CVE-2026-42777

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

CVE-2026-42777

The WordPress Aalto theme (versions

CVE-2026-42777 WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

EUVD-2026-96455

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

PT-2026-109786

Name of the Vulnerable Software and Affected Versions Aalto versions prior to 1.9 Description An unauthenticated Local File Inclusion LFI issue exists, which allows an attacker to read arbitrary files from the local file system without requiring authentication. Recommendations Update to a version...

CVE-2026-42777: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

CLEANSTART-2026-CF84062 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Aalto versions = 1.8...

CLEANSTART-2026-LS35751 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the rundeck package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

PT-2026-108514

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

Security Bulletin: Spring Framework (spring-web) — Open Redirect, Resource Exhaustion, Missing SameSite Cookie Attribute, and XML Memory Limit Bypass

Summary IBM Db2 Developer Extension is affected version 6.2.19 is vulnerable to 4 CVEs: CVE-2026-47883 CVSS 6.1 , CVE-2026-47885 CVSS 7.5 , CVE-2026-47889 CVSS 7.5 , CVE-2026-47891 CVSS 9.8 Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION: UrlHandlerFilter can be vulnerable to an open...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service DoS. The vulnerability is due to the Aalto XML processor not correctly enforcing the maxInMemorySize limit when parsing XML input, which allows an attacker to provide oversized XML data that consumes excessive memory and potentially causes a...

CVE-2026-47891

A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption,...

Linux Distros Unpatched Vulnerability : CVE-2026-47891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework...

DEBIAN-CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

UBUNTU-CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

CVE-2026-47891

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....