cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay...

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation

cve-2026-47842 - MEDIUM - Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation...

cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File

cve-2026-47881 - MEDIUM - Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File...

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist

cve-2026-47875 - MEDIUM - JobParameterDeserializer bypasses the trusted-type allowlist...

RockyLinux 8 : java-21-openjdk (RLSA-2026:55787)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55787 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has extracted...

Security update for gitea-tea (important)

openSUSE security update: security update for gitea-tea ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21603-1 Rating: important References: bsc1234598 bsc1235367 bsc1239493 bsc1241819 bsc1251471 bsc1251663 bsc1253576 Cross-References: CVE-2024-453...

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

cve-2026-47889 - MEDIUM - Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse...

java-1.8.0-openjdk security update

1.8.0.504.b01-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.504.b01-1.1 - Update to 8u504-b01 GA. - Update release notes for 8u504-b01. - Bump FreeType version to 2.14.3 following JDK-8385390 - Sync the copy of the portable specfile with the latest update - This tarball is embargoe...

java-21-openjdk security update

1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625 1:21.0.12.1.1-1.1 - Update to jdk-21.0.12.1+1 GA - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - This...

Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2026-55775)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55775 advisory. 1.8.0.504.b01-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.504.b01-1.1 - Update to 8u504-b01 GA. - Update release notes for...

cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting XSS...

java-17-openjdk security update

17.0.20.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.1.1-1.1 - Update to jdk-17.0.20.1+1 GA - Add to .gitignore openjdk-17.0.20.1+1.tar.xz - Set patchver to 1 - Set buildver to 1 - Update sources to openjdk-17.0.20.1+1.tar.xz - This tarball is embargoed until 2026-08-18 @ 1p...

java-25-openjdk security update

1:25.0.4.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:25.0.4.1.1-1.1 - Update to jdk-25.0.4.1+1 GA - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - This tarball is embargoed until 2026-08-18 @ 1p...

PT-2026-79240

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote attackers can bypass security restrictions because the system does not properly limit pathnames to restricted directories. Recommendations At the moment, there is no...

PT-2026-80606

These are all security issues fixed in the MozillaThunderbird-140.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

Virtuozzo Infrastructure 7.3 Update 1 Hotfix 3 (7.3.1-66)

This update provides security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2026-231-02)

The version of mozilla-thunderbird installed on the remote host is prior to 140.14.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-231-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

kernel security, bug fix, and enhancement update

6.12.0-211.49.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Binding to an Unrestricted IP Address

Overview org.springframework.security:spring-security-ldap is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Binding to an...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of the content type caching process. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...