EUVD-2026-66638

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-35445 Winter: Authenticated backend users can bypass Users controller permission checks

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CVE-2026-81036

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036 Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

EUVD-2026-66612

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-81036

Stalwart Mail Server through 0.16.19 fails to validate OAuth redirect_uri against registered destinations in its default configuration. The root cause lies in crates/http/src/auth/oauth/registration.rs, where the validation routine returns success immediately because the client-authentication req...

CVE-2026-81030

Mage AI through version 0.9.79 is affected by an arbitrary file read via its browser-items API endpoint. The BrowserItemResource in mage_ai/api/resources/BrowserItemResource.py passes a caller-supplied path to filesystem read/write helpers without invoking the containment helper that its sibling ...

CVE-2026-81030 Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...

CVE-2026-81029 OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-81029

OpenMetadata versions prior to 2.0.0 are vulnerable to JWT disclosure via unvalidated SAML and OIDC redirect URIs . The SamlLoginServlet stores a caller-supplied callback parameter in the HTTP session without validating it against registered destinations; the assertion consumer servlet then redir...

CVE-2026-80526

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

UBUNTU-CVE-2026-80571

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

CVE-2026-80571

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

CVE-2026-80526

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80526 ASoC: tas2562: Validate values for volume writes

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

GHSA-79GF-7FRW-68M9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Summary In Kyverno v1.18.1, a tenant who can create a NamespacedMutatingPolicy in their own namespace can instruct the admission controller to generate resources in any namespace by passing an arbitrary namespace string to the CEL generator.applynamespace, resources function. Details...

CVE-2026-54523 Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

EUVD-2026-66561

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...