joro v1.12.0

Joro A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI. Warning: This tool is intended for authorized penetration testing an...

CLSA-2026-1788376116 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.4...

CLSA-2026-1788372470 TuxCare security update for org.springframework (21 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 21 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.4...

CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...

CVE-2026-52832

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

EUVD-2026-70220

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-52831 Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container /bin/sh, -c, . Two fields in the trigger specification flow...

CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79754 Nuclio: Kaniko build tempDir command injection

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to before version 1.17.2, Nuclio's Dashboard build pipeline does not sanitize the spec.build.tempDir field before using it to construct a shell command. When the Kaniko container builder is enabled, a...

CVE-2026-52833 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CLSA-2026-1788363279 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.10...

CLSA-2026-1788362569 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 26 org.springframework packages to address 1 CVE. Fixed in 6.1.4-tuxcare.3...

CLSA-2026-1788361436 TuxCare security update for org.springframework (13 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 13 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.10...

CLSA-2026-1788360559 TuxCare security update for org.springframework (29 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 29 CVEs. Fixed in 5.3.21-tuxcare.1...

EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

EUVD-2026-68892

Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

EUVD-2026-70002

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166

Drupal Digital Signage Framework (contrib module) is affected by a missing authorization flaw in a route intended for signage devices to refresh dynamic blocks. The route failed to verify that the requester was an authorized signage device or that the requested block was one the module delivers t...