Apache Sling XSS before 2.4.14 allows XSS via getStyleToken (CVE-2026-123765)
xssAPI.getStyleToken() accepts markup in unquoted URLs; Apache rates it low and fixes it in 2.4.14.
Stories per day · 30 days
4 RSS
Relatedubuntu7deserialization6authentication5openjdk5denial-of-service4jsse4oracle4trust-store4apache3ca-certificates3graalvm3jks3apache-camel2authorization2certificates2emudhra2remote-code-execution2apache-kylin1
50 stories, newest first · one card per story
Stories tagged #java
DataSketches Java through 9.0.0 can exhaust memory on crafted input
Deserializers trusted sizes in serialized sketch images, so a small input could trigger an OutOfMemoryError.
Ubuntu 18.04 and 20.04 get ca-certificates JKS keystore fix
CA certificates removed from the system bundle could remain in the Java JKS keystore until this resync.
OpenJDK 8 flaws may let remote attackers read or change data
Ubuntu cites four CVEs in Security, JSSE, and JAAS; the notice cuts off before fixes.
SIExBench tests automated repair of sensitive information exposure
Across 161 verified Python and Java cases, the best of 18 LLM repair setups fixes only 39.1 percent.
Apache Axis2/Java JSON buffer vulnerability (CVE-2026-120367)
Apache Axis2/Java JSON builders buffered full request bodies without limits, enabling unauthenticated memory exhaustion, fixed in 2.0.2.
2021 essay on who owns open-source security failures
The 2021 post uses an unnamed Java library emergency to argue maintainers inherited users' risk by keeping a bad idea compatible.
Apache MINA 3.0.0 through 3.0.0-M2 unsafe deserialization (CVE-2026-118636)
JavaNativeMessageDecoder calls ObjectInputStream.readObject() with no class filter; the issue was unsupported when assigned.
Apache Thrift Java skip() lacks a recursion limit before 0.24.0
CVE-2026-120135 is CVSS 8.2 and can crash Java services; upgrade libthrift to 0.24.0.
Java fingerprint blocklist misses re-encoded eMudhra certificates
Re-encoded ECDSA and RSA intermediates still validated in tested JDKs after blocked.certs rejected the original encodings.
1
JANUS synthesizes cross-layer defenses for deserialization attacks
On 16 Java and PHP deployments, held-out attack success fell to 6.2% while 98.4% of benign tests still passed.
Oracle Java flaw CVE-2026-91403 allows unauthenticated remote attacks
The CVSS 9.1 JSSE issue concerns trust in compromised eMudhra intermediate certificates, not confirmed code execution.
Oracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
Oracle October 2026 CPU patches 1,295 flaws across dozens of products
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
10
Oracle alerts on unauthenticated Java JSSE flaw CVE-2026-91403
The CVSS 9.1 issue affects named Java SE and GraalVM builds and can be reached through JSSE APIs without credentials.
Apache Camel JGroups deserializes cluster messages to RCE
CVE-2026-88900 scores CVSS 8.8; fixed builds are 4.18.5 and 4.22.1.
Apache Camel fixes 38 CVEs in 4.18.5, 4.22.1 and 4.23.0
The 4.14.x line is end of life and does not receive these fixes.
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization
Apache Kylin through 5.0.4 can unsafely deserialize Java data from a broken Redis cache.
CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
CISA added exploited Apache Struts command injection flaw CVE-2016-3081 to its KEV catalog with forensic triage required.
8
Lightwell project filters out 400 Java library vulnerabilities
IBM and Red Hat's Lightwell says it found more than 400 new vulnerabilities in widely used Java libraries.
CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
Apache CXF cached validated STS tokens under a 32-bit hash, enabling authentication bypass.
Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat say Lightwell fixed more than 400 previously unknown Java library flaws without naming them.
4
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
LibreOffice patched spreadsheet code execution; matching OpenOffice flaw CVE-2026-59265 remains unfixed.
5
CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
Apache Jackrabbit DavEx clients can load attacker-chosen classes from malicious WebDAV error bodies (CVE-2026-92415).