You are viewing a plain text version of this content. The canonical link for it is here.
- [ANN] Apache Ant 1.10.16 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/04/01 15:50:29 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 5.19.4 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/04/01 17:37:18 UTC, 0 replies.
- [ANNOUNCE] Apache Accumulo Access 1.0.0-beta2 - posted by Christopher <ct...@apache.org> on 2026/04/01 21:59:28 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Client C++ 4.1.0 released - posted by Yunze Xu <xy...@apache.org> on 2026/04/02 02:21:28 UTC, 0 replies.
- [ANNOUNCE] Apache Traffic Server 10.1.2 Release - posted by Chris McFarlen <cm...@apache.org> on 2026/04/02 15:21:16 UTC, 0 replies.
- [ANN] End Of Support for Tomcat Native 1.x - posted by Christopher Schultz <sc...@apache.org> on 2026/04/02 22:34:15 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.54 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/04/02 22:34:46 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.117 available - posted by Rémy Maucherat <re...@apache.org> on 2026/04/03 09:24:46 UTC, 0 replies.
- [ANN] Apache Syncope 4.1.0 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/04/03 11:07:05 UTC, 0 replies.
- [ANN] Apache Syncope 4.0.5 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/04/03 11:09:02 UTC, 0 replies.
- [ANNOUNCE] Apache SkyWalking 10.4.0 released - posted by Sheng Wu <wu...@apache.org> on 2026/04/03 15:24:40 UTC, 0 replies.
- [ANNOUNCE] Apache log4cxx 1.7.0 released - posted by Stephen Webb <sw...@apache.org> on 2026/04/04 03:14:53 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.0-RC1 - posted by James Daugherty <jd...@apache.org> on 2026/04/04 03:30:10 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.21 Available - posted by Mark Thomas <ma...@apache.org> on 2026/04/04 12:03:34 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.10 - posted by James Daugherty <jd...@apache.org> on 2026/04/04 14:47:20 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko (Core) 1.5.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/04/05 08:17:42 UTC, 0 replies.
- [ANNOUNCE] Apache Ratis 3.2.2 Release - posted by Xinyu Tan <ta...@apache.org> on 2026/04/06 07:25:00 UTC, 0 replies.
- CVE-2026-33227: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ Web: Improper Limitation of a Pathname to a Restricted Directory - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/06 13:07:18 UTC, 0 replies.
- CVE-2026-34197: Apache ActiveMQ Broker, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/06 13:07:37 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 3.0.0-M3 released - posted by Thomas Wolf <tw...@apache.org> on 2026/04/06 19:18:28 UTC, 0 replies.
- CVE-2026-35554: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition - posted by Manikumar <ma...@apache.org> on 2026/04/07 11:57:10 UTC, 0 replies.
- CVE-2026-27314: Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass - posted by Michael Semb Wever <mc...@apache.org> on 2026/04/07 13:57:41 UTC, 0 replies.
- CVE-2026-27315: Apache Cassandra: cqlsh history sensitive information leak - posted by Michael Semb Wever <mc...@apache.org> on 2026/04/07 13:57:47 UTC, 0 replies.
- CASSANDRA-21202: CVE-2026-32588: Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing - posted by Michael Semb Wever <mc...@apache.org> on 2026/04/07 13:57:54 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.2.0 Released - posted by Rahul Vats <ra...@apache.org> on 2026/04/07 14:42:31 UTC, 0 replies.
- [ANNOUNCE] Release Apache Fluss (fluss-rust) 0.1.0-incubating - posted by yunhong Zheng <yu...@apache.org> on 2026/04/08 02:15:22 UTC, 0 replies.
- [ANNOUNCE] Apache Xalan Java xslt 3.0 alpha1 released - posted by Mukul Gandhi <mu...@apache.org> on 2026/04/08 08:13:08 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Configuration 2.14.0 - posted by Gary Gregory <gg...@apache.org> on 2026/04/08 15:04:34 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow ADBC 23 Released - posted by David Li <li...@apache.org> on 2026/04/09 07:10:57 UTC, 0 replies.
