phpstan v2.2.13

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

EUVD-2026-54577

Kirby: System path exposure from error messages in the REST API...

Linux Distros Unpatched Vulnerability : CVE-2026-59281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument...

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

UBUNTU-CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59281 Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59281

Spring Framework versions 5.2.25.RELEASE and earlier through 7.0.8 are affected by a reflected cross-site scripting (XSS) vulnerability in Spring MVC and WebFlux. The root cause is that the no-argument Errors.getFieldErrors() and Errors.getFieldError() accessors return unescaped field error conte...

EUVD-2026-67011

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

EUVD-2026-66757

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input...

CVE-2026-80588

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...

CVE-2026-80588 mptcp: reclaim forward-allocated memory on RX path errors

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...

PT-2026-82204

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the Multipath TCP MPTCP receive path. Following a specific commit that allowed borrowing forward memory from subflows, errors occurring in the receive path before...

The vulnerability of the net/netfilter/ipset component of the Linux operating system, which allows a hacker to cause a service failure.

The vulnerability of the net/netfilter/ipset component in the Linux operating system is related to uncontrolled resource consumption due to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerabilities of the functions core_tmr_drain_tmr_list() and core_tmr_lun() in the driver/target/target_core_tmr.c module of the Linux operating system’s TCM driver, which allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerabilities of the functions coretmrdraintmrlist and coretmrlun in the driver/target/targetcoretmr.c file of the Linux kernel’s TCM driver are related to synchronization errors when using shared resources. Exploiting these vulnerabilities can allow attackers to compromise the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: amdsfh: Switch to device-managed dmamalloccoherent Using the device-managed version simplifies cleanup in the probe function. This also ensures proper cleanup, which helps to resolve memory errors, page faults, btrfs...

Astra Linux – Vulnerability in curl

When curl is used to retrieve and parse cookies from an HTTPS server, it accepts cookies using control codes that, when sent back to an HTTP server later, may cause the server to return 400 responses. This effectively allows a “sister site” to deny service to all other sibling sites...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gfs2: Check sbbsizeshift after reading the superblock. Fuzzers often modify sbbsizeshift, but in reality it’s very unlikely that this field would be corrupted on its own. Nevertheless, it should still be checked to avoid potentia...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw in the processing of received ICMP errors such as ICMP fragments and ICMP redirections within the Linux kernel’s functionality was identified. This flaw allows an off-path remote user to quickly scan open UDP ports. This vulnerability enables a remote user to bypass the UDP source port...

Astra Linux – Vulnerability in symfony

Symfony is a PHP framework for web and console applications, along with a set of reusable PHP components. The ability to enumerate users was possible without requiring relevant permissions, as the handling differed depending on whether the user existed or not when trying to use the “switch users”...