5971 matches found
CVE-2026-44825
A flaw was found in Apache Solr. Hardcoded credentials in the Basic Authentication setup tool allow a remote attacker to gain full administrative access to the cluster. This occurs when the bin/solr auth enable tool is used, as publicly known default credentials are silently installed alongside...
CVE-2026-40994
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
CVE-2026-40994
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
UBUNTU-CVE-2026-40994
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
CVE-2026-40994 Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
CVE-2026-40994
Summary: CVE-2026-40994 affects Spring Web Services where Wss4jSecurityInterceptor initializes its BSP flag to disable BSP enforcement on inbound data, weakening protocol-level WS-Security checks. Affected versions: Spring Web Services 5.0.0–5.0.1; 4.1.0–4.1.3; 4.0.0–4.0.18; 3.1.0–3.1.8. Impact (...
EUVD-2026-36204
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
CVE-2026-40994 Wss4jSecurityInterceptor disables WS-I BSP validation by default
Wss4jSecurityInterceptor initialized its BSP WS-I Basic Security Profile compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level...
Exploit for CVE-2026-28699
CVE-2026-28699 — Gitea OAuth2 Scope Bypass via HTTP Basic Auth...
PT-2026-48617
Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8 Description The Wss4jSecurityInterceptor...
net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.577)
org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...
net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.577)
org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...
net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.577)
org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...
com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.568)
org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...
CLDAP Analyzer with ASN.1 BER Encoding and Basic TLV Response Parser
This Python script implements a CLDAP Connectionless LDAP analyzer that builds and sends LDAP CLDAP discovery requests and parses responses using ASN.1 BER encoding and a basic TLV parser. It constructs a structured LDAP search request including DnsDomain, User, and NtVer filters, sends it over U...
cve-2026-40994 - HIGH - Wss4jSecurityInterceptor disables WS-I BSP validation by default
cve-2026-40994 - HIGH - Wss4jSecurityInterceptor disables WS-I BSP validation by default...
CVE-2026-46440
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2...
CVE-2026-11788 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure...
CVE-2026-34033: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML int...
EUVD-2026-35107
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2...