PT-2026-88514

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

PT-2026-88515

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-82073: Incorrect Authorization

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

PT-2026-88522

The following issues are included in Project Mainline components. Subcomponent CVE ART CVE-2026-28664 Media Framework components CVE-2026-28609, CVE-2026-45527 Documents UI CVE-2026-28636 Media Codecs CVE-2026-28618, CVE-2026-55294 Media Provider CVE-2026-28622, CVE-2026-28638, CVE-2026-28671,...

PT-2026-87165

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an...

CVE-2026-82074: Incorrect Authorization

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

CVE-2026-53639: Authorization Bypass Through User-Controlled Key

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

PT-2026-87166

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually...

CLSA-2026-1788813738 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 8 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.5...

CLSA-2026-1788807216 TuxCare security update for org.springframework (11 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 11 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.5...

CLSA-2026-1788804848 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 14 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.6...

CLSA-2026-1788800921 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.29-tuxcare.10...

CLSA-2026-1788800102 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 8 CVEs. Fixed in 5.3.21-tuxcare.2...

Stream Corruption

Spring Framework is vulnerable to stream corruption. The vulnerability is due to improper handling of response streams when processing SSE with view fragments, which allows an attacker to potentially corrupt or disrupt the application’s HTTP response stream...

CLSA-2026-1788782570 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 4 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.11...

CLSA-2026-1788782067 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.1.16-tuxcare.5...

[SECURITY] Fedora 44 Update: gegl04-0.4.70-5.fc44

GEGL Generic Graphics Library is a graph based image processing framework. GEGLs original design was made to scratch GIMP's itches for a new compositing and processing core. This core is being designed to have minimal dependencies and a simple well defined API...

The vulnerability of the Vert.x Java framework in Quarkus allows attackers to exploit it to disclose protected information.

The vulnerability of the Vert.x Java framework in Quarkus relates to the disclosure of information in the error-prone data area. Exploiting this vulnerability can allow an attacker to disclose the protected information...

ROS-20260907-73-0098

The vulnerability of Microsoft.NET Framework software and the Visual Studio source code editor is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

ROS-20260907-73-0101

The vulnerability of Microsoft.NET Framework software and the Visual Studio source code editor is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to execute arbitrary code...