You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Release Apache OpenDAL 0.57.0 - posted by Xuanwo <xu...@apache.org> on 2026/06/01 02:01:10 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.1.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/06/01 02:38:59 UTC, 0 replies.
- CVE-2026-45192: Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response - posted by Rahul Vats <ra...@apache.org> on 2026/06/01 04:52:49 UTC, 0 replies.
- [ANNOUNCE] Apache APISIX Ingress controller v2.1.0 released - posted by Xin Rong <al...@apache.org> on 2026/06/01 09:00:00 UTC, 0 replies.
- CVE-2026-49328: Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF - posted by Shuxin Pan <ps...@apache.org> on 2026/06/01 09:59:11 UTC, 0 replies.
- CVE-2026-46718: Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution - posted by Julian Hyde <jh...@apache.org> on 2026/06/01 18:39:22 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit Oak 2.2.0 released - posted by Julian Reschke <re...@apache.org> on 2026/06/02 05:39:37 UTC, 0 replies.
- CVE-2026-41115: Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API - posted by Luke Chen <sh...@apache.org> on 2026/06/02 08:02:02 UTC, 0 replies.
- Apache MINA 2.0.29, 2.0.13 and 2.2.8 release - posted by Emmanuel Lecharny <el...@apache.org> on 2026/06/02 11:56:40 UTC, 0 replies.
- [ANNOUNCE] Release Apache Paimon Rust 0.2.0 - posted by yuxia luo <yu...@apache.org> on 2026/06/03 10:13:27 UTC, 0 replies.
- [ANN] Apache CycloneDX Antlib 0.1 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/06/04 04:52:54 UTC, 0 replies.
- CVE-2026-50076: Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass - posted by Chaokun Yang <ch...@apache.org> on 2026/06/04 09:08:28 UTC, 0 replies.
- [ANNOUNCE] Release Apache Paimon Mosaic 0.1.0 - posted by hope <ho...@apache.org> on 2026/06/04 13:02:17 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Helm Chart version 1.22.0 Released - posted by Jarek Potiuk <po...@apache.org> on 2026/06/04 14:21:41 UTC, 0 replies.
- [ANN] Apache Tomcat Migration tool for Jakarta EE 1.0.12 - posted by Mark Thomas <ma...@apache.org> on 2026/06/05 07:11:28 UTC, 0 replies.
- [ANNOUNCE] Release Apache DolphinScheduler 3.4.2 - posted by wenjun <we...@apache.org> on 2026/06/05 07:25:43 UTC, 0 replies.
- CVE-2026-47430: Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews - posted by Niklas Merz <ni...@apache.org> on 2026/06/07 08:57:00 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-06-02 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/06/07 16:24:24 UTC, 0 replies.
- [ANNOUNCE] Apache Hudi 0.14.2 released - posted by Danny Chan <da...@apache.org> on 2026/06/08 10:26:49 UTC, 0 replies.
- Apache Olingo is now retired - posted by Niall Pemberton <ni...@apache.org> on 2026/06/08 10:54:34 UTC, 0 replies.
- [ANNOUNCEMENT] Apache HTTP Server 2.4.68 Released - posted by covener <co...@apache.org> on 2026/06/08 12:31:17 UTC, 0 replies.
- CVE-2026-29167: Apache HTTP Server: mod_ldap per-dir use-after-free - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:06 UTC, 0 replies.
- CVE-2026-29170: Apache HTTP Server: mod_proxy_ftp XSS - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:12 UTC, 0 replies.
- CVE-2026-34355: Apache HTTP Server: mod_proxy_html buffer overflow - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:19 UTC, 0 replies.
- CVE-2026-34356: Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:26 UTC, 0 replies.
- CVE-2026-42535: Apache HTTP Server: mod_dav_fs protected directory access - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:31 UTC, 0 replies.
- CVE-2026-42536: Apache HTTP Server: mod_xml2enc heap overflow - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:37 UTC, 0 replies.
- CVE-2026-43951: Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:42 UTC, 0 replies.
- CVE-2026-44119: Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:50:49 UTC, 0 replies.
- CVE-2026-44185: Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:51:02 UTC, 0 replies.
