EUVD-2026-62704

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

BIT-JRE-2026-47035

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

BIT-JRE-2026-47030

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

PHP_CodeSniffer gitblame report command injection via crafted filename

Impact PHPCodeSniffer versions before v3.13.6 and v4.0.2 contain a command injection vulnerability in the code creating the Gitblame, Hgblame and Svnblame reports. As a result, running PHPCodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer...

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

CVE-2026-60166

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

CVE-2026-47059

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

CVE-2026-47030

Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human...

CVE-2026-47059

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

PT-2026-62219

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 Oracle GraalVM for JDK versions 17.0.19 and 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18 Description An issue in the 2D component allows an...

Incorrect Authorization

Overview @ai-sdk/harness-codex is a HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex CLI. The adapter ships a bridge process that runs inside a sandbox and talks to the host over a WebSocket on a sandbox-proxied l Affected versions of this package are vulnerable to Incorrect...

CVE-2026-64651

The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path host-tool-mcp.mjs. This allows untrusted code executing in the...

CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path the Codex CLI shim. This...

CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path the Codex CLI shim. This...

CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path the Codex CLI shim. This...

CVE-2026-64650

The CVE concerns the @ai-sdk/harness-opencode tool (HarnessV1 adapter backed by @openai/codex-sdk) that drives the codex CLI. Prior to version 1.0.29, it relayed requests from any process whose command line contained an allowed helper script path (Codex CLI shim), allowing untrusted sandbox code ...

CVE-2026-64651 AI SDK OpenCode Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path host-tool-mcp.mjs. This allows untrusted code executing in the...