Schwachstellen verstehen. Anwendungen schützen.

Hoch 16.10.2026

CVE-2026-102834

JavaCV: Ganzzahlüberlauf in IPCameraFrameGrabber verursacht Denial-of-Service durch Endlosschleife

Ein Ganzzahlüberlauf im IP-Kamera-Frame-Grabber von JavaCV kann bei der Verarbeitung nicht vertrauenswürdiger MJPEG-HTTP-Streams eine Endlosschleife auslösen. Eine manipulierte Header-Antwort führt zu einer dauerhaften CPU-Auslastung von 100 % und blockiert den betroffenen Thread dauerhaft.

Java / Kotlin (Maven)

org.bytedeco:javacv

Hoch 30.09.2026

CVE-2026-91777

jackson-databind quadratic forward-reference completion

Java / Kotlin (Maven)

com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind

Hoch 30.09.2026

CVE-2026-91776

jackson-databind retains every unknown raw type ID

Java / Kotlin (Maven)

com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind

Kritisch 23.09.2026

CVE-2026-85724

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

Java / Kotlin (Maven)

io.moquette:moquette-broker

Mittel 28.08.2026

CVE-2026-55856

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Java / Kotlin (Maven)

org.mariadb.jdbc:mariadb-java-client

Hoch 24.08.2026

CVE-2026-66908

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Java / Kotlin (Maven)

org.apache.camel:camel-platform-http-main

Hoch 20.08.2026

CVE-2026-63202

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

Java / Kotlin (Maven)

io.netty.incubator:netty-incubator-codec-bhttp

Hoch 24.07.2026

CVE-2026-102695

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Java / Kotlin (Maven)

org.omnifaces:omnifaces

Kritisch 06.07.2026

CVE-2026-53913

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

Java / Kotlin (Maven)

org.apache.camel:camel-keycloak

Kritisch 06.07.2026

CVE-2026-46455

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Java / Kotlin (Maven)

org.apache.camel:camel-keycloak

Hoch 25.06.2026

CVE-2026-46498

OpenAM Arbitrary OAuth Token Minting via Push Registration

Java / Kotlin (Maven)

org.openidentityplatform.openam:openam-oauth2

Hoch 18.06.2026

ghsa-2c85-rfcc-g74j

Karate Mock Server RCE via embedded expression evaluation of request-derived data

Java / Kotlin (Maven)

io.karatelabs:karate-core

Hoch 15.06.2026

CVE-2026-50011

Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

Java / Kotlin (Maven)

io.netty:netty-codec-redis

Kritisch 12.06.2026

CVE-2026-50627

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Java / Kotlin (Maven)

org.apache.cxf:cxf-rt-rs-security-oauth2

Hoch 08.06.2026

CVE-2026-47691

Netty has Insufficient Bailiwick Validation for NS Records

Java / Kotlin (Maven)

io.netty:netty-resolver-dns

Mittel 28.05.2026

CVE-2026-9793

Keycloak has an Improper Verification of Cryptographic Signature issue

Java / Kotlin (Maven)

org.keycloak:keycloak-services

Mittel 19.05.2026

CVE-2026-37979

Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

Java / Kotlin (Maven)

org.keycloak:keycloak-services

Kritisch 12.05.2026

CVE-2026-45091

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

Java / Kotlin (Maven) npm

io.github.davidalmeidac:sealed-env-core, sealed-env

Kritisch 11.05.2026

CVE-2026-27478

Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

Java / Kotlin (Maven)

io.unitycatalog:unitycatalog-server

Hoch 07.05.2026

CVE-2026-42582

Netty HTTP/3 QPACK literal unbounded allocation

Java / Kotlin (Maven)

io.netty:netty-codec-http3

Hoch 24.04.2026

CVE-2026-33524

Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Java / Kotlin (Maven)

io.github.ndsev:zserio-runtime

Niedrig 06.04.2026

CVE-2026-37977

Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

Java / Kotlin (Maven)

org.keycloak:keycloak-services

Kritisch 05.03.2026

CVE-2026-29000

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

Java / Kotlin (Maven)

org.pac4j:pac4j-jwt

Kritisch 23.02.2026

CVE-2026-23552

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

Java / Kotlin (Maven)

org.apache.camel:camel-keycloak