Lucene search
+L

41331 matches found

OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/08/28 11:14 p.m.•33 views

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

5.9AI score
SaveExploits0References2
OSV
OSV
•added 2026/08/28 11:14 p.m.•12 views

MAL-2026-15500 Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

5.9AI score
SaveExploits0References2
Circl
Circl
•added 2026/08/28 8:35 p.m.•20 views

CVE-2026-55485

creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:29+00:00| published-proof-of-concept| https://github.com/piccolo-orm/piccoloadmin/security/advisories/GHSA-2gh4-jmwq-rr8w 2026-08-30 12:02:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucduenvgk2z...

8.8CVSS5.8AI score0.00564EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/08/28 7:19 p.m.•22 views

CVE-2026-55484 ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p0 access...

7.5CVSS5.9AI score0.00488EPSS
SaveExploits0References2
CVE
CVE
•added 2026/08/28 7:19 p.m.•28 views

CVE-2026-55484

ALOS HTTP , a Linux-first Go web framework with a custom networking stack, is vulnerable to an unauthenticated remote denial-of-service . The root cause is an unchecked p[0] access in core/utils.go::sanitizeRequestPath after splitPathQuery processes a path beginning with a question mark, leaving ...

7.5CVSS5.9AI score0.00488EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/08/28 4:06 p.m.•23 views

EUVD-2026-43098

Phalcon: Catastrophic backtracking ReDoS in the default Phalcon Router route lead to remote unauthenticated DoS...

8.7CVSS5.9AI score0.00524EPSS
SaveExploits0References5
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/28 3:41 p.m.•18 views

Security Bulletin: Vulnerabilities in spring-core-5.3.25.jar and spring-expression-6.1.11.jar (CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41848) affect IBM PowerVM Novalink.

Summary The spring-core-5.3.25.jar and spring-expression-6.1.11.jar are used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS atta...

7.5CVSS6.7AI score0.0046EPSS
SaveExploits0Affected Software1
OSV
OSV
•added 2026/08/28 2:53 p.m.•18 views

CLSA-2026-1787928797 TuxCare security update for org.springframework (15 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 15 CVEs. Fixed in 6.1.20-tuxcare.9...

9.8CVSS6.9AI score0.00605EPSS
SaveExploits1
OSV
OSV
•added 2026/08/28 11:58 a.m.•15 views

CLSA-2026-1787918303 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.25-tuxcare.7...

5.9CVSS6.6AI score0.00385EPSS
SaveExploits1
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/28 2:23 a.m.•29 views

Security Bulletin: Multiple Security Vulnerabilities in Spring Framework Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities in Spring Framework Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patter...

7.5CVSS6.9AI score0.02127EPSS
SaveExploits2Affected Software1
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/28 2:12 a.m.•17 views

Security Bulletin: Security Vulnerability in Spring affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22737)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring. Vulnerability Details CVEID:CVE-2026-22737 DESCRIPTION: Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in...

5.9CVSS5.3AI score0.00385EPSS
SaveExploits1Affected Software1
SUSE CVE
SUSE CVE
•added 2026/08/28 1:06 a.m.•11 views

SUSE CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

7.5CVSS5.9AI score0.00431EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•18 views

Spring Framework 5.2.x < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Memory Leak via SETUP Frame in RSocketMessageHandler

The version of Spring Framework installed on the remote host is 5.2.x prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - A Spring RSocket application is exposed to...

7.5CVSS5.9AI score0.0046EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•17 views

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-framework (UTSA-2026-093017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093017 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

8.5CVSS7.5AI score0.97906EPSS
SaveExploits9References4
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•17 views

Spring Framework 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 maxPartSize Ignored in PartEventHttpMessageReader

The version of Spring Framework installed on the remote host is 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is...

7.5CVSS5.9AI score0.00366EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•15 views

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-framework (UTSA-2026-093010)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093010 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

10CVSS7.5AI score0.99999EPSS
SaveExploits377References4
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•68 views

Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies...

9.8CVSS6AI score0.00564EPSS
SaveExploits0References6
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•45 views

Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - Spring MVC and WebFlux applications tha...

9.8CVSS6AI score0.00522EPSS
SaveExploits0References12
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•38 views

Spring Framework 5.2.5 < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Header Predicate Bypass in WebFlux Functional Endpoints

The version of Spring Framework installed on the remote host is 5.2.5 prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - A WebFlux application using functional...

9.8CVSS5.9AI score0.00529EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
•added 2026/08/28 12:00 a.m.•13 views

Microsoft .NET Framework (August 2026)

The Microsoft .NET Framework installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network. CVE-2026-62872 - Relative path traversa...

8.8CVSS7.2AI score0.00778EPSS
SaveExploits0References22
Rows per page
Query Builder