CVE-2026-47886: Uncontrolled Resource Consumption

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

PT-2026-82406

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-47891: Allocation of Resources Without Limits or Throttling

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3....

PT-2026-82380

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSF WS JSON RPC API TOKEN is not explicitly set, the application resets t...

CVE-2026-47892: Incorrect Authorization

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

CVE-2026-47884: Improper Limitation of a Pathname to a Restricted Directory

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

August 27, 2026-KB5122386 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1

None None...

August 27, 2026-KB5122385 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 25H2 and Microsoft server operating system 24H2

None None...

CVE-2026-59313: Improper Neutralization of CRLF Sequences

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CLSA-2026-1787777604 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 2 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.4...

DRUPAL-CONTRIB-2026-109

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous...

CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CLSA-2026-1787750951 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 2 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.4...

CLSA-2026-1787749852 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.19-tuxcare.2...

CLSA-2026-1787739491 TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 5 CVEs. Fixed in 5.3.25-tuxcare.6...

CLSA-2026-1787726639 TuxCare security update for org.springframework (10 CVEs)

TuxCare rebuilt 26 org.springframework packages to address 10 CVEs. Fixed in 6.1.4-tuxcare.1...

CLSA-2026-1787726627 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 8 CVEs. Fixed in 6.1.13-tuxcare.1...

CLSA-2026-1787725644 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 3 CVEs. Fixed in 5.3.29-tuxcare.7...

HAKIMIX

HAKIMIX Framework 🛡️🔥 HAKIMIX waa Framework awood badan o...

Unsaid, Unsafe? Implicit Security Obligations in LLM-Based RTL Code Generation

Large Language Models LLMs generate register-transfer-level RTL code with rapidly improving functional correctness. Security of LLM-generated code, however, has been studied mainly for software, where flaws can still be patched after deployment. Insecure RTL offers no such remedy once taped out...