379 matches found
PT-2026-70119
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without...
CVE-2026-72692
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...
CVE-2026-72692 OpenSignLabs opensignserver - Missing Authorization
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...
CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
EUVD-2026-55531
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
CVE-2026-72689 OpenSignLabs opensignserver - Broken Object Level Authorization
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...
CVE-2026-72689 OpenSignLabs opensignserver - Broken Object Level Authorization
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...
CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
PT-2026-69829
Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1 Description A missing authentication issue allows an unauthenticated remote attacker to read arbitrary stored documents. This occurs via the fileupload Parse cloud function, which generates file access...
CVE-2026-72688: Missing Authentication for Critical Function
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...
CVE-2026-72692: Missing Authorization
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes...
CVE-2026-72691: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...
PT-2026-69833
Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1 Description A missing authorization issue allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user. This is possible...
CVE-2026-40990
A flaw was found in Spring Cloud Function. A local attacker with low privileges could exploit this vulnerability by repeatedly adding functions to the Function Registry, leading to an Out Of Memory OOM error. This resource exhaustion can cause a Denial of Service DoS for the affected application...
CVE-2026-40989
A flaw was found in Spring Cloud Function. An attacker could send a specially crafted request that triggers infinite recursion in the routing layer. This can lead to an Out Of Memory OOM error, causing a Denial of Service DoS condition where the application becomes unresponsive...
Denial Of Service (DoS)
Spring Cloud Function is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient restrictions on function registration within the Function Registry, allowing an attacker to register an unbounded number of functions and trigger excessive memory consumption, potentially...
ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)
org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40989 Source advisory:...
ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +356 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)
org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...