2026

Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (

Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-contro

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses withou

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parame

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generat

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_assertin

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted is

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSO

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mon

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfe

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-ran

The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index st

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.

When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an invariant which

In MongoDB Server 8.0, an aggregation stage can leave its _subPipeline field null during processing of certain pipelines

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of th

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side F

A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. W

lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to vers

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to vers

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Input Validation v

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consu

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Input Validation v

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparo

CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Improper Limitation of a Pa

OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbit

OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that al

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerabil

Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result i

Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result i

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-bounds read vulnerability that

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Stack-based Buffer Overflow vulnerabili

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Heap-based Buffer Overflow vulnerabilit

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulne

ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that c

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Dir

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could re