docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
CVE-2026-53752
### Summary docx4j's `PropertyResolver` and several adjacent helpers recursively walk the OpenXML style inheritance chai
#maven
共收录 259 条相关情报。
← 返回所有主题http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
CVE-2026-53659
### Impact `ServerFilters.GZip` and `RequestFilters.GunZip` (and the underlying `Gzip` functions used to decompress req
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
CVE-2026-59903
### Summary Netty's `CorsHandler` silently overwrites existing `Vary` headers, enabling cache poisoning and sensitive in
Netty: Memory Exhaustion in SctpMessageCompletionHandler
CVE-2026-59902
### Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticate
mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"
CVE-2026-55153
### Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI `ObjectFactory` implementation (`com.mchange.v2.
OpenAM Insecure SSO Cookie Initialization
CVE-2026-53660
## Summary **Description** An Insecure Default Initialization of Resource (CWE-1188) issue in the OpenAM default config
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
CVE-2026-56818
## Summary `RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is excee
jsoup: Cleaner may expose markup with custom raw-text elements
CVE-2026-71497
When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a t
core-geonetwork has an Open Redirect Bypass
CVE-2026-53573
### Summary GeoNetwork's post-login redirect handling can be bypassed to redirect users to an attacker-controlled extern
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
CVE-2026-56819
### Summary A remote, unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that e
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
CVE-2026-41695
`src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175` · Unbounded Resource All
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
CVE-2026-54704
OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements wh
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
CVE-2026-54712
The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
CVE-2026-50559
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parame
veraPDF Parser DoS via PostScript Type 1 Font Programs
CVE-2026-54081
## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow
veraPDF Parser DoS via PostScript CMap Streams
CVE-2026-54080
## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
CVE-2026-54082
### Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `G
veraPDF Validation XXE via Rich Text
CVE-2026-54078
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta
veraPDF Validation XXE via XFA
CVE-2026-54079
## Summary **Description** An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote atta
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
CVE-2023-37465
### Impact It's possible to forge a request to delete a message. ### Patches The problem has been patched in version 2