CVE-2026-81875 is a high-severity vulnerability in HAPI FHIR's org.hl7.fhir.core component prior to version 6.9.12. The SHCParser improperly validates input when decompressing Smart Health Card JWT content with a 'zip' header set to 'DEF'. This leads to unbounded memory allocation during decompression, potentially causing excessive heap usage, severe garbage collection pressure, request failures, or process crashes. The issue is fixed in version 6.9.12.
CVE-2026-68497 is a high-severity denial of service vulnerability in FasterXML jackson-databind affecting versions >=2.0.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2, >=3.0.0 <3.1.6, and >=3.2.0 <3.2.2. It arises because the library deserializes JSON strings bound to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing them directly to JDK factory methods that parse numeric components with O(n²) complexity, without enforcing length limits on the string input. This allows an unauthenticated attacker to cause excessive CPU consumption and denial of service by submitting a specially crafted JSON string with very long numeric components. No polymorphic typing or special configuration is required to trigger this issue.
Apache FreeMarker versions from 2.2.0 through 2.3.34 contain a path traversal vulnerability in the template loading mechanism. This occurs when an attacker specifies a malformed locale identifier while localized lookup is enabled, which is the default setting. The vulnerability allows unauthorized access to files outside intended directories, constrained by the TemplateLoader implementation. Users should upgrade to version 2.3.35 or disable localized lookup to mitigate the issue.
Apache Spark History Server versions prior to 3.5.8 have a stored cross-site scripting (XSS) vulnerability due to lack of proper escaping of application names. This flaw allows a malicious Spark job to inject arbitrary unescaped frontend code, potentially causing minimal privilege escalation in a user's browser. Exploitation requires the ability to launch a Spark job and trick a user with higher privileges to visit the Spark History Server web page. The issue is fixed in version 3.5.8.
CVE-2026-84218 is a vulnerability in Red Hat AMQ Broker 7 related to Jolokia's JSR-160 proxy functionality. It involves insufficient validation of client-controlled JMX service URLs, allowing bypass of an existing denylist. This flaw permits the use of alternative valid JMX service URL forms, such as ldaps:// schemes or LDAP URLs with non-empty JMX host components, which can lead to server-side request forgery (SSRF), credential forwarding, and potentially remote code execution.
CVE-2026-83557 is a deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.11.0 up to but excluding 2.18.10, 2.19.0 up to 2.21.6, 2.22.0 up to 2.22.2, 3.0.0 up to 3.1.6, and 3.2.0 up to 3.2.2. The issue arises because the DefaultBaseTypeLimitingValidator does not include java.lang.Comparable in its unsafe base types list, allowing polymorphic deserialization of any class implementing Comparable when @JsonTypeInfo is used without a custom validator. This can lead to attacker-controlled object instantiation, such as creating a java.io.File with an attacker-chosen path. No direct code execution via deserialization alone has been identified. Global default typing with explicit validators is not affected. Users should upgrade to fixed versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 to remediate.
CVE-2026-19032 is a medium severity vulnerability in FasterXML jackson-databind that involves unsafe reflection via deserialization of java.nio.file.Path from untrusted JSON input. The vulnerability arises because the deserialization process resolves a URI scheme from attacker-controlled input and uses it to select a FileSystemProvider via Java's ServiceLoader mechanism without restricting schemes. While built-in providers do not perform network I/O or mounting, a third-party provider could potentially be triggered, leading to side effects. The issue affects multiple jackson-databind versions from 2.8.0 up to but excluding 3.2.2 in various version ranges. No direct code execution or data confidentiality impact is described, and the impact is bounded by the behavior of the selected FileSystemProvider.
MariaDB Connector/R2DBC versions prior to 1.4.1 do not prevent cleartext password authentication plugins from being used over unencrypted connections. This allows a malicious or man-in-the-middle MariaDB server to request cleartext password authentication over plain TCP, exposing user credentials in transit. The vulnerability is fixed in version 1.4.1.
