GHSA-33VJ-92QQ-66HC containerd CRI checkpoint restore CDI annotation smuggling

Impact containerd's CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive...

containerd CRI checkpoint restore CDI annotation smuggling

Impact containerd's CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive...

CNnotator: LLM-Guided Memory Safety Annotation Synthesis

Memory safety errors account for a large proportion of security bugs in systems written in C; modern languages such as Java and Rust prevent such bugs because they are memory-safe by design. To migrate systems to safer languages or identify memory errors, we must first determine how legacy code...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

Tool Calling in Spring AI 2.0: A Composable, Agentic Architecture

Tool calling — the ability for an AI model to invoke application-defined functions and act on the results — is the essential building block of agentic AI systems. A model that can discover information, take action, and loop until a goal is reached is an agent. Spring AI 2.0 rearchitects tool...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the deserialization process of user-controlled data from the radapp.io/status annotation on a Kubernetes Deployment. An attacker can cause deletion of container resources belonging t...

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation Multi-Tenant Installs Summary A configuration-validation issue in the Radius Kubernetes controller can cause it to issue a DELETE for the container resource referenced by a tampered radapp.io/status annotation...

GHSA-FP5J-4FJ2-4JVQ Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation Multi-Tenant Installs Summary A configuration-validation issue in the Radius Kubernetes controller can cause it to issue a DELETE for the container resource referenced by a tampered radapp.io/status annotation...

PT-2026-49062

Name of the Vulnerable Software and Affected Versions Radius versions 0.57.1 and earlier Description A configuration-validation issue in the Radius Kubernetes controller allows for a Confused Deputy attack. The controller deserializes JSON data from the radapp.io/status annotation on Kubernetes...

GHSA-PHXQ-526M-79PX Spring for GraphQL: Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

Spring for GraphQL: Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

SUSE-SU-2026:2365-1 Security update for cosign

This update for cosign fixes the following issue - CVE-2026-39395: Incorrect attestation verification due to malformed payloads or mismatched predicate types bsc1261859. Changes for cosign: - update to 3.0.6: Fix DSSE predicate check GHSA-w6c6-c85g-mmv6 4801 Handle whitespace-only certificate...

CVE-2026-41856

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

CVE-2026-41856

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

CVE-2026-41856 Spring GraphQL Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

EUVD-2026-36214

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

CVE-2026-41856 Spring GraphQL Annotation Detection Vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...