pwned.coffeeUpdated 31 min ago

The menu

Java

Major outage

1 live incident affecting Java, 1 critical, 1 not fully patched.

Today's specials

  1. criticalpartial fix Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path @capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven) ### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the… fixed in @capacitor/android 6.2.2 +15CVE-2026-1039225 sources

7 spills in 2026 for Java

Week of 16 Mar 2026: 1 newWeek of 13 Apr 2026: 1 newWeek of 1 Jun 2026: 1 newWeek of 3 Aug 2026: 1 newWeek of 24 Aug 2026: 1 newWeek of 31 Aug 2026: 1 newWeek of 5 Oct 2026: 1 new
Worst week: 16 Mar 2026, 1 new spill.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. highpatchedexploited PaperCut NG/MF Unsafe Reflection Vulnerability PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. Can be chained with CVE-2026-81578. Added to CISA KEV on 2026-08-31 (federal deadline 2026-09-14). CVE-2026-81578CVE-2026-820784 sources
  2. highpatchedexploited Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24 (federal deadline 2026-08-27). CVE-2026-219622 sources
  3. highpatchedexploited Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. Added to CISA KEV on 2026-08-04 (federal deadline 2026-08-07). CVE-2026-344862 sources
  4. highpatchedexploited Oracle WebLogic Server Unspecified Vulnerability Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. Added to CISA KEV on 2026-06-01 (federal deadline 2026-06-04). CVE-2024-211822 sources
  5. highpatchedexploited Apache ActiveMQ Improper Input Validation Vulnerability Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. Added to CISA KEV on 2026-04-16 (federal deadline 2026-04-30). CVE-2026-341972 sources
  6. criticalpatchedexploited Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. Added to CISA KEV on 2026-03-19 (federal deadline 2026-03-22). CVE-2026-201312 sources

More in Web & runtimes

Follow Java

RSS: /feed.xml?stack=java. JSON: /incidents.json?stack=java. Or add it to your usual for delivery.