You are viewing a plain text version of this content. The canonical link for it is here.
- CVE-2026-42402: Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/05/01 08:19:52 UTC, 0 replies.
- CVE-2026-42403: Apache Neethi: Circular Policy Reference Infinite Loop - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/05/01 08:21:17 UTC, 0 replies.
- CVE-2026-42404: Apache Neethi: Unrestricted HTTP Redirect Following in Policy References - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/05/01 08:22:35 UTC, 0 replies.
- [ANNOUNCE] Release Apache OpenDAL 0.56.0 - posted by Xuanwo <xu...@apache.org> on 2026/05/01 12:08:54 UTC, 0 replies.
- [ANNOUNCE] OpenNLP 3.0.0-M3 released - posted by Richard Zowalla <rz...@apache.org> on 2026/05/01 17:54:24 UTC, 0 replies.
- [ANNOUNCE] OpenNLP 2.5.9 released - posted by Richard Zowalla <rz...@apache.org> on 2026/05/01 17:54:27 UTC, 0 replies.
- CVE-2026-40682: Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor - posted by Richard Zowalla <rz...@apache.org> on 2026/05/01 17:54:46 UTC, 0 replies.
- CVE-2026-42027: Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader - posted by Richard Zowalla <rz...@apache.org> on 2026/05/01 17:55:01 UTC, 0 replies.
- CVE-2026-42440: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader - posted by Richard Zowalla <rz...@apache.org> on 2026/05/01 17:55:17 UTC, 0 replies.
- CVE-2026-42809: Apache Polaris: An authenticated low-privileged user can abuse Polaris staged table creation to mint broad temporary storage credentials for an attacker-chosen location before Polaris validates that location - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/02 15:59:53 UTC, 0 replies.
- CVE-2026-42810: Apache Polaris: Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and `s3:prefix` conditions. - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/02 16:00:17 UTC, 0 replies.
- CVE-2026-42811: Apache Polaris: In plain terms, Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/02 16:01:13 UTC, 0 replies.
- CVE-2026-42812: Apache Polaris: No protection on `write.metadata.path` - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/02 16:03:19 UTC, 0 replies.
- [ANNOUNCE] Apache Polaris 1.4.1 - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/02 16:15:27 UTC, 0 replies.
- CVE-2026-40563: Apache Atlas: Script injection allows access to unintended data - posted by Pinal Shah <pi...@apache.org> on 2026/05/03 11:59:12 UTC, 0 replies.
- [ANNOUNCE] Apache Grails GitHub Actions 1.0.2 - posted by James Daugherty <jd...@apache.org> on 2026/05/03 20:17:14 UTC, 0 replies.
- [ANNOUNCE] Grails Publish Gradle Plugin 0.0.5 - posted by James Daugherty <jd...@apache.org> on 2026/05/03 20:17:26 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.11 - posted by James Daugherty <jd...@apache.org> on 2026/05/03 20:18:35 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.1 - posted by James Daugherty <jd...@apache.org> on 2026/05/03 20:19:46 UTC, 0 replies.
- [ANNOUNCE] Apache Grails Spring Security 7.0.2 - posted by James Daugherty <jd...@apache.org> on 2026/05/03 20:19:59 UTC, 0 replies.
- [ANNOUNCE] Grails Publish Gradle Plugin 1.0.0-M1 - posted by James Daugherty <jd...@apache.org> on 2026/05/03 23:37:06 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko (Core) 1.6.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/05/04 11:01:37 UTC, 0 replies.
- [ANNOUNCEMENT] Apache HTTP Server 2.4.67 Released - posted by covener <co...@apache.org> on 2026/05/04 11:42:03 UTC, 0 replies.
- CVE-2026-33857: Apache HTTP Server: Off-by-one OOB reads in AJP getter functions - posted by Eric Covener <co...@apache.org> on 2026/05/04 11:48:09 UTC, 0 replies.
- CVE-2026-34032: Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) - posted by Eric Covener <co...@apache.org> on 2026/05/04 11:50:24 UTC, 0 replies.
