GHSA-GX83-3VF8-GH7J jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

Summary DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" Object, Serializable, Closeable, AutoCloseable,...

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

Summary DefaultBaseTypeLimitingValidator — the PolymorphicTypeValidator used automatically whenever @JsonTypeInfo is applied without an explicitly configured custom validator — denies polymorphic resolution only for nine specific "unsafe base types" Object, Serializable, Closeable, AutoCloseable,...

CVE-2026-98142

A flaw was found in the Linux kernel's Cirrus video driver. This vulnerability can lead to a Denial of Service DoS due to missing validation of the Base Address Register BAR memory size during device initialization. An attacker capable of attaching a crafted PCI device with an undersized memory...

Important: 389-ds-base

Issue Overview: A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and...

Important: gstreamer1-plugins-base

Issue Overview: A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an...

Important: 389-ds-base

Issue Overview: A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the...

ROS-20260928-73-0111

The vulnerability of the topologyparsecpucapacity function in the drivers/base/archtopology.c file of the Linux kernel is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a system failure...

Important: resteasy-base

Issue Overview: A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts...

Important: 389-ds-base

Issue Overview: A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching...

CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-100861

The software heym (versions before 0.0.105 ) is vulnerable to a Server-Side Request Forgery (SSRF) due to a failure in applying egress guards to integration services. The root cause is that the application allows credential-supplied base URLs to bypass SSRF protections. This allows authenticated ...

EUVD-2026-87826

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

CVE-2026-100861 heym before 0.0.105 SSRF via credential-controlled base URLs

heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service...

[SECURITY] Fedora 44 Update: mingw-gstreamer1-plugins-base-1.28.7-1.fc44

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

[SECURITY] Fedora 45 Update: mingw-gstreamer1-plugins-base-1.28.7-1.fc45

GStreamer is a streaming media framework, based on graphs of filters which operate on media data. Applications using this library can do anything from real-time sound processing to playing videos, and just about anything else media-related. Its plugin-based architecture means that new data types ...

PT-2026-99481

Name of the Vulnerable Software and Affected Versions heym versions prior to 0.0.105 Description Authenticated users can bypass Server-Side Request Forgery SSRF protections—a flaw where an attacker induces a server to make requests to an unintended location—due to a failure in applying egress...

Malicious Package

Overview eslint-config-compact-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

5G-Shark Lures Phones to Rogue 5G Cells Without Network Jamming

Researchers have developed 5G-Shark to lure phones onto rogue base stations, collect subscriber IDs, force network downgrades and…...

CVE-2026-84463

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...