- CVE-2026-34538: Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) - posted by Rahul Vats <ra...@apache.org> on 2026/04/09 08:57:57 UTC, 0 replies.
- [ANNOUNCE] Apache OpenMeetings 9.0.0 is released - posted by Maxim Solodovnik <so...@apache.org> on 2026/04/09 10:28:24 UTC, 0 replies.
- CVE-2025-57735: Apache Airflow: Airflow Logout Not Invalidating JWT - posted by Rahul Vats <ra...@apache.org> on 2026/04/09 11:07:53 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 5.19.5 has been released! - posted by Christopher Shannon <cs...@apache.org> on 2026/04/09 12:35:25 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.4 has been released! - posted by Christopher Shannon <cs...@apache.org> on 2026/04/09 12:38:16 UTC, 0 replies.
- CVE-2026-39304: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/09 12:42:17 UTC, 0 replies.
- CVE-2026-40046: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/09 12:44:03 UTC, 0 replies.
- CVE-2026-33005: Apache OpenMeetings: Insufficient checks in FileWebService - posted by Maxim Solodovnik <so...@apache.org> on 2026/04/09 14:18:19 UTC, 0 replies.
- CVE-2026-33266: Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt - posted by Maxim Solodovnik <so...@apache.org> on 2026/04/09 14:21:08 UTC, 0 replies.
- CVE-2026-34020: Apache OpenMeetings: Login Credentials Passed via GET Query Parameters - posted by Maxim Solodovnik <so...@apache.org> on 2026/04/09 14:23:50 UTC, 0 replies.
- The Apache Software Foundation Welcomes 45 New Members - posted by Brian Proffitt <bk...@apache.org> on 2026/04/09 16:56:21 UTC, 0 replies.
- [SECURITY] CVE-2026-24880 Apache Tomcat - Request smuggling via invalid chunk extension - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:14 UTC, 0 replies.
- [SECURITY] CVE-2026-25854 Apache Tomcat - Occasionally open redirect - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:17 UTC, 0 replies.
- [SECURITY] CVE-2026-29129 Apache Tomcat - Configured TLS cipher preference order not preserved - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:19 UTC, 0 replies.
- [SECURITY] CVE-2026-29145 Apache Tomcat and Tomcat Native - OCSP checks sometimes soft-fail even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:22 UTC, 0 replies.
- [SECURITY] CVE-2026-29146 Apache Tomcat - EncryptInterceptor vulnerable to padding oracle attack by default - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:24 UTC, 0 replies.
- [SECURITY] CVE-2026-32990 Apache Tomcat - The fix for CVE-2025-66614 is incomplete - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:26 UTC, 0 replies.
- [SECURITY] CVE-2026-34483 Apache Tomcat - Incomplete escaping of JSON access logs - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:30 UTC, 0 replies.
- [SECURITY] CVE-2026-34486 Apache Tomcat - Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:32 UTC, 0 replies.
- [SECURITY] CVE-2026-34487 Apache Tomcat - Cloud membership for clustering component exposed the Kubernetes bearer token - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:34 UTC, 0 replies.
- [SECURITY] CVE-2026-34500 Apache Tomcat - OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/04/09 19:03:36 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit 2.23.4-beta released - posted by Julian Reschke <re...@apache.org> on 2026/04/10 12:16:30 UTC, 0 replies.
- CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:40:17 UTC, 0 replies.
- CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:40:38 UTC, 0 replies.
- CVE-2026-34479: Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:41:00 UTC, 0 replies.
- CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:41:26 UTC, 0 replies.
- CVE-2026-34481: Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:42:13 UTC, 0 replies.
- CVE-2026-40021: Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:42:40 UTC, 0 replies.
