Complete feed
Security advisories & CVEs
357 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-9491] server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information
Synology has released a security update for the Synology Chat Server package in DSM to address multiple vulnerabilities: CVE-2026-40541 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. CVE-2026-9491 allows remote authenticated users to obtain non-sensitive information. Please refer to the ' Affected products named by the advisory: Synology Chat Server for DSM 7.3; Synology Chat Server for DSM 7.2.2; Synology Chat Server for DSM 7.2.1.
Medium [CVE-2026-59871] Tar Vulnerability in NetApp Products
Tar versions prior to 7.5.18 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: NetApp HCI Baseboard Management Controller (BMC) - H610S. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-59875] Tar Vulnerability in NetApp Products
Tar versions prior to 7.5.17 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: NetApp HCI Baseboard Management Controller (BMC) - H610S. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-44170] Mariadb Vulnerability in NetApp Products
MariaDB versions 10.6.1 prior to 10.6.25, 10.11.1 prior to 10.11.17, 11.4.1 prior to 11.4.11, 11.8.1 prior to 11.8.7, and 12.3.1 prior to 12.3.2 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-59888] FasterXML Jackson Databind Vulnerability in NetApp Products
FasterXML Jackson Databind versions 2.15.0-rc1 through 2.18.7, 2.19.0-rc2 through 2.21.3, and 3.0.0-rc1 through 3.1.3 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-45292] OpenTelemetry Java Vulnerability in NetApp Products
OpenTelemetry Java versions through 1.61.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-59889] FasterXML Jackson Databind Vulnerability in NetApp Products
FasterXML Jackson Databind versions 2.18.0-rc1 through 2.18.8, 2.18.0-rc1 through 2.18.8, 2.21.0 through 2.21.4, 2.21.0 through 2.21.4, 2.22.0 through 2.22.0, 2.22.0 through 2.22.0, 3.0.0-rc1 through 3.1.4, 3.0.0-rc1 through 3.1.4, 3.2.0 through 3.2.0, and 3.2.0 through 3.2.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Low [CVE-2026-22056] Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service. Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: StorageGRID (formerly StorageGRID Webscale). NetApp states there is no workaround available at this time.
Critical [CVE-2026-78174] WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.
Critical [CVE-2026-19315] type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Critical [CVE-2026-13086] stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code
A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.
Critical [CVE-2026-19313] heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Critical [CVE-2026-19318] stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.
Critical [CVE-2026-59313] Spring Framework: Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE). Affected product named by the advisory: Spring Framework.
Critical [CVE-2026-59283] Spring Framework: Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnera…
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8
Critical [CVE-2026-59354] Spring Security: In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registra…
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF). Affected product named by the advisory: Spring Security (OAuth2 Authorization Server module).
Critical [CVE-2026-47892] Spring Framework: WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header pr…
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8
Critical [CVE-2026-47891] Spring Framework: Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the…
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8
Critical [CVE-2026-47890] Spring Framework: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view…
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8
Critical [CVE-2026-47884] Spring Framework: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping…
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8