- CVE-2026-44186: Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:51:13 UTC, 0 replies.
- CVE-2026-44631: Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:51:36 UTC, 0 replies.
- CVE-2026-48913: Apache HTTP Server: mod_http2 memory corruption when file handles exhausted - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:51:46 UTC, 0 replies.
- CVE-2026-49975: Apache HTTP Server: mod_http2 denial of service - posted by Eric Covener <co...@apache.org> on 2026/06/08 12:51:55 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.0.11 released - posted by Lari Hotari <lh...@apache.org> on 2026/06/08 19:04:59 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.2.2 released - posted by Lari Hotari <lh...@apache.org> on 2026/06/08 19:05:59 UTC, 0 replies.
- CVE-2026-34905: Apache Answer: Unlisted Questions Accessible via Direct API Access - posted by Enxin Xie <li...@apache.org> on 2026/06/09 05:14:10 UTC, 0 replies.
- CVE-2026-34033: Apache Answer: HTML Content Injection in Email - posted by Enxin Xie <li...@apache.org> on 2026/06/09 05:14:38 UTC, 0 replies.
- CVE-2026-34031: Apache Answer: The custom avatar was not properly validated - posted by Enxin Xie <li...@apache.org> on 2026/06/09 05:15:03 UTC, 0 replies.
- CVE-2026-33582: Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error - posted by Enxin Xie <li...@apache.org> on 2026/06/09 05:15:39 UTC, 0 replies.
- CVE-2026-25699: Apache Answer: Authorization Bypass in Timeline API - posted by Enxin Xie <li...@apache.org> on 2026/06/09 05:16:09 UTC, 0 replies.
- CVE-2026-25688: Apache Answer: XSS in AI Answer Rendering - posted by Enxin Xie <li...@apache.org> on 2026/06/09 05:16:37 UTC, 0 replies.
- CVE-2026-49818: Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names - posted by Jarek Potiuk <po...@apache.org> on 2026/06/09 07:37:45 UTC, 0 replies.
- CVE-2026-25700: Apache Answer: AdminToken not invalidated after admin deactivation - posted by Enxin Xie <li...@apache.org> on 2026/06/10 14:49:55 UTC, 0 replies.
- CVE-2026-47342: Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass - posted by Jacopo Cappellato <ja...@apache.org> on 2026/06/10 16:39:24 UTC, 0 replies.
- CVE-2026-50223: Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution - posted by Jacopo Cappellato <ja...@apache.org> on 2026/06/10 16:40:39 UTC, 0 replies.
- CVE-2026-49875: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:47:46 UTC, 0 replies.
- CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:49:56 UTC, 0 replies.
- CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:52:00 UTC, 0 replies.
- CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:54:11 UTC, 0 replies.
- CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:55:00 UTC, 0 replies.
- CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 16:56:27 UTC, 0 replies.
- CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:00:01 UTC, 0 replies.
- CVE-2026-50632: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:02:27 UTC, 0 replies.
- CVE-2026-50633: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:03:54 UTC, 0 replies.
- CVE-2026-50634: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:05:47 UTC, 0 replies.
- CVE-2026-50645: Apache CXF: No restriction on attachment headers per message - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/11 17:08:25 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-06-08 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/06/11 23:17:13 UTC, 0 replies.
- [ANNOUNCEMENT] Commons Daemon 1.6.1 Released - posted by Mark Thomas <ma...@apache.org> on 2026/06/12 07:58:44 UTC, 0 replies.
- [ANNOUNCE] Apache Zeppelin 0.12.1 available - posted by Jongyoul Lee <jo...@apache.org> on 2026/06/14 01:49:55 UTC, 0 replies.
- [ANNOUNCE] Apache Flink 1.20.5 released - posted by Yunfeng Zhou <yu...@apache.org> on 2026/06/14 05:29:56 UTC, 0 replies.
- [ANNOUNCE] Apache Flink 2.1.3 released - posted by Yunfeng Zhou <yu...@apache.org> on 2026/06/14 05:37:16 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Client C++ 4.2.0 released - posted by Yunze Xu <xy...@apache.org> on 2026/06/15 06:01:07 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Go Client 0.20.0 released - posted by Zike Yang <zi...@apache.org> on 2026/06/15 10:07:27 UTC, 0 replies.
