Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring-context-support(CVE-2026-59280)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring-context-supportCVE-2026-59280 Vulnerability Details CVEID:CVE-2026-59280 DESCRIPTION: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a vi...

RHLW-2026-80029B2333A1C4B6 Lightwell Security Advisory: spring-context 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-context 5.3.18.rhlw-00010 with backported fixes for CVE-2022-22968, CVE-2024-38820, and CVE-2025-22233. CVE-2022-22968: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145

Activiti through 7.1.0.M6 contains an expression injection vulnerability in its mail task handling. The root cause is a failure to validate hash-brace (#{}) deferred expressions in process variables, allowing an attacker to bypass expression filtering. Injected expressions are stored and later ev...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145: Improper Neutralization of Special Elements used in an Expression Language Statement

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

PT-2026-91743

Name of the Vulnerable Software and Affected Versions Activiti versions prior to 7.1.0.M7 Description Failure to validate hash-brace deferred expressions in process variables allows attackers to bypass expression filtering. By injecting expressions starting with , an attacker can store these...

CVE-2026-42588

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +2082 more potentially affected by CVE-2026-59280 via org.springframework:spring-context-support (>=7.0.0, <=7.0.8)

org.springframework:spring-context-support MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.0.0-beta.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =1.5.0, =1.7.0 and more Source cves: CVE-2026-59280 Source advisory: MEND:CVE-2026-59280...

K000162426: Apache ActiveMQ vulnerability CVE-2026-34197

Security Advisory Description Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, Spring Beans and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, SnakeYAML, Spring Beans, Logback Classic and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring...

org.springframework:spring-aop (2.0-m1), org.springframework:spring-beans (2.0-m1) +13 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.0-m1)

org.springframework:spring-core MAVEN version 2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 2.0-m1 - org.springframework:spring-beans 2.0-m1 -...

org.springframework:spring-aop (1.2.1), org.springframework:spring-beans (1.2.1) +10 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.1)

org.springframework:spring-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.1 - org.springframework:spring-beans 1.2.1 -...

org.springframework:spring-aop (1.2.4), org.springframework:spring-beans (1.2.4) +10 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.4)

org.springframework:spring-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.springframework:spring-aop 1.2.4 - org.springframework:spring-beans 1.2.4 -...

org.jasig.service:person-directory (1.0.1), org.jasig:person-directory (1.0.0) +26 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.0.3)

org.springframework:spring-core MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.jasig.service:person-directory 1.0.1 - org.jasig:person-directory 1.0.0 -...