Complete feed
Security advisories & CVEs
356 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-80179] Denial of Service via malformed JWE tokens
Denial of Service via malformed JWE tokens. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI); Red Hat OpenStack Platform 16.2.
Medium [CVE-2026-59315] Spring Cloud: The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads.
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 3.1.14 and earlier
Medium [CVE-2026-81893] invalid write in JPEG ICC profile parser on error recovery
invalid write in JPEG ICC profile parser on error recovery. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: gdk-pixbuf2.
Medium [CVE-2026-59281] Spring Framework: Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then re…
Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS) vulnerability. Spring Framework 7.0.0 - 7.0.8
Medium [CVE-2026-59276] Spring Security: Several components in Spring Security compare security-sensitive values using standard string equality (String.equals…
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value.
Medium [CVE-2026-4398] Authorization Bypass Through User-Controlled Key in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own project, due to missing namespace validation on self-managed instances.
Medium [CVE-2026-59272] RabbitMQ: Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exp…
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0
Medium [CVE-2026-59280] Spring Framework: Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a cont…
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 5.2.25.RELEASE and earlier
Medium [CVE-2026-81668] Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup
Cross-tenant Content View Filter rule access and modification via unauthorized parent filter lookup. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-639. Affected product named by the advisory: Red Hat Satellite 6.
Medium [CVE-2026-81658] Cross-tenant disclosure of template revisions via unauthorized audit lookup
Cross-tenant disclosure of template revisions via unauthorized audit lookup. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-639. Affected product named by the advisory: Red Hat Satellite 6.
Medium [CVE-2026-80489] Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state
Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: glibc.
Medium [CVE-2026-59355] Spring Authorization Server: Open Redirect via request_uri parameter
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Medium [CVE-2026-59271] RabbitMQ: When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thr…
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0
Medium [CVE-2026-47887] Spring Framework: Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a…
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8
Medium [CVE-2026-47883] Spring Framework: UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns.
UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8
Medium [CVE-2026-47894] Spring Cloud: Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the config…
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 3.1.14 and earlier
Medium [CVE-2026-38350] Integer overflow leads to Denial of Service
Integer overflow leads to Denial of Service. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-38347] Heap overflow vulnerability leads to Denial of Service
Heap overflow vulnerability leads to Denial of Service. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-38348] Denial of Service via crafted image file due to integer overflow
Denial of Service via crafted image file due to integer overflow. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-38343] Denial of Service via integer overflow in video scaling
Denial of Service via integer overflow in video scaling. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).