- CVE-2026-40023: Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters - posted by Piotr Karwasz <pk...@apache.org> on 2026/04/10 13:43:02 UTC, 0 replies.
- [ANNOUNCE] Apache NiFi 2.9.0 Released - posted by Pierre Villard <pv...@apache.org> on 2026/04/10 17:46:22 UTC, 0 replies.
- [ANN] Apache Ant 1.10.17 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/04/10 19:02:24 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Node.js client 1.17.0 released - posted by Baodi Shi <ba...@apache.org> on 2026/04/12 12:06:35 UTC, 0 replies.
- [ANNOUNCE] Apache SkyWalking MCP 0.2.0 Released - posted by xue fan <qi...@apache.org> on 2026/04/12 14:58:54 UTC, 0 replies.
- [ANNOUNCE] Apache Storm 2.8.6 Released - posted by Richard Zowalla <rz...@apache.org> on 2026/04/12 18:22:42 UTC, 0 replies.
- CVE-2026-35337: Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling - posted by Richard Zowalla <rz...@apache.org> on 2026/04/12 18:23:33 UTC, 0 replies.
- CVE-2026-35565: Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI - posted by Richard Zowalla <rz...@apache.org> on 2026/04/12 18:23:54 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-04-08 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/04/12 18:51:55 UTC, 0 replies.
- CVE-2025-54057: Apache SkyWalking: Stored XSS vulnerability - posted by Zhenxu Ke <ke...@apache.org> on 2026/04/13 12:24:02 UTC, 0 replies.
- CVE-2026-34476: Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server - posted by Qiuxia Fan <qi...@apache.org> on 2026/04/13 12:53:08 UTC, 0 replies.
- CVE-2026-34884: Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server - posted by Qiuxia Fan <qi...@apache.org> on 2026/04/13 12:55:11 UTC, 0 replies.
- CVE-2025-66236: Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI - posted by Rahul Vats <ra...@apache.org> on 2026/04/13 14:18:01 UTC, 0 replies.
- CVE-2026-33858: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API - posted by Rahul Vats <ra...@apache.org> on 2026/04/13 14:21:22 UTC, 0 replies.
- CVE-2026-39816: Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService - posted by David Handermann <ex...@apache.org> on 2026/04/13 14:26:27 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-04-12 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/04/14 00:31:24 UTC, 0 replies.
- [ANNOUNCE] Apache IoTDB 2.0.8 released - posted by Haonan Hou <ha...@apache.org> on 2026/04/14 01:56:04 UTC, 0 replies.
- [ANNOUNCE] Apache APISIX 3.16.0 has been released - posted by Abhishek Choudhary <sh...@apache.org> on 2026/04/14 02:29:49 UTC, 0 replies.
- CVE-2026-31923: Apache APISIX: Openid-connect `tls_verify` field is disabled by default - posted by Abhishek Choudhary <sh...@apache.org> on 2026/04/14 02:36:29 UTC, 0 replies.
- CVE-2026-33929: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code - posted by Tilman Hausherr <ti...@apache.org> on 2026/04/14 02:36:49 UTC, 0 replies.
- CVE-2026-31924: Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP - posted by Abhishek Choudhary <sh...@apache.org> on 2026/04/14 02:40:32 UTC, 0 replies.
- CVE-2026-31908: Apache APISIX: forward auth plugin allows header injection - posted by Abhishek Choudhary <sh...@apache.org> on 2026/04/14 02:40:45 UTC, 0 replies.
- CVE-2025-54550: Apache Airflow: RCE by race condition in example_xcom dag - posted by Jarek Potiuk <po...@apache.org> on 2026/04/15 00:17:07 UTC, 0 replies.
- CVE-2026-30778: Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. - posted by Kai Wan <wa...@apache.org> on 2026/04/15 00:24:09 UTC, 0 replies.
- [ANNOUNCE] Apache Cloudberry (Incubating) 2.1.0 released - posted by Dianjin Wang <dj...@apache.org> on 2026/04/15 02:45:00 UTC, 0 replies.