- CVE-2026-34059: Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() - posted by Eric Covener <co...@apache.org> on 2026/05/04 11:51:57 UTC, 0 replies.
- CVE-2026-24072: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr - posted by Eric Covener <co...@apache.org> on 2026/05/04 12:05:11 UTC, 0 replies.
- CVE-2026-23918: Apache HTTP Server: http2: double free and possible RCE on early reset - posted by Eric Covener <co...@apache.org> on 2026/05/04 14:05:56 UTC, 0 replies.
- CVE-2026-29169: Apache HTTP Server: mod_dav_lock indirect lock crash - posted by Eric Covener <co...@apache.org> on 2026/05/04 14:15:25 UTC, 0 replies.
- CVE-2026-33006: Apache HTTP Server: mod_auth_digest timing attack - posted by Eric Covener <co...@apache.org> on 2026/05/04 14:15:58 UTC, 0 replies.
- CVE-2026-33007: Apache HTTP Server: mod_authn_socache crash - posted by Eric Covener <co...@apache.org> on 2026/05/04 14:20:33 UTC, 0 replies.
- CVE-2026-33523: Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line - posted by Eric Covener <co...@apache.org> on 2026/05/04 14:21:05 UTC, 0 replies.
- CVE-2026-43868: Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern - posted by Jens Geyer <je...@apache.org> on 2026/05/04 23:42:19 UTC, 0 replies.
- CVE-2026-43870: Apache Thrift: Node.js web_server.js multi-vulnerability - posted by Jens Geyer <je...@apache.org> on 2026/05/04 23:43:24 UTC, 0 replies.
- CVE-2026-43869: Apache Thrift: TSSLTransportFactory.java hostname verification - posted by Jens Geyer <je...@apache.org> on 2026/05/04 23:44:11 UTC, 0 replies.
- [ANNOUNCE] Apache Atlas 2.5.0 released - posted by Madhan Neethiraj <ma...@apache.org> on 2026/05/05 03:25:53 UTC, 0 replies.
- [ANNOUNCE] Apache TomEE 10.1.5 - posted by Markus Jung <ju...@apache.org> on 2026/05/05 08:29:54 UTC, 0 replies.
- CVE-2026-29168: Apache HTTP Server: mod_md unrestricted OCSP response - posted by Eric Covener <co...@apache.org> on 2026/05/05 09:13:11 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Statistics 1.3 Released - posted by Alex Herbert <ah...@apache.org> on 2026/05/05 12:07:46 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.22 Available - posted by Mark Thomas <ma...@apache.org> on 2026/05/05 14:49:31 UTC, 0 replies.
- CVE-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() - posted by Eric Covener <co...@apache.org> on 2026/05/05 16:47:39 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow CTL 0.1.4 from 0.1.4rc3 released - posted by Jarek Potiuk <po...@apache.org> on 2026/05/05 19:22:31 UTC, 0 replies.
- CVE-2026-40010: Apache Wicket: possible session fixation using AuthenticatedWebSession - posted by Pedro Henrique Oliveira dos Santos <pe...@apache.org> on 2026/05/05 23:13:57 UTC, 0 replies.
- CVE-2026-42509: Apache Wicket: crafted strings can break out of the JavaScript sequence - posted by Pedro Henrique Oliveira dos Santos <pe...@apache.org> on 2026/05/05 23:16:51 UTC, 0 replies.
- CVE-2026-43646: Apache Wicket: crafted URLs can bypass PackageResourceGuard - posted by Pedro Henrique Oliveira dos Santos <pe...@apache.org> on 2026/05/05 23:17:19 UTC, 0 replies.
- CVE-2026-43975: Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager - posted by Pedro Henrique Oliveira dos Santos <pe...@apache.org> on 2026/05/05 23:18:05 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 10.9.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/05/06 10:37:29 UTC, 0 replies.
- [ANNOUNCE] SkyWalking Helm Chart 4.9.0 released - posted by han liu <li...@apache.org> on 2026/05/06 11:22:38 UTC, 0 replies.
