CVE-2026-48990 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...

DRUPAL-CORE-2026-008

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...

DRUPAL-CORE-2026-005

SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...

com.github.jknack:handlebars-humanize (0.6.2), com.github.jknack:handlebars-jackson2 (0.6.2) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.6.2)

com.github.jknack:handlebars MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.6.2 - com.github.jknack:handlebars-jackson2 0.6.2 -...

com.github.jknack:handlebars-guava-cache (1.2.0), com.github.jknack:handlebars-helpers (1.2.0) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.2.0)

com.github.jknack:handlebars MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.2.0 - com.github.jknack:handlebars-helpers 1.2.0 -...

com.github.jknack:handlebars-guava-cache (0.12.0), com.github.jknack:handlebars-humanize (0.12.0) +5 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.12.0)

com.github.jknack:handlebars MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 0.12.0 - com.github.jknack:handlebars-humanize 0.12.0 -...

com.github.jknack:handlebars-humanize (0.7.0), com.github.jknack:handlebars-jackson2 (0.7.0) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.7.0)

com.github.jknack:handlebars MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.7.0 - com.github.jknack:handlebars-jackson2 0.7.0 -...

com.github.jknack:handlebars-humanize (0.6.0), com.github.jknack:handlebars-jackson2 (0.6.0) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.6.0)

com.github.jknack:handlebars MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.6.0 - com.github.jknack:handlebars-jackson2 0.6.0 -...

com.github.jknack:handlebars-jackson2 (0.4.1), com.github.jknack:handlebars-json (0.4.1) +2 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.4.1)

com.github.jknack:handlebars MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-jackson2 0.4.1 - com.github.jknack:handlebars-json 0.4.1 -...

com.github.jknack:handlebars-humanize (0.5.4), com.github.jknack:handlebars-jackson2 (0.5.4) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.4)

com.github.jknack:handlebars MAVEN version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.4 - com.github.jknack:handlebars-jackson2 0.5.4 -...

com.github.jknack:handlebars-humanize (0.5.2), com.github.jknack:handlebars-jackson2 (0.5.2) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.2)

com.github.jknack:handlebars MAVEN version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.2 - com.github.jknack:handlebars-jackson2 0.5.2 -...

com.github.jknack:handlebars-jackson2 (0.4.0), com.github.jknack:handlebars-json (0.4.0) +2 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.4.0)

com.github.jknack:handlebars MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-jackson2 0.4.0 - com.github.jknack:handlebars-json 0.4.0 -...

com.github.jknack:handlebars-humanize (0.5.1), com.github.jknack:handlebars-jackson2 (0.5.1) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.5.1)

com.github.jknack:handlebars MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.5.1 - com.github.jknack:handlebars-jackson2 0.5.1 -...

com.github.jknack:handlebars-guava-cache (1.1.1), com.github.jknack:handlebars-humanize (1.1.1) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.1.1)

com.github.jknack:handlebars MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.1.1 - com.github.jknack:handlebars-humanize 1.1.1 -...

com.github.jknack:handlebars-guava-cache (1.1.0), com.github.jknack:handlebars-humanize (1.1.0) +6 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (1.1.0)

com.github.jknack:handlebars MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 1.1.0 - com.github.jknack:handlebars-humanize 1.1.0 -...

com.github.jknack:handlebars-guava-cache (2.3.0), com.github.jknack:handlebars-helpers (2.3.0) +11 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (2.3.0)

com.github.jknack:handlebars MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 2.3.0 - com.github.jknack:handlebars-helpers 2.3.0 -...

com.github.jknack:handlebars-guava-cache (2.3.1), com.github.jknack:handlebars-helpers (2.3.1) +8 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (2.3.1)

com.github.jknack:handlebars MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 2.3.1 - com.github.jknack:handlebars-helpers 2.3.1 -...

com.github.jknack:handlebars-guava-cache (0.11.0), com.github.jknack:handlebars-humanize (0.11.0) +4 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.11.0)

com.github.jknack:handlebars MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-guava-cache 0.11.0 - com.github.jknack:handlebars-humanize 0.11.0 -...

com.github.jknack:handlebars-humanize (0.10.0), com.github.jknack:handlebars-jackson2 (0.10.0) +4 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.10.0)

com.github.jknack:handlebars MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.10.0 - com.github.jknack:handlebars-jackson2 0.10.0 -...

com.github.jknack:handlebars-humanize (0.9.0), com.github.jknack:handlebars-jackson2 (0.9.0) +3 more potentially affected by CVE-2026-55760 via com.github.jknack:handlebars (0.9.0)

com.github.jknack:handlebars MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.jknack:handlebars and may be impacted: - com.github.jknack:handlebars-humanize 0.9.0 - com.github.jknack:handlebars-jackson2 0.9.0 -...