...

Security Bulletin: Multiple vulnerabilties in DevOps Test Hub

Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.9 Vulnerability Details CVEID:CVE-2026-22741 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all...

RHLW-2026-730F8211B080B586 Lightwell Security Advisory: logback-core 1.5.18.rhlw-00003

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.18.rhlw-00003 with a backported security fix. CVE-2026-1225: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes...

RHLW-2026-A08954EF69E23D40 Lightwell Security Advisory: logback-core 1.2.11.rhlw-00001

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.11.rhlw-00001 with backported fixes for CVE-2023-6378, CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-10532, CVE-2026-1225, and CVE-2026-9828. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12798: ACE...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...

logback-1.6.5-2.1 on GA media (moderate)

logback-1.6.5-2.1 on GA media Announcement ID: openSUSE-SU-2026:11985-1 Rating: moderate Cross-References: CVE-2026-104721 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the logback-1.6.5-2.1...

RHLW-2026-96D3EE80FB77C7D0 Lightwell Security Advisory: logback-classic 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central...

RHLW-2026-055D7BDE52D9946F Lightwell Security Advisory: logback-core 1.2.12.rhlw-00005

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.12.rhlw-00005 with backported fixes for CVE-2023-6378 and CVE-2024-12801. CVE-2023-6378: Logback "receiver" DOS vulnerability CVE-2024-12801: Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14...

logback-1.6.5-1.1 on GA media (moderate)

logback-1.6.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11965-1 Rating: moderate Cross-References: CVE-2026-19880 CVSS scores: CVE-2026-19880 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2026-19880 SUSE : 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N...

RHLW-2026-9CAB5871D815DD9D Lightwell Security Advisory: logback-classic 1.5.9.rhlw-00031

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14...

com.github.pukkaone:logback-gelf (>=1.1.5, <=1.1.9), com.globo.graylog2:gelfj (>=1.1.16.0, <=1.1.16.1) +13 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.0.4)

com.rabbitmq:amqp-client MAVEN version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.pukkaone:logback-gelf =1.1.5, =1.1.16.0, =2.0.0, =1.1.3, =1.2, =1.2, =1.5 Source cves: CVE-2026-1061...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream) - Object Injection Possible

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream)

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

Security Bulletin: Due to use of QOS.CH logback, IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution

Summary Due to use of QOS.CH logback IBM Cloud Pak System is affected by server-side request forgery and arbitrary code execution CVE-2024-12801, CVE-2024-12798. Those issues were addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2024-12801 DESCRIPTION: Server-Side Reque...