- [ANN] Maven Executor 1.0.0 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/06/15 12:57:51 UTC, 0 replies.
- [ANN] Apache Tomcat Native 2.0.15 released - posted by Mark Thomas <ma...@apache.org> on 2026/06/15 15:09:48 UTC, 0 replies.
- [ANN] Apache Tomcat Native 1.3.8 released - posted by Mark Thomas <ma...@apache.org> on 2026/06/15 15:21:10 UTC, 0 replies.
- [ANN] Apache TomEE 11.0.0-M1 - posted by Richard Zowalla <rz...@apache.org> on 2026/06/16 11:35:41 UTC, 0 replies.
- CVE-2026-50203: Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names - posted by Jarek Potiuk <po...@apache.org> on 2026/06/16 12:15:31 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.2.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/06/16 16:00:42 UTC, 0 replies.
- CVE-2026-32966: Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure - posted by Wenjun Ruan <we...@apache.org> on 2026/06/17 01:35:20 UTC, 0 replies.
- CVE-2026-32967: Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks - posted by Wenjun Ruan <we...@apache.org> on 2026/06/17 01:35:26 UTC, 0 replies.
- CVE-2026-42357: Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. - posted by Wenjun Ruan <we...@apache.org> on 2026/06/17 01:35:45 UTC, 0 replies.
- CVE-2026-47340: Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. - posted by Wenjun Ruan <we...@apache.org> on 2026/06/17 01:36:01 UTC, 0 replies.
- CVE-2026-49050: Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens - posted by Wenjun Ruan <we...@apache.org> on 2026/06/17 01:36:15 UTC, 0 replies.
- CVE-2026-41280: Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects - posted by Wenjun Ruan <we...@apache.org> on 2026/06/17 01:39:14 UTC, 0 replies.
- CVE-2026-49268: Apache Shiro: LDAP DN Injection in DefaultLdapRealm - posted by Lenny Primak <lp...@apache.org> on 2026/06/17 12:51:22 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Logging 1.4.0 - posted by Gary Gregory <gg...@apache.org> on 2026/06/17 14:26:22 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Helm Chart version 4.6.1 Released - posted by Lari Hotari <lh...@apache.org> on 2026/06/18 21:35:02 UTC, 0 replies.
- CVE-2026-39998: Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:55:01 UTC, 0 replies.
- CVE-2026-39999: Apache APISIX: JWT Algorithm Confusion allows authentication bypass - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:55:36 UTC, 0 replies.
- CVE-2026-44046: Apache APISIX: wolf-rbac plugin Identity Spoofing - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:55:44 UTC, 0 replies.
- CVE-2026-44087: Apache APISIX: Openid-connect plugin Identity Header Spoofing - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:55:47 UTC, 0 replies.
- CVE-2026-44915: Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:55:52 UTC, 0 replies.
- CVE-2026-47339: Apache APISIX: authz-casdoor incorrect session sharing - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:55:57 UTC, 0 replies.
- CVE-2026-47341: Apache APISIX: Session replay issue in hmac-auth - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:56:01 UTC, 0 replies.
- CVE-2026-49872: Apache APISIX: Improper authentication in cas-auth plugin - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:56:50 UTC, 0 replies.
- CVE-2026-49871: Apache APISIX: cas-auth login CSRF / session injection issue - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:56:59 UTC, 0 replies.
- CVE-2026-49231: Apache APISIX: Identity spoofing issue in APISIX opa plugin - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:57:04 UTC, 0 replies.
- CVE-2026-49230: Apache APISIX: Authentication bypass in jwe-decrypt - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:57:08 UTC, 0 replies.
- CVE-2026-48895: Apache APISIX: Cas-auth Host header influence on CAS service URL - posted by Abhishek Choudhary <sh...@apache.org> on 2026/06/19 06:57:13 UTC, 0 replies.
- Apache MINA 2.2.8, 2.1.14, 2.0.30 released - posted by Emmanuel Lecharny <el...@apache.org> on 2026/06/19 07:19:25 UTC, 0 replies.
