4865 matches found
CLSA-2026-1789366696 TuxCare security update for org.apache.commons:commons-configuration2 (2 CVEs)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 2 CVEs. Fixed in 2.8.0-tuxcare.1...
CLSA-2026-1789363246 TuxCare security update for commons-configuration:commons-configuration (2 CVEs)
TuxCare rebuilt commons-configuration:commons-configuration to address 2 CVEs. Fixed in 1.6-tuxcare.1...
CLSA-2026-1789363119 TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.8-tuxcare.1...
CLSA-2026-1789362482 TuxCare security update for commons-collections:commons-collections (1 CVE)
TuxCare rebuilt commons-collections:commons-collections to address 1 CVE. Fixed in 3.1-tuxcare.1...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091341)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091341 advisory. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded...
CLSA-2026-1789225570 TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.6...
CLSA-2026-1789201689 TuxCare security update for commons-configuration:commons-configuration (1 CVE)
TuxCare rebuilt commons-configuration:commons-configuration to address 1 CVE. Fixed in 1.10-tuxcare.2...
@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59148 via @mockoon/commons-server (>=9.0.0, <=9.6.1)
@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: OSV:GHSA-RQX4-3F6Q-3X2V...
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...
GHSA-RQX4-3F6Q-3X2V @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...
@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/serverless (>=9.0.0, <=9.6.1) +2 more potentially affected by CVE-2026-59149 via @mockoon/commons-server (>=9.0.0, <=9.6.1)
@mockoon/commons-server NPM version =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59149 Source advisory: OSV:GHSA-8WQC-V2Q8-VFF2...
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...
GHSA-8WQC-V2Q8-VFF2 @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...
commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...
commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)
Summary Vulnerabilities identified in IBM Cloud Pak for Data System Yosemite 2.0 have been addressed in version 11.3.1.3-IF4 Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...
CLSA-2026-1788757933 TuxCare security update for org.apache.commons:commons-configuration2 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-configuration2 to address 1 CVE. Fixed in 2.11.0-tuxcare.1...
CLSA-2026-1788757927 TuxCare security update for org.apache.commons:commons-lang3 (1 CVE)
TuxCare rebuilt org.apache.commons:commons-lang3 to address 1 CVE. Fixed in 3.15.0-tuxcare.1...