41331 matches found
CLSA-2026-1788341776 TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 14 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.4...
CLSA-2026-1788340622 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.30-tuxcare.9...
CVE-2026-81166: Missing Authorization
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...
The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel, which allows attackers to bypass existing security mechanisms
The vulnerability of the camel-elasticsearch-rest-client component of the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to bypass existing security mechanisms remotely...
Security Bulletin: Multiple security vulnerabilities in .NET affect IBM Robotic Process Automation
Summary Multiple security vulnerabilities in .NET affect IBM Robotic Process Automation. .NET is used by IBM Robotic Process as part of it's development framework. This security bulletin identifies the fixes required to resolve these vulnerabilities Vulnerability Details CVEID:CVE-2026-41319...
CVE-2026-73229
creationtimestamp| type| source ---|---|--- 2026-09-01 20:35:03+00:00| published-proof-of-concept| https://github.com/encode/django-rest-framework/security/advisories/GHSA-g47c-3xmw-q6m2...
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the setcookie method when...
GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`
Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...
EUVD-2026-56887
Django REST framework: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data...
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...
EUVD-2026-56888
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests...
GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...
CLSA-2026-1788287051 TuxCare security update for org.springframework (24 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 24 CVEs. Fixed in 6.1.13-tuxcare.2...
python-tuf v7.0.1
A Framework for Securing Software Update Systems The Update Framework TUF is a framework for secure content delivery and updates. It protects against various types of supply chain attacks and provides resilience to compromise. This repository is a reference implementation written in Python. It is...
CLSA-2026-1788283253 TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 20 CVEs. Fixed in 6.1.19-tuxcare.3...
CLSA-2026-1788276466 TuxCare security update for org.springframework (17 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 17 CVEs. Fixed in 6.2.15-tuxcare.7...
CLSA-2026-1788276305 TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 26 org.springframework packages to address 25 CVEs. Fixed in 6.2.13-tuxcare.2...
SUSE CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...