CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

EUVD-2026-70002

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166

Drupal Digital Signage Framework (contrib module) is affected by a missing authorization flaw in a route intended for signage devices to refresh dynamic blocks. The route failed to verify that the requester was an authorized signage device or that the requested block was one the module delivers t...

CLSA-2026-1788349534 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.27-tuxcare.9...

CLSA-2026-1788346056 TuxCare security update for org.springframework (23 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 23 CVEs. Fixed in 6.0.11-tuxcare.1...

CLSA-2026-1788344824 TuxCare security update for org.springframework (27 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 27 CVEs. Fixed in 6.0.13-tuxcare.1...

CLSA-2026-1788342506 TuxCare security update for org.springframework (11 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 11 CVEs. Fixed in 6.0.16-tuxcare.6...

CLSA-2026-1788341776 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 14 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.4...

CLSA-2026-1788340622 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.30-tuxcare.9...

CVE-2026-81166: Missing Authorization

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...

Security Bulletin: Multiple security vulnerabilities in .NET affect IBM Robotic Process Automation

Summary Multiple security vulnerabilities in .NET affect IBM Robotic Process Automation. .NET is used by IBM Robotic Process as part of it's development framework. This security bulletin identifies the fixes required to resolve these vulnerabilities Vulnerability Details CVEID:CVE-2026-41319...

CVE-2026-73229

creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:03+00:00| published-proof-of-concept| https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the setcookie method when...

EUVD-2026-56887

Django REST framework: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data...

Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...