RHSA-2026:54534 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:54520 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:54528 Red Hat Security Advisory: python-pillow security update

Bulletin has no description...

RHSA-2026:54518 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:54487 Red Hat Security Advisory: freerdp security update

Bulletin has no description...

RHSA-2026:54486 Red Hat Security Advisory: freerdp security update

Bulletin has no description...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to specially crafted HTTP requests causing excessive memory allocation when Spring Data Web Support is enabled with a controller method using @ProjectedPayload...

Denial Of Service

Spring Data Commons is vulnerable to Denial Of Service. The vulnerability is due to a StackOverflowException when parsing attacker-controlled Sort parameters, allowing an attacker to exhaust application resources...

Incorrect Authorization

org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...

ejpt-mission-framework-poc

eJPT Mission Framework An evidence-backed Markdown workflow f...

Insecure Trusted-Package Validation

Spring for Apache Pulsar is vulnerable to an insecure trusted-package validation. The vulnerability is due to JsonPulsarHeaderMapper using a prefix-based check for trusted packages and treating an empty trusted-packages configuration as trusting all packages, which allows an attacker to potential...

Open Redirect

Spring Security is vulnerable to Open Redirect. The vulnerability is due to CookieRequestCache and CookieServerRequestCache storing and using an unvalidated absolute URL from a browser cookie as the post-login redirect target, allowing an attacker to redirect users to a malicious destination...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

Deserialization Of Untrusted Data

Spring Security is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to malicious serialized payloads being stored in verificationcredentials or encryptioncredentials by an attacker with write access to the saml2assertingpartymetadata table managed by...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

Unsafe Deserialization

org.springframework.graphql, spring-graphql is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of data when processing paginated GraphQL queries, which allows an attacker to craft a malicious GraphQL request and potentially achieve Remote Code Execution RC...

Denial Of Service

Spring Security is vulnerable to Denial Of Service. The vulnerability is due to an unbounded writer inflating compressed SAML payloads into memory when processing SAML 2.0 Login or Logout requests using the REDIRECT binding, allowing an attacker to exhaust application memory...

Cross Site Scripting

Spring Security is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled values in RelyingPartyRegistration being rendered in HTML forms generated by Spring Security filters, allowing arbitrary code execution in the context of the application...

Deserialization Of Untrusted Data

Spring Statemachine is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Kryo-based persistence backends deserializing persisted state-machine contexts without enforcing a class allowlist, which allows an attacker to provide malicious serialized data and potentially...