jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
CVE-2026-83557
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used wi
#cwe-915
共收录 137 条相关情报。
← 返回所有主题Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOba...
CVE-2026-78038
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban all
Job argument injection via :args overrides primary_key and tenant in AshOban
CVE-2026-78038
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban all
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Sprin...
CVE-2026-59284
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commo
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data R...
CVE-2026-47849
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Pa
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5....
CVE-2026-47850
Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanyin...
CVE-2026-77144
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of a...
CVE-2026-71504
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers wi
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search con...
CVE-2026-78416
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code ex
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/client.py checks a dictionary supplied through the fieldname ...
CVE-2026-62315
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_value in frappe/clie
Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largep...
CVE-2026-49428
Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepa
4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithu...
CVE-2026-53958
4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the...
CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to unauthori...
CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function
A flaw was found in the `search-v2-operator` component. A user with specific administrative...
CVE-2026-71473
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed clu
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inje...
CVE-2026-71473
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed clu
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.
CVE-2026-17095
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe r
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search...
CVE-2026-72778
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code ex
A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a...
CVE-2026-18617
A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the sp
A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the...
CVE-2026-18617
A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the sp