Java
Monthly
Sort validation bypass in Spring Data JPA allows remote, unauthenticated attackers to submit crafted payloads through untrusted sort parameters, circumventing the library's built-in Sort validation and potentially injecting malicious ordering expressions into the underlying JPA query layer. Affected versions span four release trains from 3.0.0 through 4.1.0, placing a large fraction of Spring Boot applications at risk where dynamic sorting is exposed to user-controlled input. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the 'Authentication Bypass' tag suggests practical risk may exceed what the CVSS 4.8 score implies.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
Insecure Direct Object Reference in Sakai's profile2 REST API allows any authenticated user to permanently delete the profile image of any other user - including administrators - by supplying an arbitrary userId in the DELETE /api/users/{userId}/profile/image path parameter. The controller validates session existence but performs no ownership comparison, and the service layer passes the attacker-controlled userId directly to the DAO, which deletes the profile_images_t database row unconditionally. A related gap in the pronunciation recording delete endpoint (DELETE /api/users/{userId}/profile/pronunciation) omits session validation entirely, enabling unauthenticated deletion. No public exploit or CISA KEV listing exists at time of analysis, though the attack is trivially scriptable.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.
Server-side template injection (SSTI) via the FreeMarker engine in Dromara UJCMS 10.1.0 through 10.1.3 allows authenticated backend administrators to inject malicious template directives through the web-file-template update API endpoint. Exploitation requires high-privilege backend credentials but is network-reachable with no user interaction, and a public proof-of-concept exploit has been published on GitHub demonstrating the attack path. The vendor-scored CVSS 4.0 impact is rated low across confidentiality, integrity, and availability, though the FreeMarker SSTI class is capable of full JVM-level code execution if template sandboxing is absent or misconfigured - defenders should not assume the impact ceiling matches the reported score.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Denial of service in Micrometer Tracing's Brave bridge allows remote unauthenticated attackers to crash Spring Boot 3.x+ applications by sending HTTP requests with artificially inflated W3C baggage headers. The parser allocates one BaggageField object per baggage key-value pair without enforcing any limit, violating the W3C Baggage specification's own security guidance, leading to garbage collection saturation, CPU spike, and eventual OutOfMemoryError. No public exploit code has been identified at time of analysis, but the attack is trivially constructible given the documented mechanism.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Path traversal in RuoYi-Vue up to 3.9.2 allows authenticated low-privilege users to read arbitrary files from the server filesystem by manipulating the `fileName` or `resource` parameters of the Common Download Endpoint in `CommonController.java`. A publicly available exploit has been disclosed via GitHub issue, but no patch has been released and the maintainer has not responded to the disclosure. No CISA KEV listing is present, so confirmed active exploitation at scale is unverified, though the public POC and low attack complexity make opportunistic exploitation by authenticated insiders or compromised accounts a realistic near-term risk.
Unsafe Java deserialization in SPLWare esProc through version 20260507 exposes a network-accessible socket endpoint to remote, unauthenticated object injection. The vulnerable class `ObjectInputStream.readUnshared` in `SocketData.java` processes attacker-controlled serialized data without validation, enabling arbitrary object graph instantiation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the unauthenticated network vector and absence of complexity barriers make this a credible remote attack surface requiring prompt patching.
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Permission bypass in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated low-privilege remote attackers to manipulate the queryerClass argument in the DataSourceController.add method within the QueryerFactory component, resulting in unauthorized access to or modification of data source configurations. A public proof-of-concept exploit has been disclosed via GitHub issue #83, and the project maintainer has not yet acknowledged or remediated the finding. Impact is bounded to low-level confidentiality, integrity, and availability degradation on the vulnerable system with no lateral scope change to subsequent systems.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
Oracle Java SE's Security component across all current LTS and preview releases - versions 8u501 through 26.0.2 - along with GraalVM for JDK and GraalVM Enterprise Edition, permits unauthenticated remote attackers to read a limited subset of data via crafted API inputs delivered through web services. Despite the network-accessible, zero-authentication vector (AV:N/PR:N/UI:N), the high attack complexity (AC:H) and confined confidentiality impact (C:L) constrain real-world risk, yielding a CVSS 3.1 base score of 3.7. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this finding through its standard August 2026 Critical Patch Update cycle rather than an emergency out-of-band advisory.
SQL injection in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows remote authenticated attackers to manipulate the sourcePath argument within the ModuleController.java Move Operations component, enabling unauthorized database query execution. The vulnerability carries limited confidentiality, integrity, and availability impact per the CVSS 4.0 assessment, though a publicly available proof-of-concept exploit (E:P) elevates the practical risk above its low CVSS score alone suggests. No vendor patch has been issued; the project was notified via a GitHub issue report but has not responded.
RabbitMQ Java client (amqp-client) versions prior to 5.33.0 fails to enforce the AMQP 0-9-1 negotiated frame_max limit on inbound socket frames, allowing a malicious or compromised broker peer to send method frames exceeding the protocol-negotiated size. The client allocates and fully decodes these oversized frames rather than rejecting them as protocol violations, effectively nullifying the frame-size protection. This is a bypass of the partial fix introduced for CVE-2023-46120, which addressed message body size but left frame payload validation broken. No public exploit code has been identified and no KEV listing exists at time of analysis.
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior to version 5.33.0 when applications call `ConnectionFactory.useSslProtocol()` or `useSslProtocol(String)`, because these methods silently install `TrustEverythingTrustManager` and leave hostname verification disabled. A network-positioned attacker can present any certificate - including self-signed or null-chain - to impersonate the RabbitMQ broker and decrypt or modify all AMQP traffic, including plaintext credentials transmitted via PLAIN SASL on default port 5672. A verified proof-of-concept is publicly available in GHSA-5m9f-rphj-c435; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromised AMQP broker to forcibly terminate any active client connection by sending a crafted malformed frame sequence. The flaw in CommandAssembler.consumeBodyFrame subtracts a peer-controlled body-frame payload length before validating it fits within the declared body size, driving remainingBodyBytes negative and triggering an unhandled UnsupportedOperationException - a legacy stub - rather than a proper MalformedFrameException, causing AMQConnection to perform a hard connection shutdown. A PoC is referenced in the GHSA advisory; no active exploitation is confirmed in CISA KEV.
Path traversal in Logback-classic versions 0.9.14 through 1.6.2 enables a remote unauthenticated attacker to create and append log files at arbitrary filesystem locations by injecting traversal sequences into an MDC (Mapped Diagnostic Context) value that flows unsanitized into a nested FileAppender path. Deployments using MDC-based discriminators - a pattern frequently triggered by HTTP header values automatically stored in MDC by web frameworks - are directly at risk. No public exploit code or active exploitation has been confirmed at time of analysis; vendor fix notes reference version 1.6.3 as the remediated release.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server-side files through the Log File Download Endpoint in LogController.java, where the unsanitized `fileName` parameter allows directory escape sequences to be supplied by authenticated remote attackers. A public proof-of-concept exploit has been released per the CVSS 4.0 supplemental metric (E:P) and VulDB submission, lowering the bar for exploitation. Impact is limited to low-severity confidentiality loss with no integrity or availability effects, consistent with the CVSS 4.0 score of 2.1 and a PR:L/VC:L vector.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server files through the Snapshot Endpoint in PlayController.java, where the deviceId and channelId parameters are incorporated into file system operations without sanitization. Authenticated remote attackers with low-privilege access can escape the intended snapshot directory by injecting traversal sequences into these parameters, yielding partial confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit exists on GitHub (issue #2175), materially lowering the barrier to exploitation despite the moderate CVSS 5.3 score and absence from the CISA KEV catalog.
Unsafe Java deserialization in alldatacenter alldata up to version 0.6.8 exposes the xxl-rpc Listener to remote, unauthenticated exploitation via crafted Hessian2-serialized payloads. The Hessian2Input.readObject() function in HessianSerializer.java processes attacker-controlled input without class validation, enabling object deserialization attacks that can activate gadget chains present in the application's JVM classpath. A public proof-of-concept exploit is available, the project has formally declined to issue a patch, and all users on affected versions face a permanent unmitigated known risk.
Path traversal in AllData up to version 0.6.8 enables remote unauthenticated attackers to read arbitrary files from the server filesystem via the logDetailCat endpoint. The executorAddress parameter is passed unsanitized to FileInputStream in JobLogController.java, allowing directory traversal sequences to escape the intended file access boundary. A public exploit has been published on GitHub; no patch exists and the vendor has permanently declined to fix the issue by closing the bug report as 'not planned.'
Path traversal in DTStack Taier 1.4.0's UploadController allows privileged remote attackers to write files outside the intended upload directory by supplying a crafted filename containing sequences such as '../' or absolute paths. The commit diff confirms that `MultipartFile.getOriginalFilename()` output was concatenated directly into a filesystem path without any sanitization before the fix. The CVSS 4.0 PR:H rating constrains exploitation to authenticated high-privilege users; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in dromara lamp-cloud (versions up to 5.10.0) exposes the chunk-check endpoint of FileChunkController.java to remote directory traversal via a crafted 'Name' argument, potentially allowing attackers to read or write files outside the intended upload directory. No authentication is required per the CVSS 4.0 vector (PR:N), and a public exploit has been disclosed (CVSS E:P modifier), lowering the barrier for opportunistic exploitation. The vendor was notified via GitHub issue #413 but has not yet responded, leaving no official patch available at time of analysis.
Path traversal in Dromara lamp-cloud up to version 5.10.0 allows remote unauthenticated attackers to manipulate file storage paths via the bucket and bizType parameters in FileAnyoneController.java. The affected endpoint appears intentionally public (indicated by the 'Anyone' controller name), lowering the bar for exploitation significantly. No vendor patch is available at time of analysis, and a public proof-of-concept exploit exists, though no CISA KEV listing confirms active mass exploitation.
Path traversal in DTStack Taier 1.4.0 allows an authenticated administrative user to supply a crafted clusterName containing directory-escape sequences during cluster creation, causing FileUtils.deleteDirectory to operate on arbitrary filesystem paths outside the intended temp directory. The CVSS 4.0 score of 5.1 with PR:H reflects the constrained attack surface: only users with cluster management privileges can trigger the flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in DTStack Taier 1.4.0's Chunk-Check Endpoint exposes the server's filesystem to remote unauthenticated attackers who can manipulate the Name parameter in FileChunkController.java to escape the intended upload directory. The Java Paths.get() function processes attacker-controlled input without sanitization, enabling directory traversal sequences to reference arbitrary files accessible to the Taier process. A public proof-of-concept exploit is available via GitHub issue #1203, and no exploitation confirmation from CISA KEV exists at time of analysis.
Path traversal in Dromara lamp-cloud's Code Generator component (DefGenProjectController.java), affecting all versions up to 5.10.0, enables authenticated remote attackers to manipulate the `outputDir`, `parent`, and `projectPrefix` parameters to read or write files outside the application's intended output directory. A proof-of-concept exploit has been publicly disclosed (confirmed by CVSS 4.0 supplemental metric E:P), and no vendor patch is available at time of analysis as the project maintainer has not responded to the responsible disclosure submitted via GitHub issue. The attack requires low-privileged authenticated access, which bounds real-world risk but does not eliminate it in multi-user development or DevOps platforms.
JEXL expression sandbox bypass in OpenNMS Meridian and Horizon allows a low-privileged authenticated user to load arbitrary Java classes on the server via the Measurements REST API, enabling confidentiality disclosure and integrity compromise. The flaw stems from incorrect authorization logic in OnmsJexlUberspect that checked method calls on a whitelisted class object against the whitelisted class rather than against java.lang.Class itself, allowing reflection chains such as table.getClass().forName('java.lang.Runtime') to escape the sandbox. No public exploit or CISA KEV listing has been identified at time of analysis, but the upstream GitHub PR provides regression tests that precisely document the bypass technique.
Directory traversal in kkFileView prior to 5.0.1 exposes an unauthenticated POST /listFiles endpoint that accepts a user-supplied path parameter and passes it directly to Files.newDirectoryStream without confining it to the configured demo directory, enabling remote attackers to enumerate arbitrary server-side directories. The flaw is mechanically straightforward - no credentials, no user interaction, and no special configuration are required - though impact is bounded to directory listing rather than file content disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch exists at version 5.0.1.
Server-Side Request Forgery in kkFileView before 5.0.1 allows unauthenticated remote attackers to make the application server issue HTTP requests to arbitrary internal or external URLs via the unprotected /addTask endpoint. The vulnerability arises because /addTask was excluded from both TrustHostFilter and TrustDirFilter in WebConfig.java, and the fullfilename parameter can be manipulated to coerce file type classification as OFFICE, COMPRESS, or CAD, triggering FileConvertQueueTask to fetch attacker-chosen URLs. No public exploit identified at time of analysis per CISA KEV; however, SSVC flags a publicly available POC and marks the vulnerability as automatable.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users holding the nexus:selectors:create permission to traverse Java object properties outside the intended sandbox scope, disclosing internal JVM metadata such as class and classloader names. The vendor description explicitly confirms this does not permit method invocation, object construction, or code execution - making the 'RCE' intelligence tag a misclassification. Fixed in version 3.95.0; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.
Path traversal in yeqifu warehouse (all commits up to aaf29962ba407d22d991781de28796ee7b4670e4) enables authenticated remote attackers to read arbitrary files outside the intended web root by supplying directory-traversal sequences in the `path` argument handled by FileController.java. The exploit has been publicly disclosed and proof-of-concept code is available via VulDB and an external Notion document, raising the urgency despite a moderate CVSS 4.0 score of 5.3. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving all deployments of this Java-based warehouse management application unmitigated.
Denial of service in FasterXML jackson-core's non-blocking (async) JSON parser allows unauthenticated network attackers to exhaust JVM heap and CPU by submitting JSON containing arbitrarily long number tokens that bypass the maxNumberLength constraint. Affected deployments are those using the async parser API - particularly reactive frameworks such as Spring WebFlux - running com.fasterxml.jackson.core:jackson-core 2.15.0-2.18.5 or 2.19.0-2.21.0, or tools.jackson.core:jackson-core 3.0.0-3.0.x. Publicly available exploit code exists (PoC JUnit test published in GHSA-72hv-8253-57qq); the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Authorization bypass in jeequan jeepay up to version 3.2.9 allows authenticated low-privilege users to circumvent access controls enforced by the PreAuthorize Handler within WebSecurityConfig, specifically targeting the SysLogController component. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), enabling manipulation of access-control keys to reach system log data or restricted administrative functionality beyond the user's granted permissions. A public proof-of-concept exploit exists; no vendor response has been received and no patch has been confirmed, elevating remediation urgency despite the moderate CVSS score.
