44687 matches found
Astro - Broken Access Control
Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. id: CVE-2025-64525...
Denial Of Service (DoS)
Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...
CLEANSTART-2026-XP70950 Hono is a Web application framework that provides support for any JavaScript runtime
Multiple security vulnerabilities affect the langfuse package. Hono is a Web application framework that provides support for any JavaScript runtime. See references for individual vulnerability details...
raptor v3.1.0
╔═══════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ██████╗ █████╗ ██████╗ ████████╗ ██████╗ ██████╗ ║ ║ ██╔══██╗██╔══██╗██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ║ ║ ██████╔╝███████║██████╔╝ ██║ ██║ ██║██████╔╝ ║ ║ ██╔══██╗██╔══██║██╔═══╝ ██║ ██║ ██║██╔══██╗ ║ ║ ██║ ██║█...
CLEANSTART-2026-SU61748 Netty is an asynchronous, event-driven network application framework
Multiple security vulnerabilities affect the solr package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...
PT-2026-88515
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...
NERVE Attacks: Breaking AI-Powered Brain-Computer Interfaces
The rapid integration of AI into human-centred systems such as Brain-Computer Interfaces BCIs has created a poorly understood attack surface linking neural signals to physical systems. Exploits in this domain threaten cognitive autonomy, mental privacy, and physical safety, from neural data...
PT-2026-87166
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An incorrect authorization issue exists within the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that tricks...
Navigating the Latent Manifold: Proactive Concept Drift Adaptation for Resilient NIDS
Network intrusion detection systems NIDS are critical for cybersecurity, safeguarding services and data from potential attacks. However, existing AI-based NIDS often assume static data distributions and fail to handle concept drift, leading to degraded performance and increased false positives in...
PT-2026-88522
The following issues are included in Project Mainline components. Subcomponent CVE ART CVE-2026-28664 Media Framework components CVE-2026-28609, CVE-2026-45527 Documents UI CVE-2026-28636 Media Codecs CVE-2026-28618, CVE-2026-55294 Media Provider CVE-2026-28622, CVE-2026-28638, CVE-2026-28671,...
CVE-2026-53639: Authorization Bypass Through User-Controlled Key
Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...
PT-2026-88514
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...
CVE-2026-82073: Incorrect Authorization
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...
CVE-2026-82074: Incorrect Authorization
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...
PT-2026-87165
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A security issue in the aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks. This occurs when Atlas Search feature...
CLSA-2026-1788813738 TuxCare security update for org.springframework (8 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 8 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.5...
CLSA-2026-1788807216 TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 11 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.5...
CLSA-2026-1788804848 TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 22 org.springframework packages to address 14 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.6...