2026

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persist

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on t

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending r

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Sup

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also c

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowE

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to int

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parame

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. W

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Input Validation v

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pa

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbit

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that al

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that

ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that c

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Integer Overflow or Wraparound vulnera

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbit

Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php

Dreamweaver Desktop versions 21.7 and earlier are affected by an Incorrect Authorization vulnerability that could lead t

Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Input Validation vulnerability that could lead

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a stored cross-site scripting vulnerabili

Ellucian Banner Self-Service before the April T2 release (2025-04-23) contains a reflected cross-site scripting vulnerab

Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical

SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple stack overflows in the formSet

Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in

Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in