1011 matches found
CVE-2026-90595
CVE-2026-90595 is a missing authorization flaw in wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The vulnerability resides in the OnlineController.getOnlineInfo function within aceModules/ace-admin/auth/controller/OnlineController.java. A remote attacker with low privileges can exploit...
EUVD-2026-77093
A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...
CVE-2026-90594 wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
CVE-2026-90594
A missing authorization (fail-open) vulnerability in the Permission Service of wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0 affects the function PermissionService.checkUserPermission in /rpc/service/PermissionService.java. The flaw allows remote attackers with low privileges to bypass p...
EUVD-2026-77092
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
CVE-2026-90594 wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
PT-2026-90971
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
CVE-2026-90594: Missing Authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
CVE-2026-90595: Missing Authorization
A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The manipulation results in missing authorization. The attack can be executed...
PT-2026-90974
Name of the Vulnerable Software and Affected Versions wxiaoqi Spring-Cloud-Platform version 1.0 wxiaoqi Spring-Cloud-Platform version 2.2 wxiaoqi Spring-Cloud-Platform version 3.0 Description A security flaw allows remote attackers to bypass authorization. The issue resides in the getOnlineInfo...
Vulnerabilities Affecting SICK CorivaEngine
SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate...
Improper Filtering Of HTTP Headers
Spring Cloud Function is vulnerable to improper filtering of HTTP headers. The vulnerability is due to insufficient validation and filtering of HTTP headers, which allows an attacker to send specially crafted HTTP requests containing malicious or unexpected headers and potentially influence...
Improper Input Validation
org.springframework.cloud, spring-cloud-context is vulnerable to improper input validation. The vulnerability is due to the absence of property-key allow-list validation, which allows an attacker with access to the writable /actuator/env endpoint to inject or modify arbitrary environment properti...
Improper Caching
Spring Cloud Stream is vulnerable to improper caching of the original content type. The vulnerability is due to the Avro handling component caching the original content type, where the cached value is reused for subsequent messages and an attacker can supply a crafted content type to cause...
CVE-2026-47837
A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...
Denial-of-Service (DoS)
Spring Cloud Config is vulnerable to a Denial-of-Service DoS. The vulnerability is due to the Spring Cloud Config Monitor processing maliciously crafted payloads, which allows an attacker to send specially crafted requests that can exhaust application resources and cause the affected service to...
Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for September 2026, which includes 973 vulnerabilities affecting a range of products, including 113 that Microsoft marked as "critical." Microsoft notes that 2 of the vulnerabilities disclosed this month have been exploited in the wild:...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...
