CVE-2026-47885

This vulnerability affects the PartEventHttpMessageReader in Spring WebFlux , which fails to enforce the maxPartSize limit when maxInMemorySize is set to -1, potentially allowing oversized multipart data to be processed without the intended size constraint. Affected versions are Spring Framework ...

EUVD-2026-66837

Spring Data REST does not guard identifier @Id and version @Version properties against mutation via RFC 6902 JSON Patch application/json-patch+json requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7....

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

SUSE CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...

SUSE CVE-2026-80573

In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input packet lengths iforceprocesspacket reads fixed fields from joystick, wheel and status packets without first checking their lengths. In particular, the shared hats-and-buttons helper unconditionally...

SUSE CVE-2026-80576

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

SUSE CVE-2026-80587

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...

EUVD-2026-67109

Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30064

Improper input validation in the buildFilter function processor/processor.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-82603

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to re-derive and validate fingerprints when loading identities from the identity.json file. This allows attackers to substitute legitimate public keys in identity stores wi...

CVE-2026-30058

CVE-2026-30058 affects free5gc v4.0.1 , an open-source 5G core implementation. The HTTPModifySubscription handler contains an Improper Input Validation flaw that allows a remote, unauthenticated attacker to trigger a Denial of Service by sending a crafted input. The vulnerability is scored CVSS 3...

SUSE SLES15 Security Update : kernel (Live Patch 26 for SUSE Linux Enterprise 15 SP6) (SUSE-SU-2026:3775-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3775-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.112 fixes various security issues: The following security issues were fixed: -...

PT-2026-82756

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

SUSE SLES15 Security Update : kernel (Live Patch 14 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3774-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3774-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.52 fixes various security issues: The following security issues were fixed: -...

CVE-2026-30064

free5gc v4.0.1 is affected by an improper input validation flaw in the buildFilter function (file: processor/processor.go). An unauthenticated remote attacker can supply a crafted input to trigger a Denial of Service (DoS) . The vulnerability is scored CVSS 3.1: 7.5 (High) with a vector of AV:N/A...

CVE-2026-35869

A Command Injection vulnerability in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0 allows unauthenticated, network-based attackers to execute arbitrary operating system commands. The root cause is insufficient validation and sanitization of user-s...

PT-2026-82446

Name of the Vulnerable Software and Affected Versions Spring Security OAuth2 Authorization Server versions 7.0.0 through 7.0.4 Description When Dynamic Client Registration is enabled, the registration endpoint does not sufficiently validate certain client metadata fields provided by the registeri...

EUVD-2026-67116

Improper input validation in the HandleUpdate function /sbi/parameterprovision.go of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-30068

free5gc v4.0.1 is affected by an improper input validation flaw in the HandleUpdate function located at /sbi/parameter_provision.go. An unauthenticated, remote attacker can cause a Denial of Service (DoS) by sending a crafted input to the vulnerable endpoint. The CVSS v3.1 score is 7.5 (HIGH) , r...

PT-2026-82742

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...