- [ANNOUNCE] Apache Ignite 2.18.0 Released - posted by zstan <zs...@apache.org> on 2026/05/07 10:56:38 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 4.0.32 Released - posted by Paul King <pa...@apache.org> on 2026/05/07 13:33:31 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 5.0.6 Released - posted by Paul King <pa...@apache.org> on 2026/05/07 13:33:34 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-alpha-1 Released - posted by Paul King <pa...@apache.org> on 2026/05/07 13:33:36 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.1 released - posted by David Jensen <dj...@apache.org> on 2026/05/07 14:19:45 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 8.0.0-M1 - posted by James Fredley <ja...@apache.org> on 2026/05/07 19:11:24 UTC, 0 replies.
- [ANNOUNCE] Release Apache Paimon Rust 0.1.0 - posted by yuxia luo <yu...@apache.org> on 2026/05/08 03:48:00 UTC, 0 replies.
- [ADVISORY] Apache CloudStack LTS Security Releases 4.20.3.0 and 4.22.0.1 - posted by Daan Hoogland <da...@apache.org> on 2026/05/08 09:45:52 UTC, 0 replies.
- [ANNOUNCE] Apache Grails Spring Security 8.0.0-M1 - posted by Mattias Reichel <ma...@apache.org> on 2026/05/09 08:15:33 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 4.0.0-alpha-1 released - posted by Tim Allison <ta...@apache.org> on 2026/05/10 13:41:21 UTC, 0 replies.
- CVE-2026-43826: Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL - posted by Shahar Epstein <sh...@apache.org> on 2026/05/10 19:28:36 UTC, 0 replies.
- CVE-2026-41018: Apache Airflow Providers Elasticsearch: Elasticsearch task-log handlers leak credentials embedded in the host URL - posted by Shahar Epstein <sh...@apache.org> on 2026/05/10 19:34:26 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.118 available - posted by Rémy Maucherat <re...@apache.org> on 2026/05/11 06:51:53 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-05-05 are released - posted by Vincent Beck <vi...@apache.org> on 2026/05/11 17:35:26 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.55 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/05/11 21:39:55 UTC, 0 replies.
- [ANNOUNCE] Apache Calcite Avatica 1.28.0 Released - posted by Francis Chuang <fr...@apache.org> on 2026/05/11 22:58:54 UTC, 0 replies.
- [ANNOUNCE] Apache Parquet Java 1.17.1 - posted by Gang Wu <ga...@apache.org> on 2026/05/12 02:44:51 UTC, 0 replies.
- [ANNOUNCE] Apache Burr 0.42.0-incubating released - posted by Elijah ben Izzy <eb...@apache.org> on 2026/05/12 04:53:08 UTC, 0 replies.
- [SECURITY] CVE-2026-41284 Apache Tomcat - Unbounded read in WebDAV LOCK and PROPFIND handling - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:26 UTC, 0 replies.
- [SECURITY] CVE-2026-41293 Apache Tomcat - HTTP/2 request headers not validated - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:32 UTC, 0 replies.
- [SECURITY] CVE-2026-42498 Apache Tomcat - WebSocket authentication header exposure - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:37 UTC, 0 replies.
- [SECURITY] CVE-2026-43512 Apache Tomcat - Digest authenticator will authenticate any unknown user - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:42 UTC, 0 replies.
- [SECURITY] CVE-2026-43513 Apache Tomcat - LockOutRealm treats user names as case-sensitive - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:47 UTC, 0 replies.
- [SECURITY] CVE-2026-43514 Apache Tomcat - AJP secret compared in non-constant time - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:52 UTC, 0 replies.
- [SECURITY] CVE-2026-43515 Apache Tomcat - Security constraints not correctly applied - posted by Mark Thomas <ma...@apache.org> on 2026/05/12 15:06:57 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 9.23.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/05/13 16:20:15 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Configuration 2.15.0 - posted by Gary Gregory <gg...@apache.org> on 2026/05/13 18:48:07 UTC, 0 replies.
- CVE-2026-45205: Apache Commons Configuration: StackOverflowError for YAML input with cycles - posted by "Gary D. Gregory" <gg...@apache.org> on 2026/05/14 11:01:03 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 8.18.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/05/15 11:01:19 UTC, 0 replies.