- [ANN] Apache AntUnit 1.5.0 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/06/19 15:39:26 UTC, 0 replies.
- [ANNOUNCE] Apache NiFi 2.10.0 Released - posted by Pierre Villard <pv...@apache.org> on 2026/06/19 17:24:10 UTC, 0 replies.
- CVE-2025-62198: Apache Atlas: Stored XSS in Create Entity page - posted by Madhan Neethiraj <ma...@apache.org> on 2026/06/20 05:25:01 UTC, 0 replies.
- CVE-2026-44911: Apache NiFi: Incorrect Authorization for Configuration Verification Requests - posted by David Handermann <ex...@apache.org> on 2026/06/20 16:52:04 UTC, 0 replies.
- CVE-2026-44913: Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL - posted by David Handermann <ex...@apache.org> on 2026/06/20 16:52:30 UTC, 0 replies.
- CVE-2026-44914: Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents - posted by David Handermann <ex...@apache.org> on 2026/06/20 16:57:13 UTC, 0 replies.
- CVE-2026-54665: Apache NiFi: Missing Validation for Proxy Host Headers - posted by David Handermann <ex...@apache.org> on 2026/06/20 16:57:51 UTC, 0 replies.
- CVE-2025-66336: Apache Doris MCP Server: SQL injection leading the authentication bypass - posted by Calvin Kirs <ki...@apache.org> on 2026/06/22 04:01:34 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.23 Available - posted by Mark Thomas <ma...@apache.org> on 2026/06/22 11:17:41 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.2 - posted by James Daugherty <jd...@apache.org> on 2026/06/22 15:52:44 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.12 - posted by James Daugherty <jd...@apache.org> on 2026/06/22 15:52:45 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-06-16 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/06/22 21:33:24 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.56 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/06/23 01:57:11 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.119 available - posted by Rémy Maucherat <re...@apache.org> on 2026/06/23 08:12:32 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko Persistence JDBC 1.3.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/06/23 17:57:15 UTC, 0 replies.
- [ANNOUNCE] Apache Commons JEXL 3.6.3 - posted by Gary Gregory <gg...@apache.org> on 2026/06/23 22:59:41 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 5.0.0-M1 released - posted by Lari Hotari <lh...@apache.org> on 2026/06/23 23:07:33 UTC, 0 replies.
- CVE-2026-56091: Apache Shiro: Authentication bypass in Guice-Web integration - posted by Lenny Primak <lp...@apache.org> on 2026/06/24 18:26:22 UTC, 0 replies.
- CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server - posted by Lenny Primak <lp...@apache.org> on 2026/06/24 18:26:51 UTC, 0 replies.
- CVE-2026-41566: Apache Kvrocks: Improper permission for the APPLYBATCH command - posted by Hulk Lin <hu...@apache.org> on 2026/06/25 02:19:05 UTC, 0 replies.
- CVE-2026-45188: Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling - posted by Hulk Lin <hu...@apache.org> on 2026/06/25 02:20:08 UTC, 0 replies.
- CVE-2026-46751: Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service. - posted by Hulk Lin <hu...@apache.org> on 2026/06/25 02:21:08 UTC, 0 replies.
- CVE-2026-46752: Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() - posted by Hulk Lin <hu...@apache.org> on 2026/06/25 02:22:26 UTC, 0 replies.
- CVE-2026-54226: Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS - posted by Hulk Lin <hu...@apache.org> on 2026/06/25 02:23:26 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Core 5.4.3 GA released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/06/25 09:17:21 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Core 5.5-beta2 released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/06/25 09:23:02 UTC, 0 replies.
- [ANNOUNCE] Apache Kafka 4.3.1 - posted by Bill Bejeck <bb...@apache.org> on 2026/06/25 17:07:24 UTC, 0 replies.
- [ANNOUNCE] Apache log4net 3.3.2 released - posted by Jan Friedrich <fr...@apache.org> on 2026/06/25 20:01:25 UTC, 0 replies.
- CVE-2026-49486: Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P) - posted by Shahar Epstein <sh...@apache.org> on 2026/06/26 05:18:07 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Node.js client 1.18.0 released - posted by Baodi Shi <ba...@apache.org> on 2026/06/26 07:35:18 UTC, 0 replies.
- CVE-2026-57914: Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/26 10:34:16 UTC, 0 replies.
- CVE-2026-57915: Apache Kerby: Kerberos Pre-Authentication Bypass - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/06/26 10:46:50 UTC, 0 replies.
- [ANNOUNCE] Apache Lucene 10.5.0 released - posted by Alan Woodward <ro...@apache.org> on 2026/06/26 17:51:38 UTC, 0 replies.
- Apache MINA 2.1.15 and 2.0.31 released - posted by Emmanuel Lecharny <el...@apache.org> on 2026/06/27 06:28:37 UTC, 0 replies.
- [ANN] Apache Props Ant Library 1.0.0 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/06/27 14:48:46 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko Persistence R2DBC 1.2.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/06/27 20:08:09 UTC, 0 replies.
- [ANNOUNCE] Apache Commons JEXL 3.6.4 - posted by Gary Gregory <gg...@apache.org> on 2026/06/28 12:03:49 UTC, 0 replies.
- [ANNOUNCE] Apache Paimon 1.4.2 and PyPaimon 1.4.2 released - posted by hope <ho...@apache.org> on 2026/06/29 14:22:58 UTC, 0 replies.
- [ANNOUNCE] Apache Artemis 2.55.0 Released - posted by Justin Bertram <jb...@apache.org> on 2026/06/29 18:09:26 UTC, 0 replies.
- CVE-2026-49434: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:20:59 UTC, 0 replies.
- CVE-2026-49432: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:29:09 UTC, 0 replies.
- CVE-2026-49877: Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:29:26 UTC, 0 replies.
- CVE-2026-50734: Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:35:21 UTC, 0 replies.
- CVE-2026-50750: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:35:33 UTC, 0 replies.
- CVE-2026-52760: Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:41:44 UTC, 0 replies.
- CVE-2026-53916: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:42:12 UTC, 0 replies.
- CVE-2026-53917: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:44:11 UTC, 0 replies.
- CVE-2026-54475: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/06/29 18:45:04 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.7 has been releaseed! - posted by Christopher Shannon <cs...@apache.org> on 2026/06/29 19:22:39 UTC, 0 replies.
- [ANNOUNCE] Apache Allura 1.19.1 released - posted by Dave Brondsema <br...@apache.org> on 2026/06/29 20:03:40 UTC, 0 replies.
- [SECURITY] CVE-2026-50229 Apache Tomcat - XXS in number guess example - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:12 UTC, 0 replies.
- [SECURITY] CVE-2026-53404 Apache Tomcat - Bad ornext processing in RewriteValve - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:18 UTC, 0 replies.
- [SECURITY] CVE-2026-53434 Apache Tomcat - Invalid CRL configuration doesn't trigger failure for FFM Connector - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:22 UTC, 0 replies.
- [SECURITY] CVE-2026-55276 Apache Tomcat - Logged effective web.xml is incomplete - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:26 UTC, 0 replies.
- [SECURITY] CVE-2026-55955 Apache Tomcat - EncryptInterceptor not protected against replay attacks - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:31 UTC, 0 replies.
- [SECURITY] CVE-2026-55956 Apache Tomcat - Security constraints for default servlet ignored method - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:35 UTC, 0 replies.
- [SECURITY] CVE-2026-55957 Apache Tomcat - Authentication bypass with JNDIRealm and GSSAPI authenticated bind - posted by Mark Thomas <ma...@apache.org> on 2026/06/29 20:27:39 UTC, 0 replies.
- [ANN] Apache Struts 7.2.1 - posted by Lukasz Lenart <lu...@apache.org> on 2026/06/30 05:55:59 UTC, 0 replies.
- CVE-2025-53648: Apache Gravitino: SQL misconfiguration can access or truncate files - posted by Jerry Shao <js...@apache.org> on 2026/06/30 11:19:42 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Client 5.6.2 Released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/06/30 20:07:12 UTC, 0 replies.