Unbounded PKCS#12 KDF iteration counts in Bouncy Castle for Java allow remote, unauthenticated attackers to cause denial of service by supplying a crafted PKCS#12 file with an arbitrarily large iteration count in MAC or bag-decryption KDF parameters. Any Java application that processes PKCS#12 keystores using bc-java before 1.85, bc-lts-java before 2.73.12, or bc-fja (FIPS) before 1.0.2.7/2.0.2/2.1.3 is affected. No public exploit is identified at time of analysis, but the attack surface is broad given how widely PKCS#12 files are accepted across Java enterprise stacks.
CPU and memory exhaustion in Bouncy Castle Java's BCFKS keystore loader exposes applications to pre-integrity-verification denial of service when processing a crafted keystore file. Any of the three affected library variants - bc-java (before 1.85), bc-lts-java (before 2.73.12), and BC-FJA (before 1.0.2.7, 2.0.2, or 2.1.3 depending on series) - will blindly honour attacker-supplied PBKDF2 iteration counts or scrypt cost parameters read from an untrusted file before the keystore MAC is verified, allowing an adversary to trigger arbitrary CPU or memory consumption at load time. No public exploit code has been identified and the vulnerability is absent from CISA KEV; urgency is rated Amber by the upstream reporter.
CPU-exhaustion denial of service in Bouncy Castle for Java affects any server that verifies CMP (Certificate Management Protocol) password-MAC protected messages using PKMACBuilder without an explicit iteration ceiling. The library's PKMACBuilder accepted the iteration count directly from the unauthenticated PBMParameter field in an incoming CMP message with no upper bound, allowing a remote unauthenticated attacker to supply a count near 2^31 and force billions of hash iterations on the target. No active exploitation is confirmed (not in CISA KEV), but the attack is unauthenticated, requires no special configuration beyond standard CMP usage, and a patch is available upstream.
Heap and CPU exhaustion in Bouncy Castle for Java's OpenPGP implementation allows remote unauthenticated attackers to cause denial of service by crafting OpenPGP messages with extreme Argon2 S2K cost parameters. The library honoured attacker-controlled memory, passes (iterations), and parallelism fields embedded in unauthenticated OpenPGP packets before any message authentication could occur, meaning a single crafted packet could instruct the JVM to allocate up to 2^30 KiB (approximately 1 TiB) of heap. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vulnerability is straightforward to exploit given that the cost parameters are trivially crafted and processed unconditionally.
LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Denial-of-service via unbounded KDF cost in Bouncy Castle for Java's PKCS#8 / PBES2 decryptors allows remote attackers to exhaust CPU or memory by supplying crafted encrypted key material with extreme KDF parameters. The vulnerability affects bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpkix-fips) across all supported 1.0.X, 2.0.X, and 2.1.X series. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext credential storage in Spring Tools for Eclipse 5.2.0 and earlier exposes the Spring Boot DevTools remote secret (`spring.devtools.remote.secret`) in Eclipse `.launch` XML configuration files, which Eclipse persists to either workspace metadata or - critically - directly into the project tree when marked as a shared configuration. The exposed secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes, converting a credential-disclosure flaw into a remote code execution primitive against the associated Spring Boot application. No public exploit has been identified at time of analysis, but the attack technique is mechanically straightforward once the secret is retrieved from a committed VCS file or accessible workspace backup.
Denial-of-service in veraPDF-parser allows a remote unauthenticated attacker to crash or hang the PDF validation service by submitting a crafted PDF containing a Type 1 font whose /FontDescriptor /FontFile PostScript program exploits one of three unbounded resource primitives: a massive array allocation, a zero-increment for-loop, or a self-referential recursive user-dictionary lookup. All veraPDF-parser releases prior to 1.30.2 and 1.31.23 are affected across both active version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches exist for both branches.
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Information disclosure in perwendel Spark (SparkJava) up to version 2.9.4 via symlink following in the staticFiles.externalLocation method allows remote attackers with low privileges to read arbitrary files from the server. Publicly available exploit code exists, but no active exploitation or CISA KEV listing has been confirmed. The project maintainer has not yet responded to the issue report.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Path traversal in the Kubernetes Java client library's copyDirectoryFromPod function allows a compromised pod to write files to arbitrary locations on the local machine of a high-privileged operator performing copy operations. The vulnerability is only reachable when enableTarCompressing is set to false, and requires both an attacker-controlled pod and an operator actively running a copy command. With a CVSS score of 2.7 (PR:H, UI:R), no public exploit, and no CISA KEV listing, this is a narrow but credible lateral-movement vector in DevOps and CI/CD operator workflows rather than a broadly exploitable flaw.
CRLF injection in Netty's HttpPostRequestEncoder allows authenticated network attackers to inject arbitrary MIME headers into multipart HTTP request bodies by embedding CR/LF characters in user-controlled filenames. Affected are all Netty 4.1.x releases before 4.1.136.Final and 4.2.x releases before 4.2.16.Final that use the codec-http multipart encoder. Publicly available exploit code has been verified against 4.2.12.Final; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the PoC lowers the bar considerably for Content-Type spoofing, stored XSS, and multipart boundary confusion attacks.
Header injection in Netty's StompSubframeEncoder allows low-privileged network attackers to embed arbitrary STOMP headers into CONNECT and CONNECTED frames by supplying newline characters in header values. Affecting netty-codec-stomp prior to 4.1.136.Final and 4.2.x before 4.2.16.Final, the encoder deliberately skips the escape() function for CONNECT frames per STOMP 1.2 backward-compatibility requirements but neglects to reject raw newline characters, conflating 'no escaping' with 'no validation.' A fully functional proof-of-concept is publicly available and confirmed against Netty 4.2.12.Final; no public exploitation in the wild (CISA KEV) has been confirmed at time of analysis.
CRLF injection in Netty's HAProxy codec enables PROXY protocol header injection and client IP spoofing when AF_UNIX socket addresses are used with the V1 text protocol. The `HAProxyMessageEncoder.encodeV1()` method writes source and destination addresses into the CRLF-terminated header without sanitization, while `HAProxyMessage.checkAddress()` enforces only a length limit for AF_UNIX addresses - unlike IPv4/IPv6 paths whose format validators incidentally block CRLF. A fully functional, author-verified proof-of-concept was confirmed on Netty 4.2.12.Final; no public exploit identified at time of analysis maps to CISA KEV, but the PoC lowers the bar for exploitation in applications that forward attacker-influenced data into AF_UNIX address fields. Vendor-released patches are available as 4.1.136.Final and 4.2.16.Final.
Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.
Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.
Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.
Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.
