CVE-2026-41731

Spring for Apache Kafka vulnerable due to overly broad trusted-package matching in JsonKafkaHeaderMapper and deprecated DefaultKafkaHeaderMapper: they compare type headers against trusted packages with a prefix check, causing any trusted package to implicitly trust all subpackages. When combined ...

CVE-2026-40993 Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository saml2assertingpartymetadata may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials verificationcredentials and...

CVE-2026-25860

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with...

CVE-2026-45581

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-34694

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's...

CVE-2026-34691

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when th...

CVE-2026-34693

Adobe Experience Manager Forms JEE (LTS SP1, 6.5.24.0 and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue could allow an attacker to inject malicious scripts into a page, potentially gaining elevated access or control over a victim’s account or session. Exp...

EUVD-2026-35765

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's...

EUVD-2026-35764

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's...

CVE-2026-34694 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's...

CVE-2026-34691 Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when th...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM Guardium Key Lifecycle Manager due to the April 2026 Java CPU

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty is shipped as a component of IBM Guardium Key Lifecycle Manager SKLM/GKLM. Information about multiple security vulnerabilities affecting IBM WebSphere Application Server and IBM WebSphere Application Server...

ecommerce-poc

Event-Driven E-Commerce Saga POC This project is a small even...

Privilege Escalation

AWS Advanced JDBC Wrapper is vulnerable to Privilege Escalation. The vulnerability is due to an untrusted search path issue in the GlobalDatabasePlugin, where a low-privileged authenticated user can create a crafted function that is executed when another user connects through the affected wrapper...

com.ahome-it:ahome-tooling-server-core (>=1.1.32-release, <=1.1.36-release), com.ahome-it:ahome-tooling-server-mongodb (>=1.1.32-release, <=1.1.36-release) +62 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.6.release)

org.springframework:spring-jms MAVEN version 4.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.32-release, =1.1.32-release, =1.1.32-release,...

ai.mattmann.mnemosyne:cas-cli (>=1.11.0, <=1.13.8), ai.mattmann.mnemosyne:cas-crawler (>=1.11.0, <=1.13.8) +151 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5.4)

org.springframework:spring-core MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ai.mattmann.mnemosyne:cas-cli =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0, =1.11.0,...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +150 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.5.1)

org.springframework:spring-core MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - br.net.woodstock.rockframework:rockframework-domain =1.2.1, =1.2.1, =0.7, =1.3, =2.0, =2.0, =0.0....

com.free-now.apis:phrase-java-client (>=1.0.8, <=3.0.0), com.free-now.maven.plugins:phrase-plugin (>=2.0.0, <=2.1.0) +90 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (3.2.15.release)

org.springframework:spring-core MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - com.free-now.apis:phrase-java-client =1.0.8, =2.0.0, =2.0.1, =2.0.1, =3.1.0, =1.0.0,...

com.free-now.apis:phrase-java-client (>=1.0.8, <=3.0.0), com.free-now.maven.plugins:phrase-plugin (>=2.0.0, <=2.1.0) +79 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.15.release)

org.springframework:spring-expression MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.free-now.apis:phrase-java-client =1.0.8, =2.0.0, =2.0.1, =2.0.1, =3.1.0,...

com.free-now.apis:phrase-java-client (>=1.0.8, <=3.0.0), com.free-now.maven.plugins:phrase-plugin (>=2.0.0, <=2.1.0) +79 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (3.2.15.release)

org.springframework:spring-expression MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.free-now.apis:phrase-java-client =1.0.8, =2.0.0, =2.0.1, =2.0.1, =3.1.0,...