Common Vulnerabilities and Exposures (CVE)
CVE-2026-84823
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` paramet...
CVE-2026-94451
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn ...
CVE-2026-93432
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted ...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This p...
CVE-2026-92777
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.
CVE-2026-92629
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2026-89062
A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.
CVE-2026-89057
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
CVE-2026-75941
A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.
CVE-2026-16755
A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.
CVE-2026-16754
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
CVE-2026-94449
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, whe...
CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted i...
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicit...
CVE-2026-97781
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.