cve-2026-59328 - MEDIUM - CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

EUVD-2026-48591

Improper Link Resolution CWE-59 in /usr/bin/larmstarter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group leading to root privilege escalation via a symlink attack on...

Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

Summary In addition to many updates of operating system level packages, Multiple vulnerabilities were addressed in IBM Process Automation Manager Open Edition Starter Kit for Banking -9.4.2 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fai...

PYSEC-2026-2396 Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit

Summary An issue has been identified in the Bedrock AgentCore Starter Toolkit versions prior to v0.1.13 that may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. Impact A remote actor could inject code during the build process,...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21276-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21276-1 advisory. Changes in apptainer: - Enable building of SUID starter for SLES 15 jscPED-16347. Security fix for CVE-2026-2303 bsc1270529: Heap Out-of-Bounds Read in...

CVE-2026-13250

The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all...

EUVD-2026-43141

The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete all...

SUSE-RU-2026:2815-1 Recommended update for apptainer

This update for apptainer contains the following fixes: Security fixes included on this update: - CVE-2026-2303: go.mongodb.org/mongo-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1270529. Other fixes: - Enable building of SUID starter for SLES 15 jscPED-16347...

OPENSUSE-SU-2026:21276-1 Security update for apptainer

This update for apptainer fixes the following issues: Changes in apptainer: - Enable building of SUID starter for SLES 15 jscPED-16347. Security fix for CVE-2026-2303 bsc1270529: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver. The dependency on mongo-driver has be...

MAL-2026-6679 Malicious code in agent-starter-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6a3e60c2dc67c55d728aaefbc972de29f46bdbfe7f013b3b6cde05907c2397 Package [email protected] was scanned with no a static rule matches and no behavioral findings. No lifecycle scripts, network destinations,...

Malicious code in agent-starter-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6a3e60c2dc67c55d728aaefbc972de29f46bdbfe7f013b3b6cde05907c2397 Package [email protected] was scanned with no a static rule matches and no behavioral findings. No lifecycle scripts, network destinations,...

MAL-2026-5664 Malicious code in @tribe-digital/shopify-starter-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d20022a66a46ee0bc6a944946691b3746c8e0262e00b90891bd6ef26519e8a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tribe-digital/shopify-starter-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d20022a66a46ee0bc6a944946691b3746c8e0262e00b90891bd6ef26519e8a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

cn.aradin:aradin-spring-actuator-starter (>=1.1.0 <=1.1.2), cn.hdfk7.boot:hdfk7-boot-starter-common (>=1.0.0 <=3.0.3) +354 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=3.0.0 <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.0.0, =1.1.0, =1.0.0, =3.1.0.5, =3.3.0.0, =1.0.0-JDK21, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-17308629...

ai.h2o:h2o-algos (=0.1.9), ai.h2o:h2o-app (=0.1.9) +2053 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-kqueue (>=4.1.11.Final <=4.1.134.Final)

io.netty:netty-transport-native-kqueue MAVEN version =4.1.11.Final, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.1.0, =0.0.1, =2.4.0, =1.5.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-45536 Source advisory: OSV:GHSA-W573-9FFJ-6FF9...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +1044 more potentially affected by CVE-2026-44894 via io.netty:netty-codec-classes-quic (>=4.2.10.Final <=4.2.14.Final)

io.netty:netty-codec-classes-quic MAVEN version =4.2.10.Final, =0.1.0, =0.1.0, =0.0.1-alfa, =0.0.1-demo, =6.0.1, =4.0.3-M1, =1.21.9, =1.0.5, =3.6.4, =1.0.1, =26.2.1, =26.6.1 and more Source cves: CVE-2026-44894 Source advisory: OSV:GHSA-CMM3-54F8-PX4J...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0 <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0 <=0.2.0) +2562 more potentially affected by CVE-2026-41710 via org.springframework.retry:spring-retry (>=2.0.0 <=2.0.12)

org.springframework.retry:spring-retry MAVEN version =2.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 - ai.superstream:spring-kafka =3.0.1-alpha1 and more Source cves: CVE-2026-41710 Source advisory:...

com.atomikos:transactions-spring-boot4 (=6.0.1), com.atomikos:transactions-spring-boot4-integration-tests (=6.0.1) +429 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (>=7.0.0-M7 <=7.0.7)

org.springframework:spring-jms MAVEN version =7.0.0-M7, =7.0.0, =3.0.0, =4.0.0-M2, =4.0.0-M2, =0.17.0, =26.1.0, =26.2.0 - com.solace.spring.boot:solace-jms-spring-boot-autoconfigure =6.0.0 - com.solace.spring.boot:solace-jms-spring-boot-starter =6.0.0 -...

OPENSUSE-SU-2026:20888-1 Security update for apptainer

This update for apptainer fixes the following issues: Changes in apptainer: - CVE-2026-39821: Update golang.org/x/net to 0.55.0. bsc1266656 - Add improved handling of suid-starter: Add system group apptainer Make sure, only users belonging to this group are able to run the application. Document...

@aiconnect/codelets-runner (>=0.1.0 <=0.2.0), @cairncms/api (>=1.0.0-beta.1 <=1.0.0-beta.4) +23 more potentially affected by CVE-2026-47210 via vm2 (>=3.0.0 <=3.11.3)

vm2 NPM version =3.0.0, =0.1.0, =1.0.0-beta.1, =3.0.46, =0.1.0, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =1.1.0, =0.2.0, =0.1.64, =0.1.61, =0.1.65 and more Source cves: CVE-2026-47210 Source advisory: SNYK:JS-VM2-17111321...