9093 matches found
EUVD-2026-67138
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...
CVE-2026-80212
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...
CVE-2026-80212
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey, encountered...
CVE-2026-80212
CVE-2026-80212 is a memory exhaustion vulnerability in the resolv gem before 0.7.2 for Ruby. The root cause is that Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create permanently register a new class for every unknown DNS resource rec...
CVE-2026-47878 Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...
CVE-2026-47856
Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...
PT-2026-83118
Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An unsafe dynamic class loading issue exists in the database connection utilities. The application instantiates database driver classes based o...
PT-2026-83117
Name of the Vulnerable Software and Affected Versions PaperCut MF affected versions not specified PaperCut NG affected versions not specified Description An improper access control issue exists in the web management interface. Under specific conditions, unauthenticated remote requests targeting...
USN-8682-1 bind9 vulnerabilities
Vitaly Simonovich discovered that Bind could exhaust memory during GSS-API TKEY negotiation. A remote attacker could possibly use this issue to cause Bind to use excessive resources, leading to a denial of service. CVE-2026-3039 Shuhan Zhang discovered that Bind incorrectly handled self-pointed...
CVE-2026-54614
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className to constructor...
Security Bulletin: Security vulnerability affects IBM® SDK, Java™ Technology Edition (CVE-2026-16440)
Summary Security vulnerability has been addressed in IBM® SDK, Java™ Technology Edition. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault. CWE:CWE-674: Uncontrolled...
PT-2026-82119
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read occurs in the tc cls bind class function. This happens because u32 bind class unconditionally casts a passed fh to tc u knode and accesses &n-res. When fh is...
IBM Java 7.1 < 7.1.5.31 / 8.0 < 8.0.8.70
The version of IBM Java installed on the remote host is 7.1 prior to 7.1.5.31 / 8.0 prior to 8.0.8.70. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2026 advisory. - In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098825)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098825 advisory. In the Linux kernel, the following vulnerability has been resolved: netsched: Prevent creation of classes with TCHROOT The function qdisctreereducebacklog uses TCHRO...
PT-2026-82211
Name of the Vulnerable Software and Affected Versions DebugKit versions prior to 4.10.3 DebugKit versions prior to 5.2.4 Description The MailPreview feature in src/Controller/MailPreviewController.php fails to properly validate the previewName value in the findPreview function. The application...
Security Bulletin: Vulnerability in Java affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in Java has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...
CVE-2026-79784
Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...
EUVD-2026-65542
Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...
CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...