MariaDB Connector/R2DBC versions prior to 1.4.1 improperly handle mid-session changes to the character_set_client encoding when it is changed from UTF-8 to another character set. This causes a mismatch between client and server character encoding, leading to silent data corruption and potential bypass of byte-wise quoting or escaping. The issue is fixed in version 1.4.1 by restricting accepted character sets to utf8, utf8mb3, or utf8mb4 after initialization, closing the connection otherwise.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where the connector incorrectly assumes the connection character set is UTF-8 throughout the session. If the server changes the character_set_client to a non-UTF-8 encoding mid-session, the driver continues to encode/decode as UTF-8, causing silent data corruption and charset confusion. This can defeat client-side escaping and quoting mechanisms. The issue is fixed by restricting allowed character sets after initialization to utf8, utf8mb3, or utf8mb4, with other values causing the connection to close with an error.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where PAM dialog authentication can transmit the account password in cleartext over insecure connections. This occurs because the PAM handler 'dialog' does not require secure transport, unlike the mysql_clear_password plugin. A malicious or man-in-the-middle server can exploit this by sending an Authentication Switch Request over plain TCP, causing the driver to expose the password if sslMode=DISABLE and restrictedAuth=null (default settings). The issue is fixed in the specified versions.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 contain a vulnerability where the initial handshake path does not properly enforce certificate fingerprint verification. This allows a man-in-the-middle or hostile server to present a self-signed certificate and receive the full database password via the mysql_clear_password authentication plugin before the connection is rejected.
CVE-2026-55848 is a high-severity vulnerability in mapfish-print, a component used for printing templated cartographic maps. The flaw involves improper restriction of XML external entity (XXE) references in the GML layer parsing functionality. Specifically, before fixed versions, mapfish-print accepts attacker-controlled GML layer URLs that are parsed without disabling external entities and DTDs, allowing unauthenticated attackers to read sensitive local files or perform server-side request forgery (SSRF). This vulnerability affects multiple versions prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, where the issue has been resolved.
CVE-2026-55867 is a medium severity authorization bypass vulnerability in Graylog2's graylog2-server affecting versions from 6.2.0 until fixed in 6.3.12, 7.0.7, and 7.1.2. It allows an authenticated user to delete access tokens belonging to other users, including service accounts or administrators, by exploiting improper permission checks on the DELETE /users/{userId}/tokens/{idOrToken} endpoint. The vulnerability does not expose token contents but can disrupt access-token-based integrations by unauthorized token deletion.
CVE-2026-55841 is a vulnerability in Graylog2-server affecting the FortiGate key-value syslog parser. It mishandles field-like text inside quoted values, allowing crafted syslog messages to manipulate or remove security-log fields. This can enable an unauthenticated network sender to obscure malicious activity by evading logging. The issue is fixed in Graylog Server versions 6.3.12, 7.0.7, 7.1.2, and Graylog Forwarder version 7.3.
IzPack installer versions prior to 5.2.7 contain a path traversal vulnerability in the UnpackerBase.unpack() method. This flaw allows an attacker to craft a malicious installer JAR with entries that include '../' sequences in target paths, enabling files to be written outside the intended installation directory. Because IzPack installer JARs are unsigned and lack integrity protection, attackers can easily repack legitimate installers with malicious payloads. Running such a trojanized installer can result in arbitrary file writes to attacker-chosen locations on the victim's system under the victim's privileges. This can include sensitive directories such as startup folders or system paths, especially on Windows where installers often run with local administrator rights. The vulnerability is confirmed unpatched in the latest source but fixed in version 5.2.7.
An improper input validation vulnerability exists in Apache Tomcat due to an incomplete fix for CVE-2026-32990. This vulnerability affects HTTP/2 no-authority handling, allowing bypass of strict Server Name Indication (SNI) validation. It impacts Apache Tomcat versions 9.0.115 through 9.0.120, 10.1.53 through 10.1.57, and 11.0.20 through 11.0.24. The issue is resolved in versions 9.0.121, 10.1.58, and 11.0.25.
CVE-2026-65182 is a critical improper access control vulnerability in Apache Tomcat that allows security constraint bypass when a longer path constraint is specified before a more restrictive constraint for a shorter sub-path. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24. The vulnerability can lead to unauthorized access due to incorrect authorization checks. Fixed versions include 11.0.25, 10.1.58, and 9.0.121.
Apache Tomcat's DIGEST authentication mechanism contains a vulnerability that allows a limited replay attack. An attacker can replay a DIGEST authenticated request once if it uses a nonceCount at the upper boundary of the replay window before the windowSize requests have been made. This affects multiple versions of Apache Tomcat, including some end-of-life versions. The issue is fixed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
CVE-2026-68525 is a critical incorrect authorization vulnerability in Apache Tomcat's FORM authentication process. It allows bypassing a security constraint that restricts user access to a resource's POST method but not the GET method. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24, including some end-of-life versions. The issue is fixed in versions 11.0.25, 10.1.58, and 9.0.121.