Low Severity
Published: Oct 29, 2026
CVE Tracker project
# JGC CVE Tracker
JGC CVE Tracker checks the **JVM executing the scanner** and, when an application path is supplied, inspects application dependencies for evidence associated with specific CVEs.
Every invocation runs all checkers registered in `CVEPlanner`, sequentially in declaration order. The expanded implementation includes **nine CVE checkers** using a shared `AbstractCVEChecker` hierarchy.
Results distinguish demonstrated vulnerable behavior, version evidence, dependency evidence, and incomplete checks. A favorable result applies only to the condition and scope tested.
## Features
- Runs all registered checkers in one execution.
- Tests affected TLS certificate chains and invalid ECDSA signatures locally.
- Compares supported runtime versions against reviewed vendor advisory data.
- Inspects explicitly selected application directories and archives for affected dependencies.
- Logs findings to the console and an audit file.
- Writes per-CVE results to a Java properties file for automation.
- Downloads pinned public certificate fixtures automatically during the Maven build.
- Packages the executable JAR, Windows launcher, and `fixes/` directory in a ZIP.
- Includes a separately invoked Windows workaround for CVE-2026-91403.
## Supported CVEs
| CVE | Checker | Verification method |
| --- | --- | --- |
| CVE-2026-91403 | `CVE202691403Checker` | Behavioral validation of 12 affected eMudhra TLS chains using the executing JVM's default JSSE trust manager. Blocklist fingerprints provide supporting diagnostics. |
| CVE-2022-21449 | `CVE202221449Checker` | Behavioral ECDSA verification tests using invalid signature scalars, with valid-signature and wrong-message controls. |
| CVE-2023-21930 | `CVE202321930Checker` | Oracle affected-release comparison and reviewed Azul Zulu fix baselines. |
| CVE-2024-20918 | `CVE202420918Checker` | Oracle affected-release comparison and reviewed Azul Zulu fix baselines. |
| CVE-2015-2590 | `CVE20152590Checker` | Legacy Oracle ru