CVE-2026-7630

A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote...

CVE-2026-7630

A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote...

CVE-2026-7630: Improper Authentication

A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote...

PT-2026-36620

A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote...

CVE-2026-31770

A flaw was found in the Linux kernel's hwmon subsystem, specifically within the occ driver. During early boot or when no sensor samples have been collected, the occshowpower1 function can attempt to divide by zero. A local attacker could exploit this condition, leading to a kernel crash and a...

CVE-2026-31770 hwmon: (occ) Fix division by zero in occ_show_power_1()

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ Fix division by zero in occshowpower1 In occshowpower1 case 1, the accumulator is divided by updatetag without checking for zero. If no samples have been collected yet e.g. during early boot when the sensor block is...

u-boot:fuzz_efi_load_image: Crash in mbedtls_internal_sha256_process

Detailed Report: https://oss-fuzz.com/testcase?key=4840248550162432 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzefiloadimage Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000020401000 Crash State: mbedtlsinternalsha256process...

Exploit for Acceptance of Extraneous Untrusted Data With Trusted Data in Microsoft

BitUnlocker Downgrade Attack A proof of concept for accessing...

com.consol.citrus:citrus-http (2.2), de.codecentric:jbehave-admin-server (>=0.0.1, <=0.0.2) +78 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (4.0.7.release)

org.springframework:spring-webmvc MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.consol.citrus:citrus-http 2.2 - de.codecentric:jbehave-admin-server =0.0.1, =1.0....

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1744 more potentially affected by CVE-2026-22740 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-22740 Source advisory: GHSA-5843-P793-GHMM...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.1.1, <=0.112.0) +1744 more potentially affected by CVE-2026-22741 via org.springframework:spring-webflux (>=6.1.0, <=6.1.21)

org.springframework:spring-webflux MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.6.0, =0.6.0, =0.5.0, =1.2.0, =1.1.0, =1.3.0 and more Source cves: CVE-2026-22741 Source advisory: OSV:GHSA-WG35-8JPF-2XV3...

cn.bestwu:fastjson (>=1.1-unwrap, <=1.2-unwrap), co.paralleluniverse:comsat-spring-boot (0.6.0) +300 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (4.2.3.release)

org.springframework:spring-webmvc MAVEN version 4.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.bestwu:fastjson =1.1-unwrap, =3.5, =1.2.6, =3.0.0-0, =2.5, =2.5, =2.5, =2.6 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +7026 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (>=6.2.0, <=6.2.17)

org.springframework:spring-webmvc MAVEN version =6.2.0, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.2, =0.0.2, =0.0.2, =0.8.4 and more Source cves: CVE-2026-22741 Source advisory: MEND:CVE-2026-22741...

Arbitrary File Overwrite

org.springframework.boot, spring-boot is vulnerable to arbitrary file overwrite. The vulnerability is due to insecure handling of the PID file via ApplicationPidFileWriter, which allows a local attacker with write access to the PID file location to exploit symlink behavior and overwrite or corrup...

Improper Hostname Verification

Spring Boot is vulnerable to improper hostname verification. The vulnerability is due to missing hostname verification in SSL bundle configuration, which allows an attacker to perform man-in-the-middle attacks by impersonating the RabbitMQ broker...

Default Security Bypass

Spring Boot is vulnerable to Default Security Bypass. The vulnerability is due to Spring Boot's default web security being ineffective, where an application with no Spring Security configuration and relying on the default web security filter chain can allow unauthorized access to all endpoints, a...

Improper Control Of Temporary Directory Access

org.springframework.boot, spring-boot is vulnerable to improper control of temporary directory access. The vulnerability is due to inadequate ownership verification of the ApplicationTemp directory when persistent sessions are enabled, which allows a local attacker to gain control of the director...

Improper SSL Hostname Verification

org.springframework.boot, spring-boot-elasticsearch is vulnerable to improper SSL hostname verification. The vulnerability is due to missing hostname verification in SSL bundle configuration, which allows an attacker to perform man-in-the-middle attacks by connecting to a malicious Elasticsearch...

Weak Random Value Generation For Secrets (weak PRNG)

Spring Boot is vulnerable to the use of a weak pseudo-random number generator PRNG. The vulnerability is due to the use of predictable random value sources e.g., $random.value, $random.int, $random.long, which allows an attacker to guess or brute-force generated secrets and compromise application...

CVE-2026-40977

A flaw was found in Spring Boot when an application is configured to use ApplicationPidFileWriter. A local attacker with write access to the PID file's location can exploit this vulnerability to corrupt one arbitrary file on the host each time the application is started. This can lead to data...