PT-2026-108597

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

PT-2026-108440

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

PT-2026-108580

Security vulnerability affects the apache-hive package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

PT-2026-108522

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

PT-2026-108422

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CVE-2026-59313

A flaw was found in the Spring MVC functional web framework. This vulnerability allows for stream corruption when applications use Server-Sent Events SSE, a technology for pushing real-time updates from a server to a client. This could lead to unreliable data delivery and impact the integrity of...

CVE-2026-41841

A flaw was found in Spring MVC and WebFlux applications. A remote attacker could exploit this vulnerability by sending specially crafted requests when the application resolves static resources. This could lead to information disclosure, allowing the attacker to gain unauthorized access to sensiti...

CVE-2026-59281

A flaw was found in Spring MVC and WebFlux applications. When these applications are configured to obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, they become vulnerable...

com.gitee.jmash:jmash-mvc (>=0.0.2, <=1.0.2) potentially affected by CVE-2026-77762 via org.apache.tomcat.experimental:tomcat-embed-programmatic (>=10.1.16, <=10.1.39)

org.apache.tomcat.experimental:tomcat-embed-programmatic MAVEN version =10.1.16, =0.0.2, =1.0.2 Source cves: CVE-2026-77762 Source advisory: MEND:CVE-2026-77762...

com.gitee.jmash:jmash-mvc (>=0.0.2, <=1.0.2) potentially affected by CVE-2026-77756 via org.apache.tomcat.experimental:tomcat-embed-programmatic (>=10.1.16, <=10.1.39)

org.apache.tomcat.experimental:tomcat-embed-programmatic MAVEN version =10.1.16, =0.0.2, =1.0.2 Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

com.gitee.jmash:jmash-mvc (>=0.0.2, <=1.0.2) potentially affected by CVE-2026-75973 via org.apache.tomcat.experimental:tomcat-embed-programmatic (>=10.1.16, <=10.1.39)

org.apache.tomcat.experimental:tomcat-embed-programmatic MAVEN version =10.1.16, =0.0.2, =1.0.2 Source cves: CVE-2026-75973 Source advisory: MEND:CVE-2026-75973...

CVE-2026-47884

A flaw was found in the XsltView component of Spring MVC applications. This vulnerability could allow a remote, unauthenticated attacker to perform Server-Side Request Forgery SSRF, enabling them to make unauthorized requests from the server, and potentially achieve Remote Code Execution RCE,...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

CVE-2026-80515

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

CVE-2026-80515: Use of Non-Canonical URL Paths for Authorization Decisions

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL.toString.contains"/mgmt/". Tomcat returns getRequestURL un-decoded, while Spring MVC's...

Malicious code in bem-mvc-direct (npm)

--- Credit: OpenSSF source...

Malicious Package

Overview bem-mvc-direct is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Linux Distros Unpatched Vulnerability : CVE-2026-47884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an / mapping that results in view rendering, and where the...

Linux Distros Unpatched Vulnerability : CVE-2026-47883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both...

GHSA-X7RJ-F32V-7JJG Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...