You are viewing a plain text version of this content. The canonical link for it is here.
- CVE-2026-35337: Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling - posted by Richard Zowalla <rz...@apache.org> on 2026/04/12 18:23:33 UTC, 0 replies.
- CVE-2026-35565: Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI - posted by Richard Zowalla <rz...@apache.org> on 2026/04/12 18:23:54 UTC, 0 replies.
- CVE-2026-40557: Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections - posted by Richard Zowalla <rz...@apache.org> on 2026/04/25 16:59:13 UTC, 0 replies.
- CVE-2026-41081: Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure - posted by Richard Zowalla <rz...@apache.org> on 2026/04/25 16:59:41 UTC, 0 replies.