27160 matches found
CVE-2026-15968
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...
CVE-2026-15966
Moveit Transfer contains a permissive cross-domain security policy that allows interaction with untrusted domains. Affected versions: MOVEit Transfer before 2025.1.5, and 2026.0.0 before 2026.0.3. Root cause is misconfigured CORS/policy allowing cross-origin requests. Impact is high (confidenti...
EUVD-2026-48417
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...
openjdk: Improve Nashorn index handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There is an integer overflow in TypedArray.prototype.set which can cause a DoS...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...
openjdk: Enhance XBM image support (Oracle CPU 2026-07)
A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...
openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. When a server has wantClientAuth and the client sends a nocertificate alert, any client certificates are not verified...
EUVD-2026-48310
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
CVE-2026-16584
Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...
K000162395: Spring AMQP vulnerability CVE-2026-41701
Security Advisory Description Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...
Security Bulletin: Apache Lucene PRISMA-2021-0081 X-Force 216835 security vulnerability
Summary Apache Lucene PRISMA-2021-0081 X-Force 216835 security vulnerability in FileNet Content Manager FNCM / IBM Content CortexCCx Content Search Services CSS/Enterprise Content Management Text Search ECMTS. CSS/ECMTS is affected and is potentially vulnerable. Vulnerability Details Refer to the...
Security Bulletin: IBM DataPower Gateway affected by local privilege escalation due to VMware Tools (CVE-2025-41244)
Summary IBM DataPower Gateway affected by local privilege escalation due to VMware Tools CVE-2025-41244 Vulnerability Details CVEID:CVE-2025-41244 DESCRIPTION: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrati...
Security Bulletin: Apache uimaj-core.jar security vulnerability CVE-2022-32287 and CVE-2023-39913 in FileNet Content Manager (FNCM) / IBM Content Cortex(CCx) component Content Search Services (CSS) / Enterprise Content Management Text Search (ECMTS)
Summary Apache uimaj-core.jar security vulnerability CVE-2022-32287 and CVE-2023-39913 in FileNet Content Manager FNCM / IBM Content CortexCCx component Content Search Services CSS / Enterprise Content Management Text Search ECMTS Vulnerability Details Refer to the security bulletins listed in th...
EUVD-2026-48253
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...
openjdk: Improve Nashorn index handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There is an integer overflow in TypedArray.prototype.set which can cause a DoS...
openjdk: Enhance Dataview Implementation (Oracle CPU 2026-07)
A flaw was found in OpenJDK. 1 DataView getter/setter methods use absolute ByteBuffer indexing and ignore the offset, allowing read and write to memory outside its intended window. 2 Missing bounds check in the DataView constructor fails to validate the capacity...
openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. When a server has wantClientAuth and the client sends a nocertificate alert, any client certificates are not verified...
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...