Sandbox integrity bypass in the JavaFX component of Oracle Java SE 8u491 allows network-reachable unauthenticated attackers to perform unauthorized write, insert, or delete operations against data accessible within the Java security context. Exploitation is structurally constrained to client-side deployments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet - server-side Java deployments running only administrator-installed code are explicitly outside the attack surface. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the low CVSS 3.1 score of 3.1 accurately reflects the narrow, integrity-only impact combined with high attack complexity and mandatory user interaction.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated attackers across multiple network protocols, confirmed by Oracle's Critical Patch Update for July 2026. The vulnerability manifests in two distinct deployment contexts: server-side web services that pass externally supplied data to JavaFX APIs, and client-side sandboxed environments (Java Web Start applications or Java applets) that load and execute untrusted internet code. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the low-complexity, no-authentication-required attack surface makes exploitation straightforward should a proof-of-concept emerge.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Open redirect in Trino 481's OAuth2/OIDC authentication component allows remote, unauthenticated attackers to manipulate the redirect_uri parameter in ExternalUriInfo.java, redirecting authenticated users to attacker-controlled external sites. Exploitation requires user interaction - a victim must follow a crafted authentication URL - making this primarily a phishing and token-harvesting enabler rather than a direct system compromise vector. No active exploitation has been confirmed (not in CISA KEV), no public exploit code exists, and the trinodb project had not responded to the responsible disclosure report at time of analysis.
Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.
Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.
Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Path traversal in Halo CMS up to version 2.24.2 allows a remotely authenticated high-privilege user to access files outside the intended backup directory via the Download function of MigrationEndpoint.java in the Files Backup Endpoint. The vulnerability is CWE-22 (Improper Limitation of a Pathname) and carries a low CVSS score of 2.0 due to the PR:H requirement, meaning exploitation is limited to users who already hold administrator-level access. A public proof-of-concept exploit exists per the provided references, though no CISA KEV listing was found at time of analysis.
Out-of-bounds write in Bouncy Castle BC-LTS bcprov-lts8on affects ARM deployments running versions 2.73.0 through 2.73.12.0, with high confidentiality impact if successfully exploited. The flaw resides in ARM-specific native C implementations of SHA3 and SHAKE algorithms and is only triggered when an application accepts memoable SHA3/SHAKE cryptographic states from potentially untrusted external sources. No public exploit code exists and no active exploitation has been confirmed at time of analysis; the CVSS 4.0 score of 1.7 reflects the very narrow exploitation conditions required to reach this code path.
Telemetry archive exposure in Yamcs mission control framework allows any authenticated user to dump the entire raw packet archive by exploiting a broken object-level authorization check in the exportPackets API. Versions prior to 5.12.8 (stable) and 5.13.2 (development) are affected. No public exploit or CISA KEV listing exists, but the attack requires only a valid session and a trivially crafted HTTP request, making it immediately actionable for any insider or compromised account.
HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.
Deserialization logic in FasterXML jackson-databind 2.15.0 through 2.18.7, 2.21.3, and 3.1.3 allows unauthenticated remote callers to bypass @JsonIgnore annotations on Java Record types when a PropertyNamingStrategy is configured. The renamed JSON key - e.g., 'internal_role' produced by SnakeCaseStrategy from 'internalRole' - is not registered in the ignore list, so Jackson's constructor-parameter binding accepts the attacker-supplied value despite the developer's explicit exclusion directive. No public exploit tooling has been identified at time of analysis, but the upstream fix PR includes a runnable proof-of-concept test that fully demonstrates the bypass, lowering the bar for independent reproduction.
Remote code injection in pig-mesh Pig's pig-codegen module through version 3.9.2 allows low-privileged authenticated attackers to execute arbitrary code server-side via the GeneratorServiceImpl component, reachable over the network. A publicly available proof-of-concept exploit exists at GitHub (sombra0316/CVE-2026), elevating the urgency for defenders. No vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments without an official remediation path.
Code injection in SonicCloudOrg sonic-agent through version 2.7.2 allows remote unauthenticated attackers to inject and execute arbitrary code via the ExchangeController endpoint, which bypasses or is excluded from the JWT Authentication Filter. The vulnerability carries a public proof-of-concept exploit named 'Unauth_ExchangeSend', confirming the endpoint is reachable without authentication. Critically, the affected product is end-of-life with no vendor support, and the maintainer did not respond to disclosure - no patch is forthcoming.
OS command injection in SonicCloudOrg sonic-agent up to version 2.7.2 allows remote low-privileged attackers to execute arbitrary system commands via the evalIsFailed function in the Groovy Script Handler component. The public proof-of-concept - titled 'Unsandboxed_RCE' - confirms that Groovy scripts are executed without a security sandbox, enabling full host-level command execution. Critically, this is an end-of-life product with no vendor response and no patch, meaning no fix is forthcoming; no public exploit identified in CISA KEV at time of analysis, but a public POC exists.
Sort validation bypass in Spring Data JPA allows remote, unauthenticated attackers to submit crafted payloads through untrusted sort parameters, circumventing the library's built-in Sort validation and potentially injecting malicious ordering expressions into the underlying JPA query layer. Affected versions span four release trains from 3.0.0 through 4.1.0, placing a large fraction of Spring Boot applications at risk where dynamic sorting is exposed to user-controlled input. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the 'Authentication Bypass' tag suggests practical risk may exceed what the CVSS 4.8 score implies.
Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.
Insecure Direct Object Reference in Sakai's profile2 REST API allows any authenticated user to permanently delete the profile image of any other user - including administrators - by supplying an arbitrary userId in the DELETE /api/users/{userId}/profile/image path parameter. The controller validates session existence but performs no ownership comparison, and the service layer passes the attacker-controlled userId directly to the DAO, which deletes the profile_images_t database row unconditionally. A related gap in the pronunciation recording delete endpoint (DELETE /api/users/{userId}/profile/pronunciation) omits session validation entirely, enabling unauthenticated deletion. No public exploit or CISA KEV listing exists at time of analysis, though the attack is trivially scriptable.
Improper certificate validation in JSS (Java Security Services) allows the JSSTrustManager class to accept CA certificates from the NSS database that lack TRUSTED_CA trust flags, meaning certificates never explicitly designated as trust anchors can still be used to anchor TLS chains. In non-default deployments where certificate revocation checking has been disabled, this creates a viable path for a man-in-the-middle attacker to forge certificates accepted by PKI client connections, with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and the AC:H CVSS rating reflects the meaningful attack complexity - MITM positioning plus a specific non-default configuration must both be present.
Remote code injection in provectus kafka-ui up to version 0.7.2 allows a low-privileged authenticated attacker to execute arbitrary Groovy code on the server via the smart filter test endpoint. The vulnerability resides in the executeSmartFilterTest function of MessagesController.java, where user-supplied Groovy expressions are evaluated without adequate sandboxing or restriction. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the project maintainers have not responded to the responsible disclosure report.
Server-side template injection (SSTI) via the FreeMarker engine in Dromara UJCMS 10.1.0 through 10.1.3 allows authenticated backend administrators to inject malicious template directives through the web-file-template update API endpoint. Exploitation requires high-privilege backend credentials but is network-reachable with no user interaction, and a public proof-of-concept exploit has been published on GitHub demonstrating the attack path. The vendor-scored CVSS 4.0 impact is rated low across confidentiality, integrity, and availability, though the FreeMarker SSTI class is capable of full JVM-level code execution if template sandboxing is absent or misconfigured - defenders should not assume the impact ceiling matches the reported score.
