CVE-2026-103371

Apache Geode versions 2.0.0 through 2.0.3 are affected by a vulnerability where the Management REST API improperly inserts sensitive information into log files. This issue, identified as CWE-532 , could lead to the exposure of confidential data through system logs. To mitigate this risk, users ar...

CVE-2026-103371

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

Security Bulletin:RabbitMQ Web STOMP WebSocket Handler Vulnerability: Unbounded Pre-Authentication State

Summary RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of sma...

Security Bulletin:Deserialization of Untrusted Data Vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream) - Object Injection Possible

Summary Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or...

ESAPI__esapi-java-legacy_CVE-2022-24891_2-2-3-1

Java용 기업 보안 API Legacy OWASP® ESAPI The OWASP Enterprise Security API는 무료 오픈 소스 웹 애플리케이션 보안 제어 라이브러리로, 프로그래머가 더 낮은 위험의 애플리케이션을 작성하기 쉽게 해줍니다. Java용 ESAPI 라이브러리는 기존 애플리케이션에 보안을 추가retrofit하기 쉽게 설계되었습니다. 또한 Java용 ESAPI는 새로운 개발을 위한 견고한 기반을 제공합니다. --- OWASP ESAPI 위키 페이지는 어디에 있나요? OWASP ESAPI 위키 페이지는...

Security Bulletin:morgan HTTP Request Logger Middleware: Unicode Line Separator Log Forge Vulnerability

Summary morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remo...

Security Bulletin:jackson-databind Deserialization Eager DNS Resolution Vulnerability

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

Security Bulletin:ip-address IPv4-mapped/NAT64 IPv6 Address SSRF Vulnerability Fix in 10.2.1

Summary ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known...

Security Bulletin:React Router Open Redirect and XSS Vulnerability Fixed in 7.13.0

Summary React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This...

CVE-2026-96335

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-56851

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

rust-sequoia-sq security, bug fix, and enhancement update

An update is available for rust-sequoia-sq. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp:...

RLSA-2026:76737 Important: rust-sequoia-sq security, bug fix, and enhancement update

Command-line frontends for Sequoia. Security Fixes: sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion CVE-2026-42784 Bug Fixes and Enhancements: Unbundle capnproto from sequoia-sq rhel-10.2.z JIRA:Rocky Linux-177547 For more details about the security...

Security Bulletin:React Router SSR Error Handling Vulnerability in Versions 6.4.0 to 7.17.0

Summary React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor...

Security Bulletin:body-parser Limit Validation Vulnerability in Versions Prior to 1.20.6 and 2.3.0

Summary Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit...

Security Bulletin:Jackson-databind Vulnerability: Record Constructor Bypass via PropertyNamingStrategy

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals record...

Security Bulletin:Erlang OTP SSH Infinite Loop Vulnerability: Unauthorized Data Handling and System Lock-Up

Summary Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handledata/4 function in sshsftpd contains a catch-all clause that accepts channel data of any typ...

USN-8899-1 libpng1.6 vulnerability

Ze Sheng discovered that libpng incorrectly handled certain compressed data chunks in PNG files. An attacker could possibly use this issue to cause a denial of service...

ESAPI__esapi-java-legacy_CVE-2022-23457_2-2-3-1

Java용 엔터프라이즈 보안 API Legacy OWASP® ESAPIThe OWASP Enterprise Security API는 무료 오픈 소스 웹 애플리케이션 보안 제어 라이브러리로, 프로그래머가 더 낮은 위험의 애플리케이션을 더 쉽게 작성할 수 있게 해줍니다. Java용 ESAPI 라이브러리는 프로그래머가 기존 애플리케이션에 보안을 쉽게 추가retrofit할 수 있도록 설계되었습니다. Java용 ESAPI는 새로운 개발을 위한 견고한 기반 역할도 합니다. --- OWASP ESAPI 위키 페이지는 어디에 있나요? OWA...

Security Bulletin:Exposure of Sensitive Information to Unauthorized Actor in Erlang OTP ssh_sftpd Module

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...