jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution

Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets