Lightwell project filters out 400 Java library vulnerabilities

Lightwell, the open-source security initiative set up by IBM and Red Hat, has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries — and now the companies are inviting customers to submit their own code dependencies to a new service, Lightwell Clearinghouse, for review. They’ll be looking for bugs such as the critical sandbox bypass in Java template engine Thymeleaf , with a CVSS score of 9.1, discovered in April. “AI agents shifted the threat landscape