announce@apache.org, 2026-07

You are viewing a plain text version of this content. The canonical link for it is here.

- CVE-2026-54428: Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/07/01 13:11:07 UTC, 0 replies.
- CVE-2026-54399: Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/07/01 13:12:32 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.21.0 Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/07/02 04:24:48 UTC, 0 replies.
- [ANNOUNCE] Apache Log4j `2.26.1` released - posted by Ramanathan Muthu <ra...@apache.org> on 2026/07/02 14:47:26 UTC, 0 replies.
- [ANNOUNCE] Apache Commons JEXL 3.7.0 - posted by Gary Gregory <gg...@apache.org> on 2026/07/02 21:01:28 UTC, 0 replies.
- CVE-2026-47896: Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server - posted by Paul Irwin <pa...@apache.org> on 2026/07/02 23:00:31 UTC, 0 replies.
- CVE-2026-47897: Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client - posted by Paul Irwin <pa...@apache.org> on 2026/07/02 23:03:03 UTC, 0 replies.
- CVE-2026-47898: Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser - posted by Paul Irwin <pa...@apache.org> on 2026/07/02 23:04:15 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.18.3 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/07/03 11:06:45 UTC, 0 replies.
- [ANN] Maven Resolver 2.0.20 Released - posted by Tamás Cservenák <cs...@apache.org> on 2026/07/03 15:34:06 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 4.0.0-beta-1 released - posted by Tim Allison <ta...@apache.org> on 2026/07/03 15:36:54 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-06-26 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/07/03 17:03:02 UTC, 0 replies.
- [ANNOUNCE] Release Apache Groovy 5.0.7 - posted by Paul King <pa...@apache.org> on 2026/07/03 23:48:05 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-alpha-2 Released - posted by Paul King <pa...@apache.org> on 2026/07/04 01:33:32 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.13 - posted by James Fredley <ja...@apache.org> on 2026/07/04 02:47:00 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.3 - posted by James Fredley <ja...@apache.org> on 2026/07/04 02:47:57 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.2.0 - posted by James Fredley <ja...@apache.org> on 2026/07/04 02:48:41 UTC, 0 replies.
- CVE-2026-49297: Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) - posted by Shahar Epstein <sh...@apache.org> on 2026/07/04 05:07:49 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-07-01 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/07/04 19:08:06 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.14.8 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/07/05 07:07:16 UTC, 0 replies.
- CVE-2026-56140: Apache Camel: Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components; because camel-aws2-sns is producer-only (no consumer) there is no reachable inbound header-injection path, so this is a defense-in- - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:45:55 UTC, 0 replies.
- CVE-2026-56139: Apache Camel: Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients - and the option was not honoured - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:46:42 UTC, 0 replies.
- CVE-2026-55994: Apache Camel: Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling server-side request forgery and disclosure of secrets when bridged - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:47:33 UTC, 0 replies.
- CVE-2026-55993: Apache Camel: Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling server-side request forgery and disclosure of secr - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:48:17 UTC, 0 replies.
- CVE-2026-53913: Apache Camel: Camel-Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration (no required roles or permissions) the token is never verified and any non-null bearer value is accepted - a - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:49:04 UTC, 0 replies.
- CVE-2026-49365: Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:49:45 UTC, 0 replies.
- CVE-2026-49099: Apache Camel: Camel-Salesforce: Non-Camel-prefixed Exchange header constants (sObjectQuery, sObjectSearch, apexUrl, ...) bypass the HTTP header filter, allowing an HTTP client to inject SOQL/SOSL queries, override the target SObject, and redirect Apex REST calls using t - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:50:23 UTC, 0 replies.
- CVE-2026-49098: Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:51:02 UTC, 0 replies.
- CVE-2026-49097: Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:51:42 UTC, 0 replies.
- CVE-2026-49086: Apache Camel: Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to redirect the re-published message to an arbitrary Dapr Pub/Su - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:52:21 UTC, 0 replies.
- CVE-2026-48206: Apache Camel: Camel-JIRA: A set of non-Camel-prefixed Exchange header constants (IssueKey, ProjectKey, IssueTransitionId, ...) bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentials - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:52:57 UTC, 0 replies.
- CVE-2026-48205: Apache Camel: Camel-DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect DNS queries to an attacker-controlled server (server-side request forgery) and enumerate internal - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:53:41 UTC, 0 replies.
- CVE-2026-48204: Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:54:21 UTC, 0 replies.
- CVE-2026-48203: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:55:06 UTC, 0 replies.
- CVE-2026-46726: Apache Camel: Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling server-side request forgery and disclosure of - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:55:57 UTC, 0 replies.
- CVE-2026-46592: Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:56:37 UTC, 0 replies.
- CVE-2026-46591: Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169) - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:57:11 UTC, 0 replies.
- CVE-2026-46590: Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048) - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:57:59 UTC, 0 replies.
- CVE-2026-46585: Apache Camel: Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 11:59:26 UTC, 0 replies.
- CVE-2026-46584: Apache Camel: Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties, allowing an attacker to weaken the SMTP transport security and, on releases before 4.19.0, redirect the connection and steal - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:00:01 UTC, 0 replies.
- CVE-2026-46457: Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:00:47 UTC, 0 replies.
- CVE-2026-46456: Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:01:29 UTC, 0 replies.
- CVE-2026-46455: Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:02:08 UTC, 0 replies.
- CVE-2026-46454: Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:02:40 UTC, 0 replies.
- CVE-2026-46453: Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:03:15 UTC, 0 replies.
- CVE-2026-43865: Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:04:33 UTC, 0 replies.
- CVE-2026-42527: Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:05:27 UTC, 0 replies.
- CVE-2026-40859: Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:06:28 UTC, 0 replies.
- CVE-2026-40047: Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/05 12:07:08 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 8.0.0-M2 - posted by James Daugherty <jd...@apache.org> on 2026/07/05 15:58:38 UTC, 0 replies.
- CVE-2026-24012: Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query - posted by Haonan Hou <ha...@apache.org> on 2026/07/06 07:04:02 UTC, 0 replies.
- CVE-2026-24013: Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC - posted by Haonan Hou <ha...@apache.org> on 2026/07/06 07:07:31 UTC, 0 replies.
- CVE-2026-43866: Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/06 07:24:09 UTC, 0 replies.
- CVE-2026-24014: Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write - posted by Haonan Hou <ha...@apache.org> on 2026/07/06 07:27:40 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Client Python 3.13.0 released - posted by Yunze Xu <xy...@apache.org> on 2026/07/06 07:44:04 UTC, 0 replies.
- CVE-2026-43867: Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter - posted by Andrea Cosentino <ac...@apache.org> on 2026/07/06 08:15:00 UTC, 0 replies.
- CVE-2026-46587: Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input - posted by Federico Mariani <fm...@apache.org> on 2026/07/06 09:23:54 UTC, 0 replies.
- CVE-2026-46588: Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input - posted by Federico Mariani <fm...@apache.org> on 2026/07/06 09:24:02 UTC, 0 replies.
- CVE-2026-49042: Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters - posted by Federico Mariani <fm...@apache.org> on 2026/07/06 09:24:08 UTC, 0 replies.
- [ANNOUNCE] Apache Log4j `2.25.5` released - posted by Ramanathan Muthu <ra...@apache.org> on 2026/07/06 09:49:42 UTC, 0 replies.
- [ANNOUNCE] Apache Geronimo XBean 4.31 released - posted by Francois Papon <fp...@apache.org> on 2026/07/06 10:58:41 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.0.12 released - posted by Lari Hotari <lh...@apache.org> on 2026/07/06 11:33:28 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.2.3 released - posted by Lari Hotari <lh...@apache.org> on 2026/07/06 11:35:13 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit 2.23.5-beta released - posted by Manfred Baedke <ba...@apache.org> on 2026/07/06 11:52:51 UTC, 0 replies.
- CVE-2026-43825: Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel - posted by Richard Zowalla <rz...@apache.org> on 2026/07/06 13:06:26 UTC, 0 replies.
- [ANNOUNCE] Apache Shiro 3.0.0 released - new major version - posted by Lenny Primak <lp...@apache.org> on 2026/