CVE-2026-25808: Missing Authorization

Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is...

io.debezium:debezium-quarkus-outbox-reactive (>=2.2.0.alpha2, <=2.2.0.beta1), io.debezium:debezium-quarkus-outbox-reactive-deployment (>=2.2.0.alpha2, <=2.2.0.beta1) +13 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (1.1.9.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.debezium:debezium-quarkus-outbox-reactive =2.2.0.alpha2,...

io.debezium:debezium-quarkus-outbox-reactive (2.4.0.alpha1), io.debezium:debezium-quarkus-outbox-reactive-deployment (2.4.0.alpha1) +17 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.0.1.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.debezium:debezium-quarkus-outbox-reactive 2.4.0.alpha1 -...

io.debezium:debezium-quarkus-outbox-reactive (>=2.6.0.alpha2, <=2.6.0.beta1), io.debezium:debezium-quarkus-outbox-reactive-deployment (>=2.6.0.alpha2, <=2.6.0.beta1) +16 more potentially affected by CVE-2025-14969 via org.hibernate.reactive:hibernate-reactive-core (2.2.1.final)

org.hibernate.reactive:hibernate-reactive-core MAVEN version 2.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate.reactive:hibernate-reactive-core and may be impacted: - io.debezium:debezium-quarkus-outbox-reactive =2.6.0.alpha2,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989700 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: break out if skbheaderpointer returns NULL in sctprcvootb We should always check if...

Hackers Exploit Milesight Routers to Send Phishing SMS to European Users

Unknown threat actors are abusing Milesight industrial cellular routers to send SMS messages as part of a smishing campaign targeting users in European countries since at least February 2022. French cybersecurity company SEKOIA said the attackers are exploiting the cellular router's API to send...

CVE-2020-14031

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folder. Because the product usually runs as NT AUTHORITY\SYSTEM, the only files that will not be deleted are those currently being run by the...

This Week in Spring - July 2nd, 2024

Hi, spring fans! Welcome to another amazing installment of This Week in Spring! In last week's installment of A Bootiful Podcast, recorded a few weeks ago at Spring IO, I talked with Spring Security legend Laur Spilca In last week's installment of Spring Tips, I looked at a number of ways you cou...

CVE-2024-1251: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETESTR leads to sql injection. The exploit has been disclosed to the public and may be used...

PT-2024-17634 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.10 Description: A critical vulnerability has been found in Tongda OA. The issue affects an unknown function of the file /general/email/outbox/delete.php. The manipulation of the DELETE STR argument leads to SQ...

A Use Case for Transactions: Outbox Pattern Strategies in Spring Cloud Stream Kafka Binder

Other parts in this blog series Part 1: Introduction to Transactions in Spring Cloud Stream Kafka Applications Part 2: Producer Initiated Transactions in Spring Cloud Stream Kafka Applications Part 3: Synchronizing with External Transaction Managers in Spring Cloud Stream Kafka Applications Part ...

Introducing Microservices Patterns with Spring Integration

Hey Spring Community! I hope you are enjoying Spring One Essentials these days. The most exciting feature for me is an Observability which is spread throughout the Spring portfolio from now on. Nevertheless, today Id like to share with a project Im working on since holidays, where the mentioned...

Introducing Microservices Patterns with Spring Integration

Hey Spring Community! I hope you are enjoying Spring One Essentials these days. The most exciting feature for me is an Observability which is spread throughout the Spring portfolio from now on. Nevertheless, today I’d like to share with a project I’m working on since holidays, where the mentioned...

Introducing Microservices Patterns with Spring Integration

Hey Spring Community! I hope you are enjoying Spring One Essentials these days. The most exciting feature for me is an Observability which is spread throughout the Spring portfolio from now on. Nevertheless, today I’d like to share with a project I’m working on since holidays, where the mentioned...

CVE-2020-18475

Cross Site Scripting XSS vulnerabilty exists in Hucart CMS 5.7.4 is via the mestitle field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email, the malicious code will be executed...

Hucart CMS Cross-Site Scripting Vulnerabilities

HuCart HuCart is an open source enterprise website building system. a cross-site scripting vulnerability exists in the mestitle field of HuCartCMS version 5.7.4. An attacker can exploit the vulnerability by inserting a malicious script into the title field of the outbox to execute malicious code...

PT-2021-10187

Name of the Vulnerable Software and Affected Versions: Hucart CMS version 5.7.4 Description: A Cross Site Scripting XSS issue exists via the mes title field. An attacker can insert a malicious script into the header field of the outbox and send it to other users. When other users open the email,...

CVE-2020-18475: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerabilty exists in Hucart CMS 5.7.4 is via the mestitle field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email, the malicious code will be executed...

Ozeki NG SMS Gateway Arbitrary File Deletion Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. An arbitrary file deletion vulnerability exists in the Outbox feature of the TXT File module in Ozeki NG SMS Gateway 4.17.6 and earlier versions. An attacker can exploit this vulnerability to delete all/most files ...

CVE-2020-14031

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folder. Because the product usually runs as NT AUTHORITY\SYSTEM, the only files that will not be deleted are those currently being run by the...