com.eurodyn.qlack.fuse:qlack-fuse-aaa (3.9.8), com.trigyn:java-web-starter (>=2.2, <=2.13) +5 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.4.2, <=6.4.11)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.4.2, =2.2, =11.10.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =9.0-rc1, =1.15.0, =1.15.0, =2.4.0 Source cves: CVE-2026-40988 Source advisory: GHSA-M69X-PW9P-7J3Q...

com.github.shoothzj:sdk-distribute-impl-mongo (3.0.27.release), de.bwaldvogel:mongo-java-server-test-common (>=1.35.0, <=1.36.0) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.shoothzj:sdk-distribute-impl-mongo 3.0.27.release -...

com.trigyn:java-web-starter (>=1.6.0, <=2.1), com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.9.0, <=11.9.5.ee) +22 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.3.1, <=6.3.6)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.3.1, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0-m4, =2.0.0 and more Source cves: CVE-2026-41003 Source advisory:...

com.github.shoothzj:sdk-distribute-impl-mongo (3.0.27.release), de.bwaldvogel:mongo-java-server-test-common (>=1.35.0, <=1.36.0) +3 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.2.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.shoothzj:sdk-distribute-impl-mongo 3.0.27.release -...

EUVD-2026-35842

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with...

VMware Spring for Apache Kafka code issue vulnerabilities

VMware Spring for Apache Kafka is a Kafka messaging integration framework developed by VMware, Inc. Versions of VMware Spring for Apache Kafka prior to 4.0.0, as well as versions 3.3.0 and earlier, 3.2.0 and earlier, 2.9.0 and earlier, and 2.8.0 and earlier, contain code vulnerabilities. These...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40995 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40995 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320712...

PT-2026-48406

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential stri...

NSA Ghidra security vulnerabilities

NSA Ghidra is an open-source reverse-engineering tool developed by the National Security Agency National Security Agency of the United States. Previous versions of NSA Ghidra, such as version 12.1, contained security vulnerabilities. These vulnerabilities stemmed from a flaw in the...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40996 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40996 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320523...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41731

Spring for Apache Kafka vulnerable due to overly broad trusted-package matching in JsonKafkaHeaderMapper and deprecated DefaultKafkaHeaderMapper: they compare type headers against trusted packages with a prefix check, causing any trusted package to implicitly trust all subpackages. When combined ...

CVE-2026-41731 In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

CVE-2026-40993 Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository saml2assertingpartymetadata may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials verificationcredentials and...

CVE-2026-25860

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with...

CVE-2026-45581

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...

CVE-2026-34694

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's...

CVE-2026-34691

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when th...

EUVD-2026-35765

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's...

CVE-2026-34693

Adobe Experience Manager Forms JEE (LTS SP1, 6.5.24.0 and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue could allow an attacker to inject malicious scripts into a page, potentially gaining elevated access or control over a victim’s account or session. Exp...