- [ANNOUNCE] Apache Flink 2.2.1 released - posted by Sergey Nuyanzin <sn...@apache.org> on 2026/05/15 14:26:59 UTC, 0 replies.
- CVE-2026-35194: Apache Flink: Remote code execution via SQL injection in code generation - posted by Martijn Visser <ma...@apache.org> on 2026/05/15 15:06:51 UTC, 0 replies.
- [ANN] Apache Maven 3.9.16 released - posted by Slawomir Jaranowski <sj...@apache.org> on 2026/05/17 16:58:48 UTC, 0 replies.
- [ANN] Maven Resolver 2.0.18 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/05/18 09:25:16 UTC, 0 replies.
- [ANN] Apache Maven Enforcer Plugin 3.6.3 Released - posted by Tamás Cservenák <cs...@apache.org> on 2026/05/18 11:54:07 UTC, 0 replies.
- [ANNOUNCE] Apache Storm 2.8.8 Released - posted by Rui Abreu <ra...@apache.org> on 2026/05/18 22:04:59 UTC, 0 replies.
- [ANNOUNCE] Apache OFBiz 24.09.06 released - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 07:32:57 UTC, 0 replies.
- CVE-2026-29207: Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:29:20 UTC, 0 replies.
- CVE-2026-29220: Apache OFBiz: Low-Privilege LFI in Content Component - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:30:17 UTC, 0 replies.
- CVE-2026-29226: Apache OFBiz: Low-Privilege SSRF in Content Component - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:30:39 UTC, 0 replies.
- CVE-2026-31378: Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:31:00 UTC, 0 replies.
- CVE-2026-31379: Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:31:23 UTC, 0 replies.
- CVE-2026-31380: Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:31:45 UTC, 0 replies.
- CVE-2026-31387: Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:32:06 UTC, 0 replies.
- CVE-2026-31388: Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:32:29 UTC, 0 replies.
- CVE-2026-31906: Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:33:24 UTC, 0 replies.
- CVE-2026-31909: Apache OFBiz: Unauthenticated Shipment Label Image Disclosure - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:33:44 UTC, 0 replies.
- [ANNOUNCE] Apache CouchDB 3.5.2 released - posted by Jan Lehnardt <ja...@apache.org> on 2026/05/19 08:33:51 UTC, 0 replies.
- CVE-2026-31910: Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:34:03 UTC, 0 replies.
- CVE-2026-31986: Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:34:27 UTC, 0 replies.
- CVE-2026-35086: Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:34:59 UTC, 0 replies.
- CVE-2026-41919: Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:35:23 UTC, 0 replies.
- CVE-2026-45187: Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:35:49 UTC, 0 replies.
- CVE-2026-45434: Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:36:13 UTC, 0 replies.
- CVE-2026-46586: Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution - posted by Jacopo Cappellato <ja...@apache.org> on 2026/05/19 08:36:33 UTC, 0 replies.
- CVE-2026-47323: Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering - posted by Andrea Cosentino <ac...@apache.org> on 2026/05/19 12:13:49 UTC, 0 replies.
- CVE-2026-27173: Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments - posted by Vincent Beck <vi...@apache.org> on 2026/05/19 18:06:00 UTC, 0 replies.
- CVE-2026-42526: Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends - posted by Vincent Beck <vi...@apache.org> on 2026/05/19 18:08:11 UTC, 0 replies.
- [ANNOUNCE] Apache Artemis 2.54.0 Released - posted by Justin Bertram <jb...@apache.org> on 2026/05/20 02:56:13 UTC, 0 replies.
- [ANNOUNCE] Apache PDFBox JBIG2 ImageIO plugin 3.0.5 released - posted by Andreas Lehmkühler <le...@apache.org> on 2026/05/20 06:21:13 UTC, 0 replies.
- [ANNOUNCE] Apache NetBeans 30 Released - posted by Eric Barboni <sk...@apache.org> on 2026/05/20 15:05:22 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 10.9.1 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/05/20 21:24:02 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Client Python 3.12.0 released - posted by Yunze Xu <xy...@apache.org> on 2026/05/21 01:52:23 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.0.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/05/21 08:53:48 UTC, 0 replies.
- https://camel.apache.org/security/CVE-2026-45760.html: CVE-2026-45760: Apache Camel K: Camel K Cross-Namespace Build Deputy Attack - posted by Pasquale Congiusti <pc...@apache.org> on 2026/05/21 10:49:24 UTC, 0 replies.
- CVE-2026-48207: Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement - posted by Chaokun Yang <ch...@apache.org> on 2026/05/21 12:44:24 UTC, 0 replies.
- [ANNOUNCE] Apache Teaclave™ TrustZone SDK 0.9.0 Released - posted by Zehui Chen <iv...@apache.org> on 2026/05/22 10:55:22 UTC, 0 replies.
- CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE) - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/05/22 11:10:29 UTC, 0 replies.
- CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/05/22 11:11:59 UTC, 0 replies.
- CVE-2026-44930: Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/05/22 11:12:46 UTC, 0 replies.
- [ANNOUNCE] Apache Kafka 4.3.0 - posted by Mickael Maison <mi...@apache.org> on 2026/05/22 12:28:35 UTC, 0 replies.
- CVE-2026-45249: Apache ECharts: XSS in Lines series tooltip rendering - posted by Zhongxiang Wang <wa...@apache.org> on 2026/05/23 04:29:15 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-05-19 are released - posted by Jens Scheffler <js...@apache.org> on 2026/05/23 15:24:15 UTC, 0 replies.
- CVE-2026-45361: Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) - posted by Jens Scheffler <js...@apache.org> on 2026/05/24 20:12:05 UTC, 0 replies.
- CVE-2026-46745: Apache Airflow FAB provider: [ Security Report ] LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token (ZDRES-223) - posted by Jens Scheffler <js...@apache.org> on 2026/05/24 20:19:46 UTC, 0 replies.
- [ANNOUNCE] Apache Doris 4.1.1 - posted by Mingyu Chen <mo...@apache.org> on 2026/05/25 05:58:24 UTC, 0 replies.
- [ANN] Apache Syncope 4.1.1 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/05/25 12:28:47 UTC, 0 replies.
- [ANN] Apache Syncope 4.0.6 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/05/25 12:30:18 UTC, 0 replies.
- CVE-2026-42782: Apache Syncope: Post-auth RCE via Groovy static - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/05/25 12:32:42 UTC, 0 replies.
- CVE-2026-42797: Apache Syncope: JexlContextBuilder Information Disclosure - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/05/25 12:33:19 UTC, 0 replies.
- CVE-2026-43827: Apache Shiro: Session fixation: new session is not created after login by default - posted by Lenny Primak <lp...@apache.org> on 2026/05/25 19:50:13 UTC, 0 replies.
- CVE-2026-43828: Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default - posted by Lenny Primak <lp...@apache.org> on 2026/05/25 19:50:45 UTC, 0 replies.
- CVE-2026-44598: Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) - posted by Lenny Primak <lp...@apache.org> on 2026/05/25 19:51:10 UTC, 0 replies.
- CVE-2026-48589: Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow - posted by Lenny Primak <lp...@apache.org> on 2026/05/25 19:51:35 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 3.3.1 released - posted by Tim Allison <ta...@apache.org> on 2026/05/26 12:45:12 UTC, 0 replies.
- CVE-2026-40564: Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator - posted by Gyula Fora <gy...@apache.org> on 2026/05/26 14:29:39 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Configuration 2.15.1 - posted by Gary Gregory <gg...@apache.org> on 2026/05/26 22:54:04 UTC, 0 replies.
- ARTEMIS-5996: CVE-2026-40914: Apache Artemis, Apache ActiveMQ Artemis: Address routing-type can be updated by STOMP protocol user without the createAddress permission - posted by Justin Bertram <jb...@apache.org> on 2026/05/27 16:22:03 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-05-25 are released - posted by Jens Scheffler <js...@apache.org> on 2026/05/27 16:55:34 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 2.18.0 released - posted by Thomas Wolf <tw...@apache.org> on 2026/05/28 08:18:08 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 3.0.0-M4 released - posted by Thomas Wolf <tw...@apache.org> on 2026/05/28 08:19:02 UTC, 0 replies.
