BELL-CVE-2026-46242

Bulletin has no description...

CVE-2026-45609

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol MCP security specifications. Specifically, it processes untrusted...

PT-2026-121257

Уязвимость функции sev vm move enc context from компонента arch/x86/kvm/svm/sev.c ядра операционной системы Linux связана с недостаточным контролем ресурса в период его существования. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и...

PT-2026-45878

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1 Description LibreChat is an enhanced ChatGPT clone supporting multiple AI providers. The Model Context Protocol MCP server integration improperly resolves $VAR placeholders against the server's process.env...

CVE-2026-32625: Exposure of Sensitive Information to an Unauthorized Actor

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol MCP server integration resolves $VAR placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40990...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40990...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +357 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +357 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +357 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +357 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40990 Source advisory:...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40989 Source advisory:...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40990 Source advisory:...