com.foilen:database-tools (0.4.4), org.nhind:config-service-jar (>=7.0, <=7.0.1) +3 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.4.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - com.foilen:database-tools 0.4.4 -...

cn.guomw.cloud:framework-cloud-starter-web (>=1.0.0.release, <=1.1.0.1.btxc.release), org.nhind:config-service-jar (7.0.2) +3 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (1.1.9.release)

org.springframework.data:spring-data-relational MAVEN version 1.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-relational and may be impacted: - cn.guomw.cloud:framework-cloud-starter-web =1.0.0.release...

PT-2026-48600

Name of the Vulnerable Software and Affected Versions PDM versions prior to 2.28.0-1.1 Description PDM writes project-local state and configuration files without symlink protection, allowing a malicious repository to use symlinks to overwrite files outside the repository root. This creates an...

EulerOS 2.0 SP13 : systemd (EulerOS-SA-2026-2315)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.CVE-2026-40226 A flaw was...

Jenkins LTS < 2.555.3 / Jenkins weekly < 2.568 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.555.3 or Jenkins weekly prior to 2.568. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.483 through 2.567 both inclusive, LTS 2.492.1 through...

PT-2026-48442

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.systemf"dos2unix -q cfg". configver is not run...

PT-2026-48516

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX12 v1 TP-Link Archer AX17 v1 TP-Link Archer AX18 v1 TP-Link Archer AX1300 v1.6 Description An OS command injection issue exists in the VPN module. This occurs due to improper filtering of special characters, allowing an...

CVE-2026-45569: Improper Limitation of a Pathname to a Restricted Directory

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 "Expand validation to block .. in configfilename and configver for improved security" added a line in app/modules/config/config.py:462. This is tuple-membership, no...

PT-2026-48460

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5 Description A path-traversal issue exists in the web interface used for managing Haproxy, Nginx, Apache, and Keepalived servers. A security check implemented in the config.py file within the app/modules/config...

Roxy-WI input validation vulnerability

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions of Roxy-WI 8.2.6.4 and earlier contain a vulnerability related to input validation errors. This vulnerability stems from HAProxy saving unvalidated and unescaped JSON field values direct...

PT-2026-48427

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.568 Jenkins LTS versions prior to 2.555.3 Description Secrets provided via POST config.xml submissions are stored unencrypted in job configuration files on the Jenkins controller. This allows users with Item/Extende...

PT-2026-48477

Name of the Vulnerable Software and Affected Versions @hulumi/baseline versions prior to 1.4.0 Description Issues in the AccountFoundation component allow the S3 bucket used for CloudTrail and AWS Config audit logs to be modified or deleted, compromising the forensic trail. This occurs through...

Deserialization vulnerability

Jenkins uses serialization and deserialization in multiple places, like agent/controller communication the Remoting library and to load and save configuration and build data using XStream. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that on...

cc.chensoul.nacos:nacos-distribution (2.5.2), com.buession.security:buession-security-spring (>=3.0.0, <=3.0.1) +321 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-config MAVEN version =5.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.11.0, =5.11.0, =1.48.0, =1.48.0, =1.48.0, =4.5.0, =4.5.0, =4.5.0, =6.5.0, =4.5.0, =4.5.1 and more Source cves: CVE-2026-47838 Source advisory: MEND:CVE-2026-47838...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +1390 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=6.3.0, <=6.3.10)

org.springframework.security:spring-security-config MAVEN version =6.3.0, =cloud-0.1, =1.3.0, =1.0.0, =1.2.1 and more Source cves: CVE-2026-47838 Source advisory: MEND:CVE-2026-47838...

at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2), br.com.consultdg:database-module (>=1.0.1, <=1.0.10) +1789 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=6.4.0, <=6.4.13)

org.springframework.security:spring-security-config MAVEN version =6.4.0, =0.0.1, =1.0.1, =1.0.2, =1.0.4, =1.0.2, =1.0.16, =1.0.2, =1.0.4, =1.0.18 - cc.zzzyu.nacos:nacos-ai 3.1.1 - cc.zzzyu.nacos:nacos-cmdb 3.1.1 - cc.zzzyu.nacos:nacos-config 3.1.1 - cc.zzzyu.nacos:nacos-console 3.1.1 -...

au.csiro.pathling:fhir-server (>=5.3.1, <=6.4.2), au.org.consumerdatastandards:data-holder (>=2.3.0, <=2.4.1) +1888 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=5.7.0, <=5.7.14)

org.springframework.security:spring-security-config MAVEN version =5.7.0, =5.3.1, =2.3.0, =2.4.1 - au.org.consumerdatastandards:mock-data-holder-java 2.6.0 - br.com.m4rc310:br-com-m4rc310-graphql 1.0.1 - br.com.m4rc310:br-com-m4rc310-libs 1.0.1 - br.com.m4rc310:br-com-m4rc310-starter 1.0.1 -...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +2107 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-config (>=6.5.0, <=6.5.10)

org.springframework.security:spring-security-config MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

spear-ai-sqlfluff-config (>=2.0.1, <=2.0.2), sqlfluff-templater-dbt (3.0.6) potentially affected by CVE-2026-46373 via sqlfluff (3.0.6)

sqlfluff PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - spear-ai-sqlfluff-config =2.0.1, =2.0.2 - sqlfluff-templater-dbt 3.0.6 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

spear-ai-sqlfluff-config (>=2.0.1, <=2.0.2), sqlfluff-templater-dbt (3.0.6) potentially affected by CVE-2026-46374 via sqlfluff (3.0.6)

sqlfluff PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - spear-ai-sqlfluff-config =2.0.1, =2.0.2 - sqlfluff-templater-dbt 3.0.6 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...