2026

In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can caus

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the c

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frame

In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type,

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of se

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints i

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnera

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity w

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally s

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerabilit

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instan

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthe

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerab

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerabi

Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used i

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as th

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple M

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels

Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Con

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexe

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, au

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endp

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, th

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spri

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, th

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, th

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp

Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in ma

ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not

DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feat

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mecha