CVE-2026-41844 Spring Framework Open Redirect in Spring MVC and WebFlux

A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix. Affected versions: Spring Framework 7.0.0 through...

CVE-2026-8909

WpMobi WordPress plugin (versions ≤ 0.0.3) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in handleSaveGeneralSettings. This allows unauthenticated attackers to modify General Settings and inject scripts into an administrator’s browser via unescaped app_name...

PT-2026-47655

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48 Description A Spring MVC or Spring WebFlux application...

PT-2026-47771

Name of the Vulnerable Software and Affected Versions Apptha Slider Gallery version 1.0 Description An issue allows unauthenticated attackers to download arbitrary files by manipulating the imgname parameter. This is achieved by sending requests to the 'asgallDownload.php' endpoint using director...

CVE-2026-36796

The Tenda G0 router (version 15.11.0.5 ) is affected by a stack overflow vulnerability in the picCropName parameter of the formCropAndSetWewifiPic function. An attacker can exploit this flaw by sending a crafted HTTP request to trigger a Denial of Service (DoS) . No specific remediation or exploi...

PT-2026-48038

Name of the Vulnerable Software and Affected Versions Azure Stack Edge affected versions not specified Description External control of a file name or path allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment, there is no information about a newer...

PT-2026-47874

Name of the Vulnerable Software and Affected Versions Microsoft Windows DNS affected versions not specified Description A heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program writes more...

PT-2026-48333

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.7.0 through 5.7.24 Spring Security versions 5.8.0 through 5.8.26 Spring Security versions 6.3.0 through 6.3.17 Spring Security versions 6.4.0 through 6.4.17 Spring Security versions 6.5.0 through 6.5.10 Description T...

User Impersonation

Overview org.springframework.security:spring-security-config is a security configuration package for Spring Framework. Affected versions of this package are vulnerable to User Impersonation via username extraction in SubjectDnX509PrincipalExtractor. An attacker can impersonate another user by...

degit operating system command injection vulnerability

Degit is a tool developed by Rich Harris as a quick replication mechanism for Git repositories. Versions of degit prior to 2.8.6, as well as versions 3.0.0 to 3.3.1, contained an operating system command injection vulnerability. This vulnerability stemmed from improper handling of user input for...

CVE-2026-47643: External Control of File Name or Path

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network...

KB5095051: Windows 11 Version 26H1 Security Update (June 2026)

The remote Windows host is missing security update 5095051. It is, therefore, affected by multiple vulnerabilities - Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992,...

KB5094042: Windows Server 2012 Security Update (June 2026)

The remote Windows host is missing security update 5094042. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. CVE-2026-47291 - Heap-based buffer overflow in Remote Desktop...

Microsoft Windows DNS buffer error vulnerability

Microsoft Windows DNS is a domain name resolution service provided by Microsoft Corporation in the United States. The Domain Name System DNS is one of the industry-standard protocol suites that includes TCP/IP. Both DNS clients and DNS servers work together to provide name resolution services,...

Cronet web component domain replacement

The vulnerability of the Cronet web component of Google Chrome is related to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to replace a domain name using a specially created domain name...

RHEL 10 : bind (RHSA-2026:24851)

"The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24851 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVE...

KB5094123: Windows 10 version 1809 / Windows Server 2019 Security Update (June 2026)

The remote Windows host is missing security update 5094123. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. CVE-2026-47291 - Heap-based buffer overflow in Remote Desktop...

EulerOS 2.0 SP11 : avahi (EulerOS-SA-2026-2197)

According to the versions of the avahi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below,...

FreeBSD-SA-26:36.ldns

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:36.ldns Security Advisory The FreeBSD Project Topic: Insufficient response validation in the ldns stub resolver Category: contrib Module: ldns Announced:...

EulerOS 2.0 SP11 : gnutls (EulerOS-SA-2026-2244)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GnuTLS. This vulnerability allows a denial of service DoS by excessive CPU Central Processing Unit and memory consumption via...