PT-2026-82718

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-59314: Improper Neutralization of CRLF Sequences in HTTP Headers

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

TencentOS Server 3: resource-agents (TSSA-2026:0899)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0899 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47862

Spring Integration's ZipTransformer component is vulnerable to a path traversal issue when using the default ZipResultType.FILE result type. An attacker who can set the file_name message header on a message reaching the transformer can cause the resulting .zip archive to be written to an arbitrar...

CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47862

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

curl: CVE-2026-80255: secure cookie attribute bypass with tab

Summary A Set-Cookie header using HTAB horizontal tab instead of SPACE before the Secure attribute — e.g. Set-Cookie: sid=SECRET;\tSecure — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-26449

In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid memory while processing the frame, causing the process to crash...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Hpack.decodeHeaders path in ember-core/shared/src/main/scala/org/http4s/ember/core/h2/Hpack.scala. An attacker can exhaust heap memory and crash an HTTP/2 server...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-73108

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up...

CVE-2026-73108 RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up...

CVE-2026-55620

A flaw was found in emlparser, a Python module designed for parsing email files. A remote attacker can exploit a vulnerability in how the module processes Received: headers containing deeply nested parentheses. By submitting specially crafted email files, an attacker can cause excessive CPU usage...

WordPress WP Fastest Cache plugin <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability

Unauthenticated Stored Cross-Site Scripting via HTTP Host Header vulnerability discovered by Adrien Brunner in WordPress Plugin WP Fastest Cache versions = 1.5.0...

CVE-2026-63041 Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers

Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly. This issue affects Apache...