- [ANNOUNCE] Apache bRPC 1.17.0 released - posted by Xiguo Hu <hu...@apache.org> on 2026/05/28 14:32:14 UTC, 0 replies.
- [ANNOUNCE] Apache Axis2/C 2.0.0 Released - posted by robertlazarski <ro...@apache.org> on 2026/05/28 21:39:14 UTC, 0 replies.
- [ANNOUNCE] Apache Axis2/Java 2.0.1 Released - posted by robertlazarski <ro...@apache.org> on 2026/05/28 22:01:53 UTC, 0 replies.
- [ANNOUNCEMENT] Commons Daemon 1.6.0 Released - posted by Mark Thomas <ma...@apache.org> on 2026/05/29 09:28:45 UTC, 0 replies.
- [ANN] Apache Struts 6.10.0 - posted by Lukasz Lenart <lu...@apache.org> on 2026/05/29 12:43:37 UTC, 0 replies.
- CVE-2026-44825: Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users - posted by Jan Høydahl <ja...@apache.org> on 2026/05/29 20:01:06 UTC, 0 replies.
- [ANNOUNCE] Apache Fesod(Incubating) 2.0.2-incubating released - posted by delei <de...@apache.org> on 2026/05/30 07:55:47 UTC, 0 replies.
- CVE-2026-48827: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git - posted by Thomas Wolf <tw...@apache.org> on 2026/05/30 08:31:07 UTC, 0 replies.
- [ANN] Apache Maven Daemon 1.0.6 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/05/30 11:17:11 UTC, 0 replies.
- CVE-2026-49361: Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability - posted by Jark Wu <ja...@apache.org> on 2026/05/30 15:19:31 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.6 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/31 06:20:19 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 5.19.7 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/05/31 06:22:21 UTC, 0 replies.
- CVE-2026-40861: Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:35:50 UTC, 0 replies.
- CVE-2026-40961: Apache Airflow: Open Redirect Bypass Vulnerability - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:37:43 UTC, 0 replies.
- CVE-2026-40963: Apache Airflow: DAG authorization bypass on /ui/structure/structure_data - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:39:07 UTC, 0 replies.
- CVE-2026-41014: Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:40:24 UTC, 0 replies.
- CVE-2026-49267: Apache Airflow: No certificate validation on SMTP STARTTLS connections - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:42:43 UTC, 0 replies.
- CVE-2026-41017: Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:45:13 UTC, 0 replies.
- CVE-2026-41084: Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:47:57 UTC, 0 replies.
- CVE-2026-42252: Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:50:40 UTC, 0 replies.
- CVE-2026-42360: Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:54:12 UTC, 0 replies.
- CVE-2026-42358: Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 11:58:45 UTC, 0 replies.
- CVE-2026-42359: Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:03:06 UTC, 0 replies.
- CVE-2026-45360: Apache Airflow: Arbitrary import in custom deadline-reference deserialization - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:08:58 UTC, 0 replies.
- CVE-2026-45426: Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:11:30 UTC, 0 replies.
- CVE-2026-46764: Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:13:34 UTC, 0 replies.
- CVE-2026-48726: Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:17:29 UTC, 0 replies.
- CVE-2026-49298: Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments - posted by Rahul Vats <ra...@apache.org> on 2026/05/31 12:18:33 UTC, 0 replies.
- CVE-2026-42253: Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/05/31 16:16:35 UTC, 0 replies.
- CVE-2026-42588: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/05/31 16:17:00 UTC, 0 replies.
- CVE-2026-45505: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/05/31 16:17:17 UTC, 0 replies.
- CVE-2026-46605: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/05/31 16:17:37 UTC, 0 replies.
- CVE-2026-49157: Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/05/31 16:17:49 UTC, 0 replies.
- CVE-2026-49270: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/05/31 16:18:07 UTC, 0 replies.
- CVE-2026-35563: Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname - posted by Emmanuel Lécharny <el...@apache.org> on 2026/05/31 22:03:27 UTC, 0 replies.