CVE-2026-52833 Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CLSA-2026-1788363279 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.10...

CLSA-2026-1788362569 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 26 org.springframework packages to address 1 CVE. Fixed in 6.1.4-tuxcare.3...

CLSA-2026-1788361436 TuxCare security update for org.springframework (13 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 13 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.10...

CLSA-2026-1788360559 TuxCare security update for org.springframework (29 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 29 CVEs. Fixed in 5.3.21-tuxcare.1...

EUVD-2026-68765

Livewire DOM-based cross-site scripting during client-side state handling...

EUVD-2026-68892

Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...

EUVD-2026-70002

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166

Drupal Digital Signage Framework (contrib module) is affected by a missing authorization flaw in a route intended for signage devices to refresh dynamic blocks. The route failed to verify that the requester was an authorized signage device or that the requested block was one the module delivers t...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CLSA-2026-1788349534 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 5.3.27-tuxcare.9...

CLSA-2026-1788346056 TuxCare security update for org.springframework (23 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 23 CVEs. Fixed in 6.0.11-tuxcare.1...

CLSA-2026-1788344824 TuxCare security update for org.springframework (27 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 27 CVEs. Fixed in 6.0.13-tuxcare.1...

CLSA-2026-1788342506 TuxCare security update for org.springframework (11 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 11 CVEs. Fixed in 6.0.16-tuxcare.6...

CLSA-2026-1788341776 TuxCare security update for org.springframework (14 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 14 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.4...

CLSA-2026-1788340622 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.30-tuxcare.9...

CVE-2026-81166: Missing Authorization

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms

The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...