5352 matches found
CLSA-2026-1789201689 TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2...
PT-2026-96696
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2...
PT-2026-96882
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.6...
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...
@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59148 via @mockoon/commons-server (>=9.0.0, <=9.6.1)
@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: OSV:GHSA-RQX4-3F6Q-3X2V...
GHSA-RQX4-3F6Q-3X2V @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...
@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59149 via @mockoon/commons-server (>=9.0.0, <=9.6.1)
@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59149 Source advisory: OSV:GHSA-8WQC-V2Q8-VFF2...
GHSA-8WQC-V2Q8-VFF2 @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...
commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...
commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)
Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF4 Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...
CLSA-2026-1788757933 TuxCare security update for org.apache.commons:commons-configuration2 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.11.0-tuxcare.1...
CLSA-2026-1788757927 TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.15.0-tuxcare.1...
CLSA-2026-1788757915 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)
TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1...
CLSA-2026-1788757862 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)
TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1...
CLSA-2026-1788757840 TuxCare security update for commons-io:commons-io (1 CVE)
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.0.1-tuxcare.1...
PT-2026-94211
TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.10.0-tuxcare.1...