Poznaj podatności. Chroń swoje aplikacje.

Wysoka 16.10.2026

CVE-2026-102834

JavaCV: Przepełnienie liczby całkowitej w IPCameraFrameGrabber powoduje DoS przez nieskończoną pętlę

Przepełnienie liczby całkowitej w komponencie JavaCV do pobierania klatek z kamer IP może spowodować nieskończoną pętlę podczas przetwarzania strumieni HTTP MJPEG. Zmanipulowany nagłówek odpowiedzi wymusza stałe 100% zużycie procesora przez wątek, prowadząc do odmowy usługi.

Java / Kotlin (Maven)

org.bytedeco:javacv

Wysoka 30.09.2026

CVE-2026-91777

jackson-databind quadratic forward-reference completion

Java / Kotlin (Maven)

com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind

Wysoka 30.09.2026

CVE-2026-91776

jackson-databind retains every unknown raw type ID

Java / Kotlin (Maven)

com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind

Krytyczna 23.09.2026

CVE-2026-85724

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

Java / Kotlin (Maven)

io.moquette:moquette-broker

Średnia 28.08.2026

CVE-2026-55856

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Java / Kotlin (Maven)

org.mariadb.jdbc:mariadb-java-client

Wysoka 24.08.2026

CVE-2026-66908

Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Java / Kotlin (Maven)

org.apache.camel:camel-platform-http-main

Wysoka 20.08.2026

CVE-2026-63202

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

Java / Kotlin (Maven)

io.netty.incubator:netty-incubator-codec-bhttp

Wysoka 24.07.2026

CVE-2026-102695

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Java / Kotlin (Maven)

org.omnifaces:omnifaces

Krytyczna 06.07.2026

CVE-2026-53913

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

Java / Kotlin (Maven)

org.apache.camel:camel-keycloak

Krytyczna 06.07.2026

CVE-2026-46455

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Java / Kotlin (Maven)

org.apache.camel:camel-keycloak

Wysoka 25.06.2026

CVE-2026-46498

OpenAM Arbitrary OAuth Token Minting via Push Registration

Java / Kotlin (Maven)

org.openidentityplatform.openam:openam-oauth2

Wysoka 18.06.2026

ghsa-2c85-rfcc-g74j

Karate Mock Server RCE via embedded expression evaluation of request-derived data

Java / Kotlin (Maven)

io.karatelabs:karate-core

Wysoka 15.06.2026

CVE-2026-50011

Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

Java / Kotlin (Maven)

io.netty:netty-codec-redis

Krytyczna 12.06.2026

CVE-2026-50627

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Java / Kotlin (Maven)

org.apache.cxf:cxf-rt-rs-security-oauth2

Wysoka 08.06.2026

CVE-2026-47691

Netty has Insufficient Bailiwick Validation for NS Records

Java / Kotlin (Maven)

io.netty:netty-resolver-dns

Średnia 28.05.2026

CVE-2026-9793

Keycloak has an Improper Verification of Cryptographic Signature issue

Java / Kotlin (Maven)

org.keycloak:keycloak-services

Średnia 19.05.2026

CVE-2026-37979

Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

Java / Kotlin (Maven)

org.keycloak:keycloak-services

Krytyczna 12.05.2026

CVE-2026-45091

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

Java / Kotlin (Maven) npm

io.github.davidalmeidac:sealed-env-core, sealed-env

Krytyczna 11.05.2026

CVE-2026-27478

Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

Java / Kotlin (Maven)

io.unitycatalog:unitycatalog-server

Wysoka 07.05.2026

CVE-2026-42582

Netty HTTP/3 QPACK literal unbounded allocation

Java / Kotlin (Maven)

io.netty:netty-codec-http3

Wysoka 24.04.2026

CVE-2026-33524

Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Java / Kotlin (Maven)

io.github.ndsev:zserio-runtime

Niska 06.04.2026

CVE-2026-37977

Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

Java / Kotlin (Maven)

org.keycloak:keycloak-services

Krytyczna 05.03.2026

CVE-2026-29000

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

Java / Kotlin (Maven)

org.pac4j:pac4j-jwt

Krytyczna 23.02.2026

CVE-2026-23552

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

Java / Kotlin (Maven)

org.apache.camel:camel-keycloak