Lightwell project filters out 400 Java library vulnerabilities
IBM and Red Hat's Lightwell says it found more than 400 new vulnerabilities in widely used Java libraries.
IBM and Red Hat's Lightwell initiative says it has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries and is inviting customers to submit dependencies to a new Lightwell Clearinghouse. As an example of the bugs it seeks, the companies cite an April critical sandbox bypass in the Thymeleaf template engine with a CVSS score of 9.1; the article names no CVE identifiers. IBM and Red Hat said in May they would commit 20,000 engineers and $5 billion, combining open-source work with AI-assisted remediation. Azul separately offers free Java vulnerability assessments aimed at blind spots that automated exploitation tools such as Mythos can find.