MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

EUVD-2026-68018

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-55425

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

Malicious code in 3layerdipstacko8li9w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9886025a6437b781a80821d6f113c08dea138ee45899438c19bf9e7cf3e366c5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14861 Malicious code in 3layerdipstackoms1fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c97713fb02abd28ed8ae39bdff7b71df1f21f6e8f835baf5f074bbe05984808 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackihi1o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f7a901824681511a2e113ac8f970984a35b6e042d971695d8933f0a44f58442 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14749 Malicious code in 3layerdipstackfdgka0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b1e8e507446d2e1921511d47721fa25899b90432339713bbaac218908d68b8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14602 Malicious code in 3layerdipstack1g5cxo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed95dd89d1a5daf491b1350b3cd65fb73e19a50ef66848b5a86ffdba77ba6205 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14944 Malicious code in 3layerdipstackuew4bh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f693f3775d167495f7080e39f299df6fb4cc1e282f79718d712fcca91076e82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-83371

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.28.30 mapfish-print versions prior to 3.30.32 mapfish-print versions prior to 3.31.24 mapfish-print versions prior to 3.33.16 mapfish-print versions prior to 4.0.5 Description MapFish Print fails to disable...

EUVD-2026-67198

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2022-50998

A flaw was found in Nokogiri, a Ruby gem for parsing XML and HTML documents. This vulnerability arises from issues within its bundled libxml2 library, specifically involving data corruption from entity reference cycles and integer overflows when processing large XML files. A remote attacker could...

assertj-core security update

An update is available for assertj-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A rich and intuitive set of strongly-typed assertions to use for unit...

OPENSUSE-SU-2026:21665-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

EUVD-2026-66840

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

DRUPAL-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

DRUPAL-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...