In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2453-1 advisory.

    This update for java-1_8_0-ibm fixes the following issues

    - CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
    - CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
    - CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data     (bsc#1262495).
    - CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service     (bsc#1262496).
    - CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
    - CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).
    - CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string     (bsc#1265261)

    Changes for java-1_8_0-ibm:

    - Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20947-1 advisory.

    Changes in java-21-openj9:

    - Make post scripts less noisy (bsc#1267355)

    - Use libalternatives instead of update-alternatives for       distributions where libalternatives is available

    - Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine
    - Including Oracle April 2026 CPU changes
      * CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494),         CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496),         CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118),         CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)
    - OpenJ9 specific security fix
      * CVE-2026-1188 (bsc#1265261)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.59/

    - Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine
    - Including Oracle January 2026 CPU changes
      * CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036),         CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.57/

    - Do not depend on update-desktop-files (jsc#PED-14507)

    - Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine
    - Including Oracle October 2025 CPU changes
      * CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417),         CVE-2025-61748 (bsc#1252418)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.56/

    - Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine
    - Including Oracle July 2025 CPU changes
      * CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598),         CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.53/
    - Enable bootcycle build

    - Do not embed rebuild counter (bsc#1246806)

    - Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since       the C++ part is on -std=gnu++98, this is the closest.

    - Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine
    - Including Oracle April 2025 CPU changes
      * CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275),         CVE-2025-30698 (bsc#1241276)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.51/

    - fix wrong execstack flag in libj9jit (bsc#1235844)

    - Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine
    - Including Oracle October 2024 and January 2025 CPU changes
      * CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711),         CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719),         CVE-2025-21502 (bsc#1236278)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.49/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20943-1 advisory.

    Changes in java-17-openj9:

    - Make post scripts less noisy (bsc#1267355)

    - Use libalternatives instead of update-alternatives for       distributions where libalternatives is available

    - Update to OpenJDK 17.0.19 with OpenJ9 0.59.0 virtual machine
    - Including Oracle April 2026 CPU changes
      * CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494),         CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496),         CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118),         CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)
    - OpenJ9 specific security fix
      * CVE-2026-1188 (bsc#1265261)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.59/

    - Update to OpenJDK 17.0.18 with OpenJ9 0.57.0 virtual machine
    - Including Oracle January 2026 CPU changes
      * CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036),         CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.57/

    - Do not depend on update-desktop-files (jsc#PED-14507)

    - Update to OpenJDK 17.0.17 with OpenJ9 0.56.0 virtual machine
    - Including Oracle October 2025 CPU changes
      * CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.56/

    - Update to OpenJDK 17.0.16 with OpenJ9 0.53.0 virtual machine
    - Including Oracle July 2025 CPU changes
      * CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598),         CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.53/
    - Enable bootcycle build

    - Do not embed rebuild counter (bsc#1246806)

    - Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since       the C++ part is on -std=gnu++98, this is the closest.
    - Added patch:
      * fix-build-with-gcc15.patch
        - fix a typo in omr that is fatal with gcc15

    - Update to OpenJDK 17.0.15 with OpenJ9 0.51.0 virtual machine
    - Including Oracle April 2025 CPU changes
      * CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275),         CVE-2025-30698 (bsc#1241276)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.51/

    - fix wrong execstack flag in libj9jit (bsc#1235844)

    - Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine
    - Including Oracle October 2024 and January 2025 CPU changes
      * CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711),         CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719),         CVE-2025-21502 (bsc#1236278)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.49/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2110-1 advisory.

    This update for java-1_8_0-ibm fixes the following issues

    - CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
    - CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
    - CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data     (bsc#1262495).
    - CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service     (bsc#1262496).
    - CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
    - CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).
    - CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string     (bsc#1265261)

    Changes for java-1_8_0-ibm:

    - Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2036-1 advisory.

    This update for java-1_8_0-openj9 fixes the following issues

    - CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string     (bsc#1265261).
    - CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
    - CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
    - CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data     (bsc#1262495).
    - CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service     (bsc#1262496).
    - CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
    - CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).
    - CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).

    Changes for java-1_8_0-openj9:

    - Update to OpenJDK 8u492 build 09 with OpenJ9 0.59.0 virtual      machine

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 7267689 advisory.

  - In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names     of all supported processor features was not accounting for the separator inserted between processor     features. If the output buffer supplied to this function was incorrectly sized, failing to account for the     separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue     is fixed in Eclipse OMR version 0.8.0. (CVE-2026-1188)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM     for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2026-21945)

  - A Blind Server-Side Request Forgery (SSRF) vulnerability exists in Oracle Java 21. The vulnerability,     which leads to Denial of Service (DoS), is present in the x509 certificate path validation mechanism when     the non-default system property com.sun.security.enableAIAcaIssuers is set to true. (CVE-2026-21945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
321695	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2026:2453-1)	Nessus	SuSE Local Security Checks	medium
321009	openSUSE 16 Security Update : java-21-openj9 (openSUSE-SU-2026:20947-1)	Nessus	SuSE Local Security Checks	medium
321003	openSUSE 16 Security Update : java-17-openj9 (openSUSE-SU-2026:20943-1)	Nessus	SuSE Local Security Checks	medium
318096	SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2026:2110-1)	Nessus	SuSE Local Security Checks	medium
316721	SUSE SLES15 Security Update : java-1_8_0-openj9 (SUSE-SU-2026:2036-1)	Nessus	SuSE Local Security Checks	medium
303926	IBM WebSphere eXtreme Scale 8.6.1.0 < 8.6.1.6 (7267689)	Nessus	Web Servers	medium

Detections

Analytics

CVE-2026-1188

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium