CLSA-2026-1788525613 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.0.16-tuxcare.8...

CLSA-2026-1788525419 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.0-tuxcare.3...

Improper Validation of Unsafe Equivalence in Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input due to incomplete schema case normalization in lib/validation.js when compiling header schemas. An attacker can bypass schema-enforced...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

Improper Security Configuration

Spring Framework is vulnerable to Improper Security Configuration. The vulnerability is due to response cookies being serialized without the SameSite attribute in WebFlux applications using the Jetty 12 Core reactive adapter...

Memory Leak

Spring Framework is vulnerable to a memory leak. The vulnerability is due to a malformed SETUP frame, where the RSocket server allocates resources without proper cleanup and an attacker can repeatedly send crafted frames to exhaust memory...

Malicious Package

Overview @bx-ui-framework/authentication is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview @bx-ui-framework/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @bx-ui-framework/microfrontend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

MAL-2026-15866 Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

CLEANSTART-2026-ZB03263 Netty is a network application framework for development of protocol servers and clients

Multiple security vulnerabilities affect the keycloak package. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details...

PT-2026-85574

Name of the Vulnerable Software and Affected Versions TEN Framework version 0.11.71 Description The TMAN Designer component contains flaws allowing unauthenticated users to read and write arbitrary files. By sending POST and PUT requests to the '/api/designer/v1/file-content' endpoint, an attacke...

CVE-2026-85688: Missing Authentication for Critical Function

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

The vulnerability in the `internal/transport/transport.go` file of the gRPC-Go framework for remote procedure calls in the Go programming language allows a attacker to cause a service failure.

The vulnerability in the internal/transport/transport.go file of the Go-based gRPC-Go framework for remote procedure calls involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

CVE-2026-56812

creationtimestamp| type| source ---|---|--- 2026-09-03 22:35:14+00:00| published-proof-of-concept| https://github.com/phoenixframework/phoenix/security/advisories/GHSA-63mc-hw7g-86rr...

EUVD-2026-42050

Phoenix: Presence keys colliding with Object.prototype members break existence checks...

CVE-2017-1000486

README - CVE-2020-1039909 Primefaces Remote Code Execution ============================================================ SOBRE A VULNERABILIDADE CVE-2020-1039909 e uma vulnerabilidade de execucao remota de codigo RCE no framework Primefaces JSF. A falha permite que um atacante execute comandos...

CVE-2026-49456

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...