- CVE-2026-25219: Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access - posted by Jarek Potiuk <po...@apache.org> on 2026/04/15 11:31:58 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Go Client 0.19.0 released - posted by Zike Yang <zi...@apache.org> on 2026/04/15 11:55:36 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.0 released - posted by David Jensen <dj...@apache.org> on 2026/04/15 13:10:44 UTC, 0 replies.
- [ANNOUNCE] Apache Pinot 1.5.0 Released - posted by Yash Mayya <ya...@apache.org> on 2026/04/15 20:31:51 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.0 - posted by James Daugherty <jd...@apache.org> on 2026/04/15 23:27:36 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.19.0 Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/04/16 11:49:27 UTC, 0 replies.
- CVE-2026-31987: Apache Airflow: JWT token appearing in logs - posted by Rahul Vats <ra...@apache.org> on 2026/04/16 13:30:05 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Client Python 3.11.0 released - posted by Yunze Xu <xy...@apache.org> on 2026/04/17 02:29:00 UTC, 0 replies.
- CVE-2026-33557: Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication - posted by Luke Chen <sh...@apache.org> on 2026/04/17 08:15:56 UTC, 0 replies.
- CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output - posted by Luke Chen <sh...@apache.org> on 2026/04/17 08:16:31 UTC, 0 replies.
- [ANN] Apache Maven 3.9.15 released - posted by Slawomir Jaranowski <sj...@apache.org> on 2026/04/17 09:29:04 UTC, 0 replies.
- CVE-2025-66335: Apache Doris MCP Server: MCP SQL inject - posted by Mingyu Chen <mo...@apache.org> on 2026/04/17 09:34:31 UTC, 0 replies.
- CVE-2026-30912: Apache Airflow: Exposing stack trace in case of constraint error - posted by Rahul Vats <ra...@apache.org> on 2026/04/17 10:15:40 UTC, 0 replies.
- CVE-2026-32690: Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 - posted by Rahul Vats <ra...@apache.org> on 2026/04/17 10:24:10 UTC, 0 replies.
- CVE-2026-30898: Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf - posted by Rahul Vats <ra...@apache.org> on 2026/04/17 10:28:55 UTC, 0 replies.
- CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to - posted by Rahul Vats <ra...@apache.org> on 2026/04/17 10:31:25 UTC, 0 replies.
- CVE-2026-25917: Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) - posted by Rahul Vats <ra...@apache.org> on 2026/04/17 10:34:42 UTC, 0 replies.
- CVE-2026-40948: Apache Airflow Keycloak Provider: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager - posted by Jarek Potiuk <po...@apache.org> on 2026/04/17 17:00:40 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.14.6 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/04/19 06:22:26 UTC, 0 replies.
- [ANNOUNCE] Apache log4net 3.3.1 released - posted by Jan Friedrich <fr...@apache.org> on 2026/04/19 20:11:21 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 0.17.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/04/20 04:24:05 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Numbers Version 1.3 Released - posted by Alex Herbert <ah...@apache.org> on 2026/04/20 11:11:59 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit Oak 2.0.0 released - posted by Julian Reschke <re...@apache.org> on 2026/04/21 16:20:02 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow 24.0.0 released - posted by Raúl Cumplido <ra...@apache.org> on 2026/04/22 08:48:31 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.2.1 Released - posted by Rahul Vats <ra...@apache.org> on 2026/04/22 09:12:21 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.18.2 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/04/22 19:14:24 UTC, 0 replies.
- [ANNOUNCE] Apache Commons IO 2.22.0 - posted by Gary Gregory <gg...@apache.org> on 2026/04/23 12:55:22 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 5.19.6 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/04/23 16:43:05 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.5 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/04/23 16:43:06 UTC, 0 replies.
- CVE-2026-40466: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/23 17:02:52 UTC, 0 replies.
