SUSE CVE-2026-46327

In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dmsuspendedmd The function dmblkreportzones tests if the device is suspended with the "dmsuspendedmd" call. However, this function is called without holding any locks, so the device may be suspended just...

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

com.bgiddens:spring-data-rest-utils (>=0.0.1-beta, <=0.0.7-beta), com.boschsemanticstack:semanticstack-rql-examples-querydsljpa (>=3.0.0, <=3.0.1) +31 more potentially affected by CVE-2026-41730 via org.springframework.data:spring-data-rest-core (>=5.0.0, <=5.0.5)

org.springframework.data:spring-data-rest-core MAVEN version =5.0.0, =0.0.1-beta, =3.0.0, =3.0.0, =3.0.9, =3.0.9, =3.0.9, =2026.05, =4.0.0, =4.0.2 and more Source cves: CVE-2026-41730 Source advisory: GHSA-P5MM-XWGQ-WH...

be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +171 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)

org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

com.github.shoothzj:sdk-distribute-impl-mongo (3.0.27.release), de.bwaldvogel:mongo-java-server-test-common (>=1.35.0, <=1.36.0) +3 more potentially affected by CVE-2026-41717 via org.springframework.data:spring-data-mongodb (2.2.10.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.shoothzj:sdk-distribute-impl-mongo 3.0.27.release -...

com.wavemaker.runtime:wavemaker-app-runtime-core (>=11.3.0, <=11.8.5.ee), io.github.grails-spring-security-saml:spring-security-saml (>=6.0.9, <=6.0.10) +4 more potentially affected by CVE-2026-41694 via org.springframework.security:spring-security-saml2-service-provider (>=5.8.0, <=5.8.16)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =5.8.0, =11.3.0, =6.0.9, =1.19.1, =1.19.1, =5.26.4, =5.26.4, =5.27.15 Source cves: CVE-2026-41694 Source advisory: GHSA-WW38-37G9-M3Q3...

ACPM Multithreaded Minimal Transfer Stress Tester

This C program is a lightweight multi-threaded stress test designed to evaluate concurrent behavior of the acpmdoxfer interface under repeated small-size transfer operations across multiple threads sharing the same ACPM handle...

io.camunda.connector:connector-runtime-bundle (>=8.5.0-alpha2, <=8.6.0-alpha5), io.camunda.connector:connector-soap (>=8.5.0-alpha2, <=8.9.0-alpha2) +7 more potentially affected by CVE-2026-40997 via org.springframework.ws:spring-ws-security (>=4.0.0, <=4.1.3)

org.springframework.ws:spring-ws-security MAVEN version =4.0.0, =8.5.0-alpha2, =8.5.0-alpha2, =8.5.0-alpha2, =7.0.0-rc1, =5.0.0, =5.0.0, =7.0.0-rc3, =7.0.0-rc3, =7.1.6.2 Source cves: CVE-2026-40997 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKWS-17320569...

CVE-2026-46481

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2026-49842 FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...

CVE-2026-49842 FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...

CVE-2026-49842

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...

CVE-2026-49842

CVE-2026-49842 - FreeSWITCH mod_verto pre-auth bandwidth amplification : Before v1.11.1, FreeSWITCH’s mod_verto WebSocket frame loop processed a #-prefixed speed-test protocol (#SPU/#SPB/#SPE) prior to authentication. The payload size in #SPU was parsed with atoi() and non-positive values were re...

EUVD-2026-35473

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...

CVE-2026-49842 FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's WebSocket frame loop intercepts a -prefixed speed-test protocol SPU / SPB / SP...

CVE-2026-46327

In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dmsuspendedmd The function dmblkreportzones tests if the device is suspended with the "dmsuspendedmd" call. However, this function is called without holding any locks, so the device may be suspended just...

Security Bulletin: DevOps Test Performance / Rational Performance Tester contains a vulnerability related to use of the AsyncHttpClient (AHC) library

Summary Due to use of the AsyncHttpClient AHC library, DevOps Test Performance / Rational Performance Tester, contains a potential vulnerability exposing sensitive session cookies or other credentials. CVE-2026-45300 Vulnerability Details CVEID:CVE-2026-45300 DESCRIPTION: The AsyncHttpClient AHC...