12652 matches found
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-1672...
opentaint analyzer/2026.07.24.401b297
The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...
Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE
TL;DR:A critical remote code execution vulnerability has been disclosed in FastJson, a widely used JSON processing library for Java. The vulnerability, assigned CVE-2026-16723 with a CVSS score of 9.0 Critical, affects FastJson versions 1.2.68 through 1.2.83 under specific Spring Boot deployment...
K000162436: Spring Web Flow vulnerability CVE-2026-40985
Security Advisory Description Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1. CVE-2026-40985 Impact There is no impact; F5 products are not...
K000162435: Spring Data REST vulnerability CVE-2026-41728
Security Advisory Description Spring Data REST's JSON Patch application/json-patch+json implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16;...
K000162431: Spring Integration vulnerability CVE-2026-40987
Security Advisory Description A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0...
K000162426: Apache ActiveMQ vulnerability CVE-2026-34197
Security Advisory Description Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access...
K000162395: Spring AMQP vulnerability CVE-2026-41701
Security Advisory Description Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...
Security Bulletin: Security Vulnerability in Spring-Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22732)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring-Security Vulnerability Details CVEID:CVE-2026-22732 DESCRIPTION: When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility th...
Deserialization of Untrusted Data
Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...
Vulnerabilities found in Oracle Financial Services
Oracle has identified vulnerabilities in various Financial Services modules. Oracle has also processed updates for various third-party products. The vulnerabilities include code injection through malicious schemes in Apache Avro, unauthorized access to sensitive data in various Oracle products, a...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Vulnerable to Regular Expression Denial of Service (ReDoS)
Summary spring-core-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41848. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-webmvc-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846. Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure...
opentaint analyzer/2026.07.22.49c8792
The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...
CLEANSTART-2026-ZG11653 Security fixes for ghsa-4265-ccf5-phj5, ghsa-4g9r-vxhx-9pgx applied in versions: 3.4.13-r0
Multiple security vulnerabilities affect the spring-boot package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-JI44198 Security fixes for ghsa-j288-q9x7-2f5v applied in versions: 3.5.13-r0
Security vulnerability affects the spring-boot package. This issue is resolved in later releases. See references for vulnerability details...
Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.
Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...