- CVE-2026-41043: Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/23 17:03:58 UTC, 0 replies.
- CVE-2026-41044: Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/04/23 17:04:42 UTC, 0 replies.
- [ANNOUNCE] Apache Sedona 1.9.0 released - posted by Jia Yu <ji...@apache.org> on 2026/04/23 23:11:05 UTC, 0 replies.
- CVE-2026-23902: Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. - posted by Wenjun Ruan <we...@apache.org> on 2026/04/24 02:19:19 UTC, 0 replies.
- CVE-2025-62233: Apache DolphinScheduler: Deserialization of untrusted data in RPC - posted by Wenjun Ruan <we...@apache.org> on 2026/04/24 02:19:50 UTC, 0 replies.
- CVE-2026-38743: Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities - posted by Rahul Vats <ra...@apache.org> on 2026/04/24 12:19:59 UTC, 0 replies.
- CVE-2026-40690: Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users - posted by Rahul Vats <ra...@apache.org> on 2026/04/24 12:24:03 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.14.7 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/04/24 15:03:00 UTC, 0 replies.
- [ANNOUNCE] Apache Storm 2.8.7 Released - posted by Rui Abreu <ra...@apache.org> on 2026/04/25 15:52:31 UTC, 0 replies.
- CVE-2026-40557: Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections - posted by Richard Zowalla <rz...@apache.org> on 2026/04/25 16:59:13 UTC, 0 replies.
- CVE-2026-41081: Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure - posted by Richard Zowalla <rz...@apache.org> on 2026/04/25 16:59:41 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.20.0 Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/04/25 18:50:29 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Codec 1.22.0 - posted by Gary Gregory <gg...@apache.org> on 2026/04/25 23:24:42 UTC, 0 replies.
- CVE-2026-27172: Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:05:21 UTC, 0 replies.
- CVE-2026-33453: Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:06:00 UTC, 0 replies.
- CVE-2026-33454: Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant) - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:06:52 UTC, 0 replies.
- CVE-2026-40022: Apache Camel: Camel-Platform-HTTP-Main: Authentication Bypass on Non-Root Context Paths in camel main runtime - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:07:43 UTC, 0 replies.
- CVE-2026-40048: Apache Camel: Camel-PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:08:09 UTC, 0 replies.
- CVE-2026-40453: Apache Camel: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:08:31 UTC, 0 replies.
- CVE-2026-40473: Apache Camel: Camel-Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:09:00 UTC, 0 replies.
- CVE-2026-40858: Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:09:28 UTC, 0 replies.
- CVE-2026-40860: Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp - posted by Andrea Cosentino <ac...@apache.org> on 2026/04/26 18:09:56 UTC, 0 replies.
- [ANNOUNCE] Apache TsFile 2.3.0 released - posted by Haonan Hou <ha...@apache.org> on 2026/04/27 03:03:23 UTC, 0 replies.
- CVE-2026-41409: Apache MINA: CWE-502 Deserialization of Untrusted Data - posted by Emmanuel Lécharny <el...@apache.org> on 2026/04/27 08:23:37 UTC, 0 replies.
- ZDRES-059: CVE-2026-41635: Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE - posted by Emmanuel Lécharny <el...@apache.org> on 2026/04/27 08:23:45 UTC, 0 replies.
- Apache MINA 2.0.28, 2.0.11 and 2.2.6 release - posted by Emmanuel Lecharny <el...@apache.org> on 2026/04/27 08:32:36 UTC, 0 replies.
- [ANNOUNCE] Apache CloudStack LTS Release 4.20.3.0 - posted by Abhisar Sinha <ab...@apache.org> on 2026/04/27 12:22:58 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 3.0.17 released - posted by Lari Hotari <lh...@apache.org> on 2026/04/27 14:00:25 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.0.10 released - posted by Lari Hotari <lh...@apache.org> on 2026/04/27 14:09:09 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.2.1 released - posted by Lari Hotari <lh...@apache.org> on 2026/04/27 14:10:26 UTC, 0 replies.
