Search: “java”

4 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 18 Vulnerability 14 Threat actor 6 Research 5 Advisory 4 Tools 2 AI research 2 Malware 1 Ransomware 1 Industry 1 Data breach 1

SeverityAll critical 9 high 26 medium 6 low 4 info 10

MongoDB security advisory (AV26-911)

Canada's Cyber Centre warns MongoDB Java Driver and Laravel MongoDB (PHP) have vulnerabilities fixed in versions 5.11.1 and 5.11.0.

The Canadian Centre for Cyber Security (AV26-911) reports MongoDB vulnerabilities affecting the Java Driver prior to 5.11.1 and Laravel MongoDB (PHP) prior to 5.11.0. Fixed issues include a native heap use-after-free during cancellation racing a KMS credential fetch in reactive encryption (JAVA-6276) and a query builder fix forcing literal equality when 3-arg where clauses use '=' with array values (PHPLARA-260). Administrators are urged to review the advisories and apply the updates.

Canadian Centre for Cyber SecuritySep 11, 13:38 UTC · 4d agoAdvisory1

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.

Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-securitySep 14, 15:23 UTC · 1d agoVulnerability CVE-2026-73195

CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Apache Parquet Hadoop CVE-2026-73334: a file-controlled KMS URL reaches pluggable KmsClients without host validation in parquet-java 1.12 through 1.18.0.

Apache disclosed CVE-2026-73334, a moderate issue in the org.apache.parquet.crypto.keytools package of parquet-java, versions 1.12 through 1.18.0. The package implements envelope encryption that wraps data keys via a Key Management Service. A KMS URL controlled by the Parquet file is forwarded to a pluggable KmsClient that skips host validation, which could allow crafted files to redirect KMS requests.

oss-securitySep 8, 15:46 UTC · 7d agoVulnerability CVE-2026-733341

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Unit 42 found a Muhstik botnet variant brute-forcing Tomato router web authentication to harvest IoT devices for crypto mining and DDoS attacks.

Palo Alto Networks Unit 42 researchers in December 2019 identified a new Muhstik botnet variant scanning Tomato routers on TCP 8080 and brute-forcing default admin credentials, targeting roughly 4,600 exposed devices found via Shodan. The variant also scans WordPress and Webuzo installations and exploits the Oracle WebLogic deserialization flaw CVE-2019-2725 for unauthenticated remote code execution. Muhstik, active since March 2018, self-propagates like a worm and typically monetizes infections through cryptocurrency mining and DDoS attacks controlled via an IRC C2 channel.

Palo Alto Unit 42Aug 19, 12:06 UTC · 27d agoMalware in the wildCVE-2019-2725