Spring AI 2.0.0's Semantic Cache feature leaks cached LLM responses across unrelated system prompt contexts due to insufficient isolation in the context hashing mechanism. Applications using semantic caching across multiple tenants or security domains - where different system prompts define distinct access boundaries - are at risk of cross-context information disclosure and response tampering. Exploitation requires authenticated access and high attack complexity (AC:H, PR:L); no public exploit code and no CISA KEV listing exist at time of analysis.
Denial of service in Micrometer Tracing's Brave bridge allows remote unauthenticated attackers to crash Spring Boot 3.x+ applications by sending HTTP requests with artificially inflated W3C baggage headers. The parser allocates one BaggageField object per baggage key-value pair without enforcing any limit, violating the W3C Baggage specification's own security guidance, leading to garbage collection saturation, CPU spike, and eventual OutOfMemoryError. No public exploit code has been identified at time of analysis, but the attack is trivially constructible given the documented mechanism.
Binary HTTP parser in Netty's `netty-incubator-codec-bhttp` (all versions through 0.0.22.Final) crashes with an unchecked `ArrayIndexOutOfBoundsException` when processing a 15-byte crafted payload, enabling remote unauthenticated denial of service. The parser accumulates attacker-controlled varint field lengths - read correctly as `long` - into `int` offset counters; a value of 2^31 silently wraps the accumulator negative via Java's compound-assignment narrowing, bypassing the readable-bytes guard and reaching unchecked buffer index arithmetic. Publicly available exploit code exists per the GitHub advisory GHSA-pgrf-4654-3gq8; no active exploitation is confirmed in CISA KEV.
Path traversal in RuoYi-Vue up to 3.9.2 allows authenticated low-privilege users to read arbitrary files from the server filesystem by manipulating the `fileName` or `resource` parameters of the Common Download Endpoint in `CommonController.java`. A publicly available exploit has been disclosed via GitHub issue, but no patch has been released and the maintainer has not responded to the disclosure. No CISA KEV listing is present, so confirmed active exploitation at scale is unverified, though the public POC and low attack complexity make opportunistic exploitation by authenticated insiders or compromised accounts a realistic near-term risk.
Unsafe Java deserialization in SPLWare esProc through version 20260507 exposes a network-accessible socket endpoint to remote, unauthenticated object injection. The vulnerable class `ObjectInputStream.readUnshared` in `SocketData.java` processes attacker-controlled serialized data without validation, enabling arbitrary object graph instantiation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the unauthenticated network vector and absence of complexity barriers make this a credible remote attack surface requiring prompt patching.
Server-Side Template Injection (SSTI) in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated remote attackers to inject malicious template expressions through the sqlText argument of the SQL Preview endpoint (execSqlText/previewSqlText in DesignerController.java). A publicly available exploit exists via GitHub issue #82, and the project maintainer has not responded to the coordinated disclosure. No patch is available at time of analysis; CVSS 4.0 scores the impact conservatively at low across confidentiality, integrity, and availability, though SSTI in Java template engines frequently enables outcomes beyond information disclosure.
Permission bypass in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows authenticated low-privilege remote attackers to manipulate the queryerClass argument in the DataSourceController.add method within the QueryerFactory component, resulting in unauthorized access to or modification of data source configurations. A public proof-of-concept exploit has been disclosed via GitHub issue #83, and the project maintainer has not yet acknowledged or remediated the finding. Impact is bounded to low-level confidentiality, integrity, and availability degradation on the vulnerable system with no lateral scope change to subsequent systems.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
Oracle Java SE's Security component across all current LTS and preview releases - versions 8u501 through 26.0.2 - along with GraalVM for JDK and GraalVM Enterprise Edition, permits unauthenticated remote attackers to read a limited subset of data via crafted API inputs delivered through web services. Despite the network-accessible, zero-authentication vector (AV:N/PR:N/UI:N), the high attack complexity (AC:H) and confined confidentiality impact (C:L) constrain real-world risk, yielding a CVSS 3.1 base score of 3.7. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this finding through its standard August 2026 Critical Patch Update cycle rather than an emergency out-of-band advisory.
SQL injection in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows remote authenticated attackers to manipulate the sourcePath argument within the ModuleController.java Move Operations component, enabling unauthorized database query execution. The vulnerability carries limited confidentiality, integrity, and availability impact per the CVSS 4.0 assessment, though a publicly available proof-of-concept exploit (E:P) elevates the practical risk above its low CVSS score alone suggests. No vendor patch has been issued; the project was notified via a GitHub issue report but has not responded.
RabbitMQ Java client (amqp-client) versions prior to 5.33.0 fails to enforce the AMQP 0-9-1 negotiated frame_max limit on inbound socket frames, allowing a malicious or compromised broker peer to send method frames exceeding the protocol-negotiated size. The client allocates and fully decodes these oversized frames rather than rejecting them as protocol violations, effectively nullifying the frame-size protection. This is a bypass of the partial fix introduced for CVE-2023-46120, which addressed message body size but left frame payload validation broken. No public exploit code has been identified and no KEV listing exists at time of analysis.
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior to version 5.33.0 when applications call `ConnectionFactory.useSslProtocol()` or `useSslProtocol(String)`, because these methods silently install `TrustEverythingTrustManager` and leave hostname verification disabled. A network-positioned attacker can present any certificate - including self-signed or null-chain - to impersonate the RabbitMQ broker and decrypt or modify all AMQP traffic, including plaintext credentials transmitted via PLAIN SASL on default port 5672. A verified proof-of-concept is publicly available in GHSA-5m9f-rphj-c435; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromised AMQP broker to forcibly terminate any active client connection by sending a crafted malformed frame sequence. The flaw in CommandAssembler.consumeBodyFrame subtracts a peer-controlled body-frame payload length before validating it fits within the declared body size, driving remainingBodyBytes negative and triggering an unhandled UnsupportedOperationException - a legacy stub - rather than a proper MalformedFrameException, causing AMQConnection to perform a hard connection shutdown. A PoC is referenced in the GHSA advisory; no active exploitation is confirmed in CISA KEV.
Path traversal in Logback-classic versions 0.9.14 through 1.6.2 enables a remote unauthenticated attacker to create and append log files at arbitrary filesystem locations by injecting traversal sequences into an MDC (Mapped Diagnostic Context) value that flows unsanitized into a nested FileAppender path. Deployments using MDC-based discriminators - a pattern frequently triggered by HTTP header values automatically stored in MDC by web frameworks - are directly at risk. No public exploit code or active exploitation has been confirmed at time of analysis; vendor fix notes reference version 1.6.3 as the remediated release.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server-side files through the Log File Download Endpoint in LogController.java, where the unsanitized `fileName` parameter allows directory escape sequences to be supplied by authenticated remote attackers. A public proof-of-concept exploit has been released per the CVSS 4.0 supplemental metric (E:P) and VulDB submission, lowering the bar for exploitation. Impact is limited to low-severity confidentiality loss with no integrity or availability effects, consistent with the CVSS 4.0 score of 2.1 and a PR:L/VC:L vector.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server files through the Snapshot Endpoint in PlayController.java, where the deviceId and channelId parameters are incorporated into file system operations without sanitization. Authenticated remote attackers with low-privilege access can escape the intended snapshot directory by injecting traversal sequences into these parameters, yielding partial confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit exists on GitHub (issue #2175), materially lowering the barrier to exploitation despite the moderate CVSS 5.3 score and absence from the CISA KEV catalog.
