justhtml has sanitization bypass in custom policies and programmatic DOM

Summary justhtml 1.17.0 fixes multiple security issues in sanitization, serialization, and programmatic DOM handling. Most of these issues affected advanced or custom configurations rather than the default safe path. Affected versions - justhtml , MathML , SVG / , and MathML text integration poin...

CVE-2026-41455

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network...

CVE-2026-41454

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new...

CVE-2026-41454 WeKan < 8.35 Missing Authorization via Integration REST API

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new...

CVE-2026-41454

CVE-2026-41454 affects WeKan

CVE-2026-41454 WeKan < 8.35 Missing Authorization via Integration REST API

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new...

CVE-2026-41454 WeKan < 8.35 Missing Authorization via Integration REST API

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new...

CVE-2026-41454

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new...

CVE-2026-25542

A flaw was found in Tekton Pipelines. An attacker can bypass trusted resource verification policies by crafting a malicious source string that contains a trusted pattern as a substring. This is due to the regexp.MatchString function in Go matching patterns anywhere within a string, rather than...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the POST /api/lunchflow/link endpoint, which insufficiently validates user-supplied URLs and fails to restrict access to internal or sensitive network addresses. An attacker can cause the server to...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the POST /api/lunchflow/link endpoint, which insufficiently validates user-supplied URLs and fails to restrict access to internal or sensitive network addresses. An attacker can cause the server to...

K2view vs Broadcom For Test Data Management

Compare Broadcom TDM and K2view across architecture, integration, masking, and scalability to find the right test data management solution for your needs...

org.apache.camel.kafkaconnector:camel-infinispan-kafka-connector (0.9.0), org.apache.camel.quarkus:camel-quarkus-infinispan (>=1.8.0, <=1.8.1) +3 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.9.0)

org.apache.camel:camel-infinispan MAVEN version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.kafkaconnector:camel-infinispan-kafka-connector 0.9.0 -...

org.apache.camel.quarkus:camel-quarkus-infinispan (2.3.0), org.apache.camel.quarkus:camel-quarkus-infinispan-deployment (2.3.0) +2 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.11.2)

org.apache.camel:camel-infinispan MAVEN version 3.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.quarkus:camel-quarkus-infinispan 2.3.0 -...

org.apache.camel.quarkus:camel-quarkus-infinispan (2.7.1), org.apache.camel.quarkus:camel-quarkus-infinispan-deployment (2.7.1) +2 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.14.2)

org.apache.camel:camel-infinispan MAVEN version 3.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.quarkus:camel-quarkus-infinispan 2.7.1 -...

org.apache.camel.quarkus:camel-quarkus-infinispan (2.10.0), org.apache.camel.quarkus:camel-quarkus-infinispan-deployment (2.10.0) +3 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.17.0)

org.apache.camel:camel-infinispan MAVEN version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.quarkus:camel-quarkus-infinispan 2.10.0 -...

org.apache.camel.quarkus:camel-quarkus-infinispan (2.11.0), org.apache.camel.quarkus:camel-quarkus-infinispan-deployment (2.11.0) +2 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.18.0)

org.apache.camel:camel-infinispan MAVEN version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.quarkus:camel-quarkus-infinispan 2.11.0 -...

org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector (3.18.1), org.apache.camel.kafkaconnector:camel-infinispan-source-kafka-connector (3.18.1) +4 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.18.1)

org.apache.camel:camel-infinispan MAVEN version 3.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.kafkaconnector:camel-infinispan-sink-kafka-connector 3.18.1 -...

org.apache.camel.kafkaconnector:camel-infinispan-kafka-connector (0.7.0), org.apache.camel.quarkus:camel-quarkus-infinispan (>=1.5.0, <=1.6.0) +3 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.7.0)

org.apache.camel:camel-infinispan MAVEN version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.kafkaconnector:camel-infinispan-kafka-connector 0.7.0 -...

org.apache.camel.quarkus:camel-quarkus-infinispan (>=0.3.0, <=0.4.0), org.apache.camel.quarkus:camel-quarkus-infinispan-deployment (>=0.3.0, <=0.4.0) +2 more potentially affected by CVE-2026-6857 via org.apache.camel:camel-infinispan (3.0.0-rc3)

org.apache.camel:camel-infinispan MAVEN version 3.0.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-infinispan and may be impacted: - org.apache.camel.quarkus:camel-quarkus-infinispan =0.3.0, =0.3.0, =0.3.0, =0.4.0 -...