Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via XAML parsing in Windows Presentation Foundation WPF. An attacker can execute arbitrary code by supplying specially crafted XAML input that is processed by a vulnerable WPF application. Successful...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SslStream implementation. An attacker can bypass authorization checks during TLS/SSL communication by exploiting flaws in the processing of secure connections. This may allow access to protected...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via TLS handshake processing. An attacker can cause a denial of service by sending malformed TLS handshake messages that trigger excessive resource consumption or cause the application to...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.0.0.beta.ee-20220401222842, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +8 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=5.6.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.6.2, =11.0.0.beta.ee-20220401222842, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.0, =5.26.0, =0.6.4-b, =0.7.0 - zone.cogni.lib.security:security 1.2.5 Source cves: CVE-2026-41694 Source advisory:...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41003 Source advisory: OSV:GHSA-3PJJ-QPW6-5FCM...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.0.0.beta.ee-20220401222842, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +8 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=5.6.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.6.2, =11.0.0.beta.ee-20220401222842, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.0, =5.26.0, =0.6.4-b, =0.7.0 - zone.cogni.lib.security:security 1.2.5 Source cves: CVE-2026-41003 Source advisory:...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41003 Source advisory: GHSA-3PJJ-QPW6-5FCM...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-40988 Source advisory: OSV:GHSA-M69X-PW9P-7J3Q...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41694 Source advisory: GHSA-WW38-37G9-M3Q3...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41003 Source advisory:...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.1.0, <=11.2.6.ee), io.spinnaker.gate:gate-api-tck (>=6.63.0, <=6.69.0) +7 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=5.7.2, <=5.7.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.7.2, =11.1.0, =6.63.0, =6.63.0, =6.63.0, =1.17.0, =1.17.0, =5.26.1, =5.26.1, =5.26.3 - zone.cogni.asquare:security2 0.7.0 Source cves: CVE-2026-41003 Source advisory: MEND:CVE-2026-41003...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=12.1.1), cc.zzzyu.nacos:default-auth-plugin (3.1.1) +134 more potentially affected by CVE-2026-41720 via org.springframework.ldap:spring-ldap-core (>=3.2.0, <=3.2.16)

org.springframework.ldap:spring-ldap-core MAVEN version =3.2.0, =1.0.0.ee-20260424025040, =0.0.13, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.11.5 and more Source cves: CVE-2026-41720 Source advisory: GHSA-JRV5-8W28-4265...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper validation of user-supplied input in the authentication process. An attacker can gain elevated privileges by providing crafted input during local interaction. Remediation Upgrade...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling via the interpretation of...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.win-x86 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code execution...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling...

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...