Unsafe Java deserialization in alldatacenter alldata up to version 0.6.8 exposes the xxl-rpc Listener to remote, unauthenticated exploitation via crafted Hessian2-serialized payloads. The Hessian2Input.readObject() function in HessianSerializer.java processes attacker-controlled input without class validation, enabling object deserialization attacks that can activate gadget chains present in the application's JVM classpath. A public proof-of-concept exploit is available, the project has formally declined to issue a patch, and all users on affected versions face a permanent unmitigated known risk.
Path traversal in AllData up to version 0.6.8 enables remote unauthenticated attackers to read arbitrary files from the server filesystem via the logDetailCat endpoint. The executorAddress parameter is passed unsanitized to FileInputStream in JobLogController.java, allowing directory traversal sequences to escape the intended file access boundary. A public exploit has been published on GitHub; no patch exists and the vendor has permanently declined to fix the issue by closing the bug report as 'not planned.'
Path traversal in DTStack Taier 1.4.0's UploadController allows privileged remote attackers to write files outside the intended upload directory by supplying a crafted filename containing sequences such as '../' or absolute paths. The commit diff confirms that `MultipartFile.getOriginalFilename()` output was concatenated directly into a filesystem path without any sanitization before the fix. The CVSS 4.0 PR:H rating constrains exploitation to authenticated high-privilege users; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in dromara lamp-cloud (versions up to 5.10.0) exposes the chunk-check endpoint of FileChunkController.java to remote directory traversal via a crafted 'Name' argument, potentially allowing attackers to read or write files outside the intended upload directory. No authentication is required per the CVSS 4.0 vector (PR:N), and a public exploit has been disclosed (CVSS E:P modifier), lowering the barrier for opportunistic exploitation. The vendor was notified via GitHub issue #413 but has not yet responded, leaving no official patch available at time of analysis.
Path traversal in Dromara lamp-cloud up to version 5.10.0 allows remote unauthenticated attackers to manipulate file storage paths via the bucket and bizType parameters in FileAnyoneController.java. The affected endpoint appears intentionally public (indicated by the 'Anyone' controller name), lowering the bar for exploitation significantly. No vendor patch is available at time of analysis, and a public proof-of-concept exploit exists, though no CISA KEV listing confirms active mass exploitation.
Path traversal in DTStack Taier 1.4.0 allows an authenticated administrative user to supply a crafted clusterName containing directory-escape sequences during cluster creation, causing FileUtils.deleteDirectory to operate on arbitrary filesystem paths outside the intended temp directory. The CVSS 4.0 score of 5.1 with PR:H reflects the constrained attack surface: only users with cluster management privileges can trigger the flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in DTStack Taier 1.4.0's Chunk-Check Endpoint exposes the server's filesystem to remote unauthenticated attackers who can manipulate the Name parameter in FileChunkController.java to escape the intended upload directory. The Java Paths.get() function processes attacker-controlled input without sanitization, enabling directory traversal sequences to reference arbitrary files accessible to the Taier process. A public proof-of-concept exploit is available via GitHub issue #1203, and no exploitation confirmation from CISA KEV exists at time of analysis.
Path traversal in Dromara lamp-cloud's Code Generator component (DefGenProjectController.java), affecting all versions up to 5.10.0, enables authenticated remote attackers to manipulate the `outputDir`, `parent`, and `projectPrefix` parameters to read or write files outside the application's intended output directory. A proof-of-concept exploit has been publicly disclosed (confirmed by CVSS 4.0 supplemental metric E:P), and no vendor patch is available at time of analysis as the project maintainer has not responded to the responsible disclosure submitted via GitHub issue. The attack requires low-privileged authenticated access, which bounds real-world risk but does not eliminate it in multi-user development or DevOps platforms.
JEXL expression sandbox bypass in OpenNMS Meridian and Horizon allows a low-privileged authenticated user to load arbitrary Java classes on the server via the Measurements REST API, enabling confidentiality disclosure and integrity compromise. The flaw stems from incorrect authorization logic in OnmsJexlUberspect that checked method calls on a whitelisted class object against the whitelisted class rather than against java.lang.Class itself, allowing reflection chains such as table.getClass().forName('java.lang.Runtime') to escape the sandbox. No public exploit or CISA KEV listing has been identified at time of analysis, but the upstream GitHub PR provides regression tests that precisely document the bypass technique.
Directory traversal in kkFileView prior to 5.0.1 exposes an unauthenticated POST /listFiles endpoint that accepts a user-supplied path parameter and passes it directly to Files.newDirectoryStream without confining it to the configured demo directory, enabling remote attackers to enumerate arbitrary server-side directories. The flaw is mechanically straightforward - no credentials, no user interaction, and no special configuration are required - though impact is bounded to directory listing rather than file content disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch exists at version 5.0.1.
Server-Side Request Forgery in kkFileView before 5.0.1 allows unauthenticated remote attackers to make the application server issue HTTP requests to arbitrary internal or external URLs via the unprotected /addTask endpoint. The vulnerability arises because /addTask was excluded from both TrustHostFilter and TrustDirFilter in WebConfig.java, and the fullfilename parameter can be manipulated to coerce file type classification as OFFICE, COMPRESS, or CAD, triggering FileConvertQueueTask to fetch attacker-chosen URLs. No public exploit identified at time of analysis per CISA KEV; however, SSVC flags a publicly available POC and marks the vulnerability as automatable.
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archives via HTTP POST requests, potentially achieving arbitrary file reads and further system compromise. Affected products span multiple Red Hat enterprise offerings including JBoss EAP 7 and 8, Red Hat Fuse 7, Process Automation 7, and Single Sign-On 7, all of which embed wildfly-core as a foundational dependency. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users holding the nexus:selectors:create permission to traverse Java object properties outside the intended sandbox scope, disclosing internal JVM metadata such as class and classloader names. The vendor description explicitly confirms this does not permit method invocation, object construction, or code execution - making the 'RCE' intelligence tag a misclassification. Fixed in version 3.95.0; no public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.
Path traversal in yeqifu warehouse (all commits up to aaf29962ba407d22d991781de28796ee7b4670e4) enables authenticated remote attackers to read arbitrary files outside the intended web root by supplying directory-traversal sequences in the `path` argument handled by FileController.java. The exploit has been publicly disclosed and proof-of-concept code is available via VulDB and an external Notion document, raising the urgency despite a moderate CVSS 4.0 score of 5.3. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving all deployments of this Java-based warehouse management application unmitigated.
