CVE-2026-40997

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

CVE-2026-25809

PlaciPy 1.0.0 contains a code evaluation endpoint that allows execution without validating the assessment lifecycle (started, not expired, or submission window open). This exposes low-risk (per CVSS 4.0 metrics) but real impact to integrity with LOW impact and no confidentiality/availability impa...

CVE-2026-25809 PlaciPy Code Execution Allowed Without Assessment Active State Validation

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission...