CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

EUVD-2026-66823

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

CVE-2026-81486 bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

EUVD-2026-66833

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

CVE-2026-81486

bsmi021 mcp-file-context-server 1.0.0 contains a path traversal vulnerability in the Path Resolution component, specifically in the function read_context within src/index.ts. Manipulating the path argument allows an unauthenticated remote attacker to read files outside the intended directory, res...

EUVD-2026-66761

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

SUSE CVE-2026-78942

Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. Chromium security severity: Medium...

SUSE CVE-2026-78985

Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79049

Incorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Medium...

SUSE CVE-2026-79070

Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79103

Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-79254

Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-79264

Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-82435

Name of the Vulnerable Software and Affected Versions resolv gem versions prior to 0.7.2 Description An issue exists where Resolv::DNS::MessageEncoder writes a DNS label length into a single octet without range validation. When a label exceeds 255 octets, the length is stored modulo 256 while the...

PT-2026-82545

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-59311: Improper Link Resolution Before File Access

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-81486: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

CVE-2026-81697: Untrusted Search Path

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2026-81572: Improper Link Resolution Before File Access

In CodeMeter Runtime from version 8.40 to excluding 8.41a and 9.00 to excluding 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before fi...