EUVD-2026-52894

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

CVE-2026-70554

CVE-2026-70554 affects MaxSite CMS. It describes an unauthenticated PHP object injection via the maxsite_comuser cookie, where unvalidated serialized data is passed directly to unserialize(), allowing an attacker to reconstruct object graphs and trigger magic methods. This can enable property-ori...

PYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Summary When resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

SummaryWhen resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents...

CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

UBUNTU-CVE-2026-69249

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same...

Sensitive Information Exposure

Spring Data REST is vulnerable to Sensitive Information Exposure. The vulnerability is due to serialization of the full exception cause chain in HTTP error responses, allowing attackers to obtain persistence-layer implementation details and other internal application information through error...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

CLEANSTART-2026-IA15090 Security fixes in tekton-chains 0.26.0-r0

Package tekton-chains version 0.26.0-r0 fixes 3 vulnerabilities: ghsa-72c7-4g63-hpw5, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-NP82781 Security fixes in tekton-chains-fips 0.26.0-r1

Package tekton-chains-fips version 0.26.0-r1 fixes 9 vulnerabilities: ghsa-4qg8-fj49-pxjh, ghsa-whqx-f9j3-ch6m, ghsa-846p-jg2w-w324, ghsa-fphv-w9fq-2525, ghsa-59jp-pj84-45mr...

CLEANSTART-2026-PK71881 Security fixes in tekton-chains 0.26.0-r1

Package tekton-chains version 0.26.0-r1 fixes 5 vulnerabilities: ghsa-4qg8-fj49-pxjh, ghsa-whqx-f9j3-ch6m, ghsa-846p-jg2w-w324, ghsa-fphv-w9fq-2525, ghsa-59jp-pj84-45mr...

CLEANSTART-2026-DH93836 Security fixes in tekton-chains-fips 0.26.0-r3

Package tekton-chains-fips version 0.26.0-r3 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-YY20637 Security fixes in tekton-chains-fips 0.26.0-r0

Package tekton-chains-fips version 0.26.0-r0 fixes 4 vulnerabilities: ghsa-72c7-4g63-hpw5, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, CVE-2025-61729...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59933 PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

Erlang/OTP -- denial of service via exponential certificate policy tree growth

https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352 reports: A remote attacker can trigger a denial of service through TLS certificate handling. By sending a specially crafted certificate chain with multiple certificate policies at each level, the policy tree expands exponential...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2025-66471: excessive resource consumption via decompression of highly compressed data in Streaming API bsc1254867. CVE-2025-66418: resource exhaustion via unbounded number of links in the decompression chain bsc1254866. Patch...

Apache Tomcat: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing

A flaw was found in Apache Tomcat's rewrite valve. This vulnerability involves an incorrect control flow implementation where, during the processing of rewrite rules, if the first condition in an OR chain matched, subsequent non-OR conditions were unexpectedly skipped. This can lead to unintended...

An Automated Framework for Extracting Reachable Attack Chains from Cyber Threat Intelligence Reports

Cyber Threat Intelligence CTI reports richly describe real-world attack processes, but their unstructured narratives cannot be directly used for automated attack-path reasoning. Existing CTI extraction methods focus on indicators, entities, or TTP labels without modeling the execution conditions...