CLEANSTART-2026-OM15124 Security fix for CVE-2024-3177 applied in: local-static-provisioner 2.6.0-r1

Security vulnerability affects the local-static-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EF04271 Security fix for CVE-2023-5528 applied in: local-static-provisioner 2.6.0-r1

Security vulnerability affects the local-static-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-FI30695 Security fix for CVE-2023-3955 applied in: flux-notification-controller-fips 1.9.2-r0, local-static-provisioner 2.6.0-r1

CVE-2023-3955 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DE45486 Security fix for CVE-2023-3676 applied in: flux-notification-controller-fips 1.9.2-r0, local-static-provisioner 2.6.0-r1

CVE-2023-3676 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

CVE-2026-92714

CVE-2026-92714 affects the Download Manager WordPress plugin (versions ≤ 3.3.68) with an Insecure Direct Object Reference (IDOR) in the duplicate() function hooked on admin_init. The handler only checks the generic edit_posts capability and a plugin-wide static nonce, without an object-level auth...

Path Traversal

Grav is vulnerable to Path Traversal. The vulnerability is due to improper directory-boundary validation in the static asset server, which allows an unauthenticated attacker to exploit path prefix matching and access files from sibling directories outside the configured asset directory...

Security Bulletin: Vulnerability in Spring Framework affects DB2 Dev Extension (CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41846)

Summary Upgraded spring-webmvc to 6.2.19 to remediate CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, and CVE-2026-41846 Information Disclosure, DoS, Path Traversal, Open Redirect, XSS — highest CVSS Base Score 7.5 High — PVR0786341. Vulnerability Details CVEID:CVE-2026-41841...

CVE-2026-90395

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

CVE-2026-90151

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

CVE-2026-28326

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key...

EUVD-2026-52281

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...

EUVD-2026-82317

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key...

CVE-2026-28326 SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key...

CVE-2026-28326

SolarWinds Access Rights Manager (ARM) is affected by an unauthenticated remote code execution vulnerability caused by a hardcoded static key . The CVSS v3.1 score is 8.8 (HIGH) , with an adjacent network attack vector, no required privileges, and no user interaction. Impact is High across confid...

CVE-2026-28326 SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key...

CVE-2026-93076 dax/fsdev: clear vmemmap_shift when binding static pgmap

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

EUVD-2026-82055

In the Linux kernel, the following vulnerability has been resolved: power: supply: sc2731charger: cancel work on remove The USB notifier and initial charger detection can schedule info-work. The remove path unregisters the notifier, but does not cancel queued or running work before the...

Security Bulletin: Insecure Deserialization Vulnerability in Mina Core Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-47065)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-47065 DESCRIPTION: ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed...

Improper Handling of Case Sensitivity

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the route matching process. An attacker can access protected files by altering the letter case of a path segment in a...