GHSA-8WQC-V2Q8-VFF2 @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)

Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF4 Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...

CLSA-2026-1788757933 TuxCare security update for org.apache.commons:commons-configuration2 (1 CVE)

TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.11.0-tuxcare.1...

CLSA-2026-1788757927 TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.15.0-tuxcare.1...

CLSA-2026-1788757915 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1...

CLSA-2026-1788757862 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1...

CLSA-2026-1788757840 TuxCare security update for commons-io:commons-io (1 CVE)

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.0.1-tuxcare.1...

PT-2026-94211

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1...

PT-2026-94207

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1...

PT-2026-94206

TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.0.1-tuxcare.1...

PT-2026-94212

TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.15.0-tuxcare.1...

Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Recursion (CVE-2026-45205)

Summary There are vulnerabilities in commons-configuration2-2.10.1.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-45205. The vulnerability has/vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in...

Security Bulletin: Due to the use of mchange-commons-java, IBM webMethods BPM is vulnerable to Unsafe Reflection ( CVE-2026-55153 )

Summary IBM webMethods BPM includes the standalone utility which includes the vulnerable component mchange-commons-java. The tool operates as a standalone utility and is not part of the main runtime environments. Vulnerability Details CVEID:CVE-2026-55153 DESCRIPTION: mchange-commons-java is a Ja...

CLSA-2026-1788420664 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.5...

PT-2026-90810

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.5...

CLSA-2026-1788348838 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 2.7.18-tuxcare.8...

CLSA-2026-1788331098 TuxCare security update for org.apache.commons:commons-compress (1 CVE)

TuxCare rebuilt org.apache.commons:commons-compress to address 1 CVE. Fixed in 1.14-tuxcare.2...

Security Bulletin: Vulnerability in commons-configuration2 impacts IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent is affected by Uncontrolled recursion vulnerability in Apache Commons CVE-2026-45205 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. Wh...