- Re: CVE-2026-41016: Apache Airflow SMTP Provider: No certificate validation on SMTP STARTTLS connections - posted by Shahar Epstein <sh...@apache.org> on 2026/04/27 18:49:04 UTC, 0 replies.
- CVE-2026-41636: Apache Thrift: Node.js skip() recursion - posted by Jens Geyer <je...@apache.org> on 2026/04/27 23:59:36 UTC, 0 replies.
- CVE-2026-41607: Apache Thrift: C++ JSON OOB read - posted by Jens Geyer <je...@apache.org> on 2026/04/27 23:59:53 UTC, 0 replies.
- CVE-2026-41606: Apache Thrift: c_glib dispatch stack overflow - posted by Jens Geyer <je...@apache.org> on 2026/04/28 00:00:12 UTC, 0 replies.
- CVE-2026-41605: Apache Thrift: Swift Compact Protocol integer overflow - posted by Jens Geyer <je...@apache.org> on 2026/04/28 00:00:24 UTC, 0 replies.
- CVE-2026-41604: Apache Thrift: Swift Range crash in skip() - posted by Jens Geyer <je...@apache.org> on 2026/04/28 00:00:36 UTC, 0 replies.
- CVE-2026-41603: Apache Thrift: Java TSSLTransportFactory hostname verification - posted by Jens Geyer <je...@apache.org> on 2026/04/28 00:00:53 UTC, 0 replies.
- CVE-2026-41602: Apache Thrift: Go TFramedTransport uint32 overflow - posted by Jens Geyer <je...@apache.org> on 2026/04/28 00:01:06 UTC, 0 replies.
- CVE-2025-48431: Apache Thrift glibc language bindings: Specially crafted input can crash a c_glib Thrift server with invalid pointer error. - posted by Jens Geyer <je...@apache.org> on 2026/04/28 00:01:21 UTC, 0 replies.
- [ANN] Apache Struts 6.9.0 - posted by Lukasz Lenart <lu...@apache.org> on 2026/04/28 11:18:39 UTC, 0 replies.
- CVE-2026-41873: Pony Mail: Admin account takeover via request smuggling - posted by Arnout Engelen <en...@apache.org> on 2026/04/28 15:18:07 UTC, 0 replies.
- ANNOUNCE] Apache Jackrabbit Oak 1.22.24 released - posted by Julian Reschke <re...@apache.org> on 2026/04/28 18:58:12 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit Oak 1.22.24 released - posted by Julian Reschke <re...@apache.org> on 2026/04/28 20:08:12 UTC, 0 replies.
- [ANNOUNCE] Apache KIE (Incubating) 10.2.0 released - posted by Alex Porcelli <po...@apache.org> on 2026/04/29 20:07:08 UTC, 0 replies.
- [ANNOUNCE] Apache Accumulo Access 1.0.0-beta3 - posted by Christopher <ct...@apache.org> on 2026/04/29 20:08:47 UTC, 0 replies.
- [ANNOUNCE] Apache James MIME4J 0.8.13 released - posted by "btellier@apache.org" <bt...@apache.org> on 2026/04/30 12:42:08 UTC, 0 replies.
- [ANNOUNCE] Apache James MIME4J 0.8.14 released - posted by "btellier@apache.org" <bt...@apache.org> on 2026/04/30 12:44:26 UTC, 0 replies.
- Apache Beam 2.73.0 Released! - posted by Vitalii Terentev <vt...@apache.org> on 2026/04/30 18:25:06 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Helm Chart version 4.6.0 Released - posted by Lari Hotari <lh...@apache.org> on 2026/04/30 19:17:12 UTC, 0 replies.
- Apache MINA 2.0.12 and 2.2.7 release - posted by Emmanuel Lecharny <el...@apache.org> on 2026/04/30 21:52:01 UTC, 0 replies.