Denial of service in FasterXML jackson-core's non-blocking (async) JSON parser allows unauthenticated network attackers to exhaust JVM heap and CPU by submitting JSON containing arbitrarily long number tokens that bypass the maxNumberLength constraint. Affected deployments are those using the async parser API - particularly reactive frameworks such as Spring WebFlux - running com.fasterxml.jackson.core:jackson-core 2.15.0-2.18.5 or 2.19.0-2.21.0, or tools.jackson.core:jackson-core 3.0.0-3.0.x. Publicly available exploit code exists (PoC JUnit test published in GHSA-72hv-8253-57qq); the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Authorization bypass in jeequan jeepay up to version 3.2.9 allows authenticated low-privilege users to circumvent access controls enforced by the PreAuthorize Handler within WebSecurityConfig, specifically targeting the SysLogController component. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), enabling manipulation of access-control keys to reach system log data or restricted administrative functionality beyond the user's granted permissions. A public proof-of-concept exploit exists; no vendor response has been received and no patch has been confirmed, elevating remediation urgency despite the moderate CVSS score.
Unbounded PKCS#12 KDF iteration counts in Bouncy Castle for Java allow remote, unauthenticated attackers to cause denial of service by supplying a crafted PKCS#12 file with an arbitrarily large iteration count in MAC or bag-decryption KDF parameters. Any Java application that processes PKCS#12 keystores using bc-java before 1.85, bc-lts-java before 2.73.12, or bc-fja (FIPS) before 1.0.2.7/2.0.2/2.1.3 is affected. No public exploit is identified at time of analysis, but the attack surface is broad given how widely PKCS#12 files are accepted across Java enterprise stacks.
CPU and memory exhaustion in Bouncy Castle Java's BCFKS keystore loader exposes applications to pre-integrity-verification denial of service when processing a crafted keystore file. Any of the three affected library variants - bc-java (before 1.85), bc-lts-java (before 2.73.12), and BC-FJA (before 1.0.2.7, 2.0.2, or 2.1.3 depending on series) - will blindly honour attacker-supplied PBKDF2 iteration counts or scrypt cost parameters read from an untrusted file before the keystore MAC is verified, allowing an adversary to trigger arbitrary CPU or memory consumption at load time. No public exploit code has been identified and the vulnerability is absent from CISA KEV; urgency is rated Amber by the upstream reporter.
CPU-exhaustion denial of service in Bouncy Castle for Java affects any server that verifies CMP (Certificate Management Protocol) password-MAC protected messages using PKMACBuilder without an explicit iteration ceiling. The library's PKMACBuilder accepted the iteration count directly from the unauthenticated PBMParameter field in an incoming CMP message with no upper bound, allowing a remote unauthenticated attacker to supply a count near 2^31 and force billions of hash iterations on the target. No active exploitation is confirmed (not in CISA KEV), but the attack is unauthenticated, requires no special configuration beyond standard CMP usage, and a patch is available upstream.
Heap and CPU exhaustion in Bouncy Castle for Java's OpenPGP implementation allows remote unauthenticated attackers to cause denial of service by crafting OpenPGP messages with extreme Argon2 S2K cost parameters. The library honoured attacker-controlled memory, passes (iterations), and parallelism fields embedded in unauthenticated OpenPGP packets before any message authentication could occur, meaning a single crafted packet could instruct the JVM to allocate up to 2^30 KiB (approximately 1 TiB) of heap. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vulnerability is straightforward to exploit given that the cost parameters are trivially crafted and processed unconditionally.
LDAP filter injection in Bouncy Castle bc-java before 1.85 allows network-reachable attackers to manipulate LDAP directory search queries by supplying certificates with crafted Subject or Issuer CN values containing LDAP metacharacters. This is a bypass of the CVE-2023-33201 fix: the escaping was applied to the main-Java LDAPStoreHelper and both X509LDAPCertStoreSpi variants, but the jdk1.4 Ant build overlay carries its own private parseDN method that was never patched, leaving bcprov-jdk14 consumers exposed. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Denial-of-service via unbounded KDF cost in Bouncy Castle for Java's PKCS#8 / PBES2 decryptors allows remote attackers to exhaust CPU or memory by supplying crafted encrypted key material with extreme KDF parameters. The vulnerability affects bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpkix-fips) across all supported 1.0.X, 2.0.X, and 2.1.X series. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cleartext credential storage in Spring Tools for Eclipse 5.2.0 and earlier exposes the Spring Boot DevTools remote secret (`spring.devtools.remote.secret`) in Eclipse `.launch` XML configuration files, which Eclipse persists to either workspace metadata or - critically - directly into the project tree when marked as a shared configuration. The exposed secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes, converting a credential-disclosure flaw into a remote code execution primitive against the associated Spring Boot application. No public exploit has been identified at time of analysis, but the attack technique is mechanically straightforward once the secret is retrieved from a committed VCS file or accessible workspace backup.
Denial-of-service in veraPDF-parser allows a remote unauthenticated attacker to crash or hang the PDF validation service by submitting a crafted PDF containing a Type 1 font whose /FontDescriptor /FontFile PostScript program exploits one of three unbounded resource primitives: a massive array allocation, a zero-increment for-loop, or a self-referential recursive user-dictionary lookup. All veraPDF-parser releases prior to 1.30.2 and 1.31.23 are affected across both active version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches exist for both branches.
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Information disclosure in perwendel Spark (SparkJava) up to version 2.9.4 via symlink following in the staticFiles.externalLocation method allows remote attackers with low privileges to read arbitrary files from the server. Publicly available exploit code exists, but no active exploitation or CISA KEV listing has been confirmed. The project maintainer has not yet responded to the issue report.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Path traversal in the Kubernetes Java client library's copyDirectoryFromPod function allows a compromised pod to write files to arbitrary locations on the local machine of a high-privileged operator performing copy operations. The vulnerability is only reachable when enableTarCompressing is set to false, and requires both an attacker-controlled pod and an operator actively running a copy command. With a CVSS score of 2.7 (PR:H, UI:R), no public exploit, and no CISA KEV listing, this is a narrow but credible lateral-movement vector in DevOps and CI/CD operator workflows rather than a broadly exploitable flaw.
CRLF injection in Netty's HttpPostRequestEncoder allows authenticated network attackers to inject arbitrary MIME headers into multipart HTTP request bodies by embedding CR/LF characters in user-controlled filenames. Affected are all Netty 4.1.x releases before 4.1.136.Final and 4.2.x releases before 4.2.16.Final that use the codec-http multipart encoder. Publicly available exploit code has been verified against 4.2.12.Final; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the PoC lowers the bar considerably for Content-Type spoofing, stored XSS, and multipart boundary confusion attacks.
Header injection in Netty's StompSubframeEncoder allows low-privileged network attackers to embed arbitrary STOMP headers into CONNECT and CONNECTED frames by supplying newline characters in header values. Affecting netty-codec-stomp prior to 4.1.136.Final and 4.2.x before 4.2.16.Final, the encoder deliberately skips the escape() function for CONNECT frames per STOMP 1.2 backward-compatibility requirements but neglects to reject raw newline characters, conflating 'no escaping' with 'no validation.' A fully functional proof-of-concept is publicly available and confirmed against Netty 4.2.12.Final; no public exploitation in the wild (CISA KEV) has been confirmed at time of analysis.
CRLF injection in Netty's HAProxy codec enables PROXY protocol header injection and client IP spoofing when AF_UNIX socket addresses are used with the V1 text protocol. The `HAProxyMessageEncoder.encodeV1()` method writes source and destination addresses into the CRLF-terminated header without sanitization, while `HAProxyMessage.checkAddress()` enforces only a length limit for AF_UNIX addresses - unlike IPv4/IPv6 paths whose format validators incidentally block CRLF. A fully functional, author-verified proof-of-concept was confirmed on Netty 4.2.12.Final; no public exploit identified at time of analysis maps to CISA KEV, but the PoC lowers the bar for exploitation in applications that forward attacker-influenced data into AF_UNIX address fields. Vendor-released patches are available as 4.1.136.Final and 4.2.16.Final.
Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.
Oracle JDeveloper's Java Business Objects component exposes a network-accessible confidentiality and availability flaw in versions 12.2.1.4.0 and 14.1.2.0.0, allowing low-privileged remote attackers to gain unauthorized access to critical or all JDeveloper-accessible data alongside a partial denial of service. The attack complexity is rated high, requiring specific conditions to be met, but no user interaction is needed beyond initial low-privilege authentication. No public exploit code or active exploitation has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
JavaFX in Oracle Java SE 8u491 exposes a limited confidentiality breach to unauthenticated network attackers who can induce a user into executing untrusted Java content within a sandboxed client environment. The impact is strictly read-only access to a subset of sandbox-accessible data - no integrity or availability consequences are present. No public exploit has been identified at time of analysis, CISA has not listed this in KEV, and the high attack complexity alongside mandatory user interaction makes opportunistic or automated exploitation unlikely.
Unauthorized data read in the JavaFX component of Oracle Java SE 8u491 allows a remote unauthenticated attacker to access a subset of Oracle Java SE data by luring a victim into interacting with a malicious sandboxed Java Web Start application or Java applet. The attack is constrained exclusively to client-side Java deployments that run untrusted code within the Java sandbox, with high exploitation complexity (AC:H) and mandatory user interaction (UI:R) further limiting real-world reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 3.1 score of 3.1 (Low) accurately reflects the narrow, confidentiality-only impact.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.
Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.
Sandbox integrity bypass in the JavaFX component of Oracle Java SE 8u491 allows network-reachable unauthenticated attackers to perform unauthorized write, insert, or delete operations against data accessible within the Java security context. Exploitation is structurally constrained to client-side deployments running sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet - server-side Java deployments running only administrator-installed code are explicitly outside the attack surface. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the low CVSS 3.1 score of 3.1 accurately reflects the narrow, integrity-only impact combined with high attack complexity and mandatory user interaction.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated attackers across multiple network protocols, confirmed by Oracle's Critical Patch Update for July 2026. The vulnerability manifests in two distinct deployment contexts: server-side web services that pass externally supplied data to JavaFX APIs, and client-side sandboxed environments (Java Web Start applications or Java applets) that load and execute untrusted internet code. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the low-complexity, no-authentication-required attack surface makes exploitation straightforward should a proof-of-concept emerge.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical application data across seven affected Java SE releases and three GraalVM variants. The attack targets the TLS stack directly - not through applets or Web Start - and is tagged as an authentication bypass, suggesting the flaw undermines TLS-level authentication controls within JSSE. No public exploit code and no CISA KEV listing have been identified at time of analysis; the AC:H metric constrains real-world risk to adversaries capable of achieving precise network positioning or TLS session manipulation.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Open redirect in Trino 481's OAuth2/OIDC authentication component allows remote, unauthenticated attackers to manipulate the redirect_uri parameter in ExternalUriInfo.java, redirecting authenticated users to attacker-controlled external sites. Exploitation requires user interaction - a victim must follow a crafted authentication URL - making this primarily a phishing and token-harvesting enabler rather than a direct system compromise vector. No active exploitation has been confirmed (not in CISA KEV), no public exploit code exists, and the trinodb project had not responded to the responsible disclosure report at time of analysis.
Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.
Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.
Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Path traversal in Halo CMS up to version 2.24.2 allows a remotely authenticated high-privilege user to access files outside the intended backup directory via the Download function of MigrationEndpoint.java in the Files Backup Endpoint. The vulnerability is CWE-22 (Improper Limitation of a Pathname) and carries a low CVSS score of 2.0 due to the PR:H requirement, meaning exploitation is limited to users who already hold administrator-level access. A public proof-of-concept exploit exists per the provided references, though no CISA KEV listing was found at time of analysis.
Out-of-bounds write in Bouncy Castle BC-LTS bcprov-lts8on affects ARM deployments running versions 2.73.0 through 2.73.12.0, with high confidentiality impact if successfully exploited. The flaw resides in ARM-specific native C implementations of SHA3 and SHAKE algorithms and is only triggered when an application accepts memoable SHA3/SHAKE cryptographic states from potentially untrusted external sources. No public exploit code exists and no active exploitation has been confirmed at time of analysis; the CVSS 4.0 score of 1.7 reflects the very narrow exploitation conditions required to reach this code path.
Telemetry archive exposure in Yamcs mission control framework allows any authenticated user to dump the entire raw packet archive by exploiting a broken object-level authorization check in the exportPackets API. Versions prior to 5.12.8 (stable) and 5.13.2 (development) are affected. No public exploit or CISA KEV listing exists, but the attack requires only a valid session and a trivially crafted HTTP request, making it immediately actionable for any insider or compromised account.
HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.
Deserialization logic in FasterXML jackson-databind 2.15.0 through 2.18.7, 2.21.3, and 3.1.3 allows unauthenticated remote callers to bypass @JsonIgnore annotations on Java Record types when a PropertyNamingStrategy is configured. The renamed JSON key - e.g., 'internal_role' produced by SnakeCaseStrategy from 'internalRole' - is not registered in the ignore list, so Jackson's constructor-parameter binding accepts the attacker-supplied value despite the developer's explicit exclusion directive. No public exploit tooling has been identified at time of analysis, but the upstream fix PR includes a runnable proof-of-concept test that fully demonstrates the bypass, lowering the bar for independent reproduction.
Remote code injection in pig-mesh Pig's pig-codegen module through version 3.9.2 allows low-privileged authenticated attackers to execute arbitrary code server-side via the GeneratorServiceImpl component, reachable over the network. A publicly available proof-of-concept exploit exists at GitHub (sombra0316/CVE-2026), elevating the urgency for defenders. No vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments without an official remediation path.
Code injection in SonicCloudOrg sonic-agent through version 2.7.2 allows remote unauthenticated attackers to inject and execute arbitrary code via the ExchangeController endpoint, which bypasses or is excluded from the JWT Authentication Filter. The vulnerability carries a public proof-of-concept exploit named 'Unauth_ExchangeSend', confirming the endpoint is reachable without authentication. Critically, the affected product is end-of-life with no vendor support, and the maintainer did not respond to disclosure - no patch is forthcoming.
OS command injection in SonicCloudOrg sonic-agent up to version 2.7.2 allows remote low-privileged attackers to execute arbitrary system commands via the evalIsFailed function in the Groovy Script Handler component. The public proof-of-concept - titled 'Unsandboxed_RCE' - confirms that Groovy scripts are executed without a security sandbox, enabling full host-level command execution. Critically, this is an end-of-life product with no vendor response and no patch, meaning no fix is forthcoming; no public exploit identified in CISA KEV at time of analysis, but a public POC exists.