CVE-2026-47856

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

PT-2026-82573

Name of the Vulnerable Software and Affected Versions tiger-gh-mcp-server versions prior to the commit that implemented the fix Description The MCP HTTP transport was started without enabling the host allow-list provided by the underlying SDK. Specifically, the httpServer.ts file called the...

PT-2026-82384

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls to...

PT-2026-82572

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-59284: Improperly Controlled Modification of Dynamically-Determined Object Attributes

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...

PT-2026-82568

Name of the Vulnerable Software and Affected Versions pg-aiguide versions prior to 0.5.1 Description The MCP HTTP transport was started without enabling the host allow-list provided by the underlying SDK. Specifically, the httpServer.ts file called the httpServerFactory helper without setting the...

PT-2026-82695

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...

CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

CVE-2026-47856

Spring Integration 's JsonToObjectTransformer deserializes JSON messages by resolving the json__TypeId__ message header to a target class via ClassUtils.forName, with no type or package allow-list to constrain the resolved class. This allows an attacker with low privileges to supply an arbitrary ...

CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104809)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104809 advisory. With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptl...

AlmaLinux 9 : grafana (ALSA-2026:58982)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:58982 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...

PT-2026-82351

Spring Integration's JSON to object conversion uses the json TypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5....

RLSA-2026:58982 Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default...

grafana security, bug fix, and enhancement update

An update is available for grafana. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

RockyLinux 9 : grafana (RLSA-2026:58982)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:58982 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind [CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in jackson-databind CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515. Jackson-databind is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediati...

Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

RHEL 9 : grafana (RHSA-2026:58982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58982 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana:...