CVE-2026-54757

Compliance-trestle (Trestle) , a Python SDK and CLI for managing OSCAL compliance documents, is vulnerable to server-side template injection (SSTI) leading to remote code execution . The root cause is that the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as ...

CVE-2026-54757 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

EUVD-2026-66188

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476

doorkeeper-openid_connect (an OpenID Connect extension for the Doorkeeper OAuth 2 gem in Ruby on Rails) is affected in version 1.9.0 . The root cause is in DynamicClientRegistrationController#register, which hard-codes confidential: false when creating dynamically registered applications, yet sti...

CVE-2026-44476

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

yara-x v1.20.0

YARA-X YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malwar...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707

Spring Security 's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack . The internal cache that stores JWT ID claims has a strict size limit, which an attacker can exploit by flooding the server with dummy requests to evict legitimate entries, then replaying intercepted valid...

CVE-2026-15916

CVE-2026-15916 is a Missing Authorization vulnerability in the Drupal core Image module that allows forceful browsing, leading to information disclosure. The module does not sufficiently check access to image style derivatives when files are served via a file stream other than private://. The ris...

CVE-2026-15916 Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

CVE-2026-15916 Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

CVE-2026-15916 Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

CVE-2026-15917

Drupal core 11.2 and above integrates the HTMX JavaScript library , and the built-in XSS filter does not sufficiently sanitize certain HTMX attributes, allowing a cross-site scripting (XSS) attack. An attacker must be able to insert HTML with specific attributes to exploit this. Affected versions...

CVE-2026-15917 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

CVE-2026-15917 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

CVE-2026-15917 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...