Aggregator

CVE-2026-50568 | Fission up to 1.24.x pkg/utils/utils.go resolution of path (GHSA-r5jh-q2mw-gcx4 / EUVD-2026-36072)

Vuldb Updates
1 day 9 hours ago
A vulnerability described as problematic has been identified in Fission up to 1.24.x. This issue affects some unknown processing of the file pkg/utils/utils.go. The manipulation results in improper resolution of path equivalence. This vulnerability is reported as CVE-2026-50568. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-45062 | dunglas frankenphp prior 1.12.3 CGI Path Splitting unicode encoding (EUVD-2026-36075)

Vuldb Updates
1 day 9 hours ago
A vulnerability has been found in dunglas frankenphp and classified as problematic. This affects an unknown part of the component CGI Path Splitting. Performing a manipulation results in improper handling of unicode encoding. This vulnerability is identified as CVE-2026-45062. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.
vuldb.com

CVE-2026-46654 | Plonky3 up to 0.4.2/0.5.2 cryptographic primitive risky implementation (GHSA-vj64-rjf3-w3v7 / EUVD-2026-36119)

Vuldb Updates
1 day 9 hours ago
A vulnerability marked as problematic has been reported in Plonky3 up to 0.4.2/0.5.2. Affected is an unknown function. The manipulation leads to use of a cryptographic primitive with a risky implementation. This vulnerability is referenced as CVE-2026-46654. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-5497 | vLLM up to 0.18.x OpenAI-compatible Chat Completions API VideoMediaIO.load_base64 resource consumption (EUVD-2026-36217)

Vuldb Updates
1 day 9 hours ago
A vulnerability, which was classified as problematic, was found in vLLM up to 0.18.x. Affected is the function VideoMediaIO.load_base64 of the component OpenAI-compatible Chat Completions API. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-5497. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.
vuldb.com

CVE-2026-53901 | cerebrate up to 1.36 add params dynamically-determined object attributes (EUVD-2026-36216)

Vuldb Updates
1 day 9 hours ago
A vulnerability was found in cerebrate up to 1.36. It has been declared as critical. This vulnerability affects the function Add. The manipulation of the argument params results in dynamically-determined object attributes. This vulnerability is reported as CVE-2026-53901. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-53465 | ImageMagick up to 7.1.2-24 SF3 Encoder heap-based overflow (GHSA-44cp-c3ww-9rv5 / EUVD-2026-36192)

Vuldb Updates
1 day 9 hours ago
A vulnerability was found in ImageMagick up to 7.1.2-24. It has been declared as critical. This affects an unknown part of the component SF3 Encoder. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is handled as CVE-2026-53465. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-41694 | Vmware Spring Security up to 7.0.5 SAML Response signature verification (CNNVD-202606-2873)

Vuldb Updates
1 day 9 hours ago
A vulnerability classified as problematic was found in Vmware Spring Security up to 7.0.5. Affected is an unknown function of the component SAML Response Handler. Executing a manipulation can lead to improper verification of cryptographic signature. This vulnerability is handled as CVE-2026-41694. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.
vuldb.com

CVE-2026-41696 | Vmware Spring Data MongoDB up to 5.0.5 String data query logic injection (CNNVD-202606-2872)

Vuldb Updates
1 day 9 hours ago
A vulnerability was found in Vmware Spring Data MongoDB up to 5.0.5. It has been rated as problematic. The affected element is an unknown function of the component String Handler. The manipulation leads to improper neutralization of special elements in data query logic. This vulnerability is listed as CVE-2026-41696. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.
vuldb.com

CVE-2026-41003 | Vmware Spring Security up to 7.0.5 RelyingPartyRegistration cross site scripting (CNNVD-202606-2875)

Vuldb Updates
1 day 9 hours ago
A vulnerability was found in Vmware Spring Security up to 7.0.5. It has been classified as problematic. This issue affects some unknown processing of the component RelyingPartyRegistration. Performing a manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-41003. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-41008 | Vmware Spring Security/Spring Authorization Server Authorization Endpoint request_uri redirect (CNNVD-202606-2874)

Vuldb Updates
1 day 9 hours ago
A vulnerability was found in Vmware Spring Security and Spring Authorization Server. It has been declared as problematic. Impacted is an unknown function of the component Authorization Endpoint. Executing a manipulation of the argument request_uri can lead to open redirect. This vulnerability is tracked as CVE-2026-41008. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.
vuldb.com

CISA orders federal agencies to “patch smarter”

Help Net Security
1 day 9 hours ago

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a Binding Operational Directive that will change how the US federal government approaches vulnerability management. The directive arrives as the patching problem has become nearly unmanageable, driven by a surge in newly published vulnerabilities and by AI tools that are accelerating both security research and exploit development on the attacker side. Towards risk-based vulnerability management BOD 26-04 introduces a framework that allow federal civilian Executive … More →

The post CISA orders federal agencies to “patch smarter” appeared first on Help Net Security.

Zeljka Zorz

Managed ad