wagtail-embedvideos (5.1.0), wagtail-reoako (2.1.1) +2 more potentially affected by CVE-2026-54260 via wagtail (5.1.3)

wagtail PYPI version 5.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-embedvideos 5.1.0 - wagtail-reoako 2.1.1 - wagtail-spa-integration =2.1.0, =2.1.3 - wagtail-treemodeladmin 1.8.0 Source cves: CVE-2026-542...

wagtail-embedvideos (5.1.0), wagtail-reoako (2.1.1) +2 more potentially affected by CVE-2026-54259 via wagtail (5.1.3)

wagtail PYPI version 5.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-embedvideos 5.1.0 - wagtail-reoako 2.1.1 - wagtail-spa-integration =2.1.0, =2.1.3 - wagtail-treemodeladmin 1.8.0 Source cves: CVE-2026-542...

Exploit for CVE-2026-8181

💥 CVE-2026-8181 - Burst Statistics Authentication Bypass...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the setBeanClassLoader process. An attacker can execute arbitrary code by injecting malicious serialized data into the INTMESSAGE.MESSAGECONTENT field. This is only exploitable if the deserializatio...

cn.herodotus.dante:message-mqtt-spring-boot-starter (4.1.0.1), org.citrusframework.mvn:citrus-maven-plugin (>=5.0.0-m2, <=5.0.2) +35 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (7.1.0)

org.springframework.integration:spring-integration-http MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-http and may be impacted: - cn.herodotus.dante:message-mqtt-spring-boot-start...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.20.0, <=0.21.0), com.solace.connector.core.io:spring-cloud-stream-binder-jms (5.0.1) +2 more potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (7.1.0)

org.springframework.integration:spring-integration-jms MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-jms and may be impacted: -...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.17.0, <=0.19.0), org.springframework.cloud.fn:spring-jms-supplier (6.0.0) potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (>=7.0.2, <=7.0.4)

org.springframework.integration:spring-integration-jms MAVEN version =7.0.2, =0.17.0, =0.19.0 - org.springframework.cloud.fn:spring-jms-supplier 6.0.0 Source cves: CVE-2026-47880 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267412...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

io.awspring.cloud:spring-cloud-aws-starter-integration-sns (>=4.0.0-m1, <=4.2.0), org.citrusframework.mvn:citrus-maven-plugin (5.0.0-m1) +34 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-http MAVEN version =7.0.0-m1, =4.0.0-m1, =4.2.0 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent-connector 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59324 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59292 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59324 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions via the PropertiesPersistingMetadataStore. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in ...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the fluxTransform when used with an asynchronous or reordering fluxFunction that emits raw payloads. An attacker can access another user's reply headers and cause reply mis-routing by sendin...

ch.sbb:spring-cloud-stream-binder-solace (>=9.1.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (4.1.0.1) +522 more potentially affected by CVE-2026-59292 via org.springframework.integration:spring-integration-core (7.1.0)

org.springframework.integration:spring-integration-core MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-core and may be impacted: - ch.sbb:spring-cloud-stream-binder-solace =9.1.0,...

org.apereo.cas:cas-server-support-jpa-ticket-registry (>=8.0.0-rc6, <=8.0.2), org.eclipse.hawkbit:hawkbit-ddi-server (1.1.0) +10 more potentially affected by CVE-2026-59307 via org.springframework.integration:spring-integration-jdbc (7.1.0)

org.springframework.integration:spring-integration-jdbc MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-jdbc and may be impacted: -...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DefaultJmsHeaderMapper process. An attacker can redirect handler output or error messages to arbitrary MessageChannel beans by setting crafted JMS properties such as replyChannel,...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonToObjectTransformer. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted jsonTypeId message header that is mapped from an external source, such as...

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

cve-2026-47880 - MEDIUM - DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names...