507 matches found
CVE-2025-27511
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution RCE. Version 2.27.0 fixes...
CVE-2025-27511: Deserialization of Untrusted Data
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution RCE. Version 2.27.0 fixes...
PT-2026-50730
Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.18.0 Description When using MySQL as the datastore, the system may return identical responses for two distinct check requests. This occurs when authorization decisions depend on case-sensitive user strings...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...
GHSA-G628-R368-6VH7 GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution RCE. Impact If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code. Details Authenticated users can access Vector Data Sources page to...
com.btmatthews.atlas:atlas-mongodb (1.0.0), com.github.microon:microon-services-userdirectory (0.0) +6 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.2.1.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.btmatthews.atlas:atlas-mongodb 1.0.0 -...
com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.3.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...
in.clouthink.daas:daas-token (>=1.0.0, <=1.8.1), io.github.jhipster.loaded:agent (>=0.5, <=0.12) +7 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.1.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - in.clouthink.daas:daas-token =1.0.0, =0.5, =0.5, =0.5, =0.5,...
org.grails:gorm-mongodb-spring-boot (1.0.0.m1), org.grails:grails-datastore-gorm-mongodb (>=2.0.0.release, <=2.0.1.release) +1 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.4.0.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.0.0.m1 -...
org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.0.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...
org.grails:grails-datastore-gorm-mongo (>=1.1.0.release, <=1.2.0.release), org.grails:grails-datastore-mongo (>=1.1.0.release, <=1.2.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.1.0.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.1.0.release,...
org.bitbucket.swattu:datastore-utils (>=4.0.32, <=4.0.63), org.bitbucket.swattu:lock-utils (>=4.0.32, <=4.0.63) +4 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.10.13.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.10.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.bitbucket.swattu:datastore-utils =4.0.32, =4.0.32,...
com.lordofthejars:nosqlunit-mongodb (>=0.9.0, <=1.0.0), org.grails:grails-datastore-gorm-mongodb (>=3.0.2.release, <=3.1.5.release) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.3.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.lordofthejars:nosqlunit-mongodb =0.9.0, =3.0.2.release,...
org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.0.0.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...
org.grails:gorm-mongodb-spring-boot (1.0.0.m1), org.grails:grails-datastore-gorm-mongodb (>=2.0.0.release, <=2.0.1.release) +1 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.4.0.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:gorm-mongodb-spring-boot 1.0.0.m1 -...
org.bitbucket.swattu:datastore-utils (>=4.0.32, <=4.0.63), org.bitbucket.swattu:lock-utils (>=4.0.32, <=4.0.63) +4 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (1.10.13.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.10.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.bitbucket.swattu:datastore-utils =4.0.32, =4.0.32,...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal in the cluster-admin:backup-datastore component. The user-controlled input of the filePath argument to the BackupDatastoreCommand passes its value into the fileName parameter of a ObjectOutputStream invocations, whic...
CVE-2026-36500
An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request...
