CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

Applied Systems Engineering ASE2000 V2 Communications Test Set

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to impersonate the trusted peer, complete the TLS handshake, and read or modify...

EUVD-2026-66831

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47874

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-59295

A flaw was found in Micrometer Instrumentation for Apache HttpAsyncClient. When asynchronous requests fail before receiving a response, such as due to connection resets or timeouts, the system can leak memory unboundedly. This continuous memory leak leads to heap exhaustion and OutOfMemoryError...

CVE-2026-47874: Allocation of Resources Without Limits or Throttling

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

PT-2026-82726

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description An...

X-WAD: EXplainable Web Anomaly Detection

The rapid growth of web-based services, particularly API-driven architectures, reflects an increasing reliance on distributed systems, exposing sensitive data to security risks and making the adoption of automated defensive mechanisms essential. In this context, where benign traffic predominates ...

CVE-2026-47874 Reactor Netty HTTP Server Denial of Service With Pipelined Requests

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47874

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47874 Reactor Netty HTTP Server Denial of Service With Pipelined Requests

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47874

CVE-2026-47874 affects the Reactor Netty HTTP server. When a client sends HTTP/1.1 pipelined requests over a single connection, the server can consume excessive memory, leading to a denial of service . The affected version ranges are 1.3.0–1.3.6 , 1.1.0–1.2.18 , and 1.0.52 and earlier . The vulne...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

EUVD-2026-66638

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an insecure temporary file vulnerability due to Python Requests library

Summary The Requests library is used by IBM Integrated Analytics System as an HTTP library for Python applications. CVE-2026-25645 affects the requests.utils.extractzippedpaths utility function in Requests versions prior to 2.33.0, which uses a predictable filename when extracting files from zip...

[SECURITY] [DSA 6467-1] freecad security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6467-1 [email protected] https://www.debian.org/security/ Aron Xu August 26, 2026 https://www.debian.org/security/faq -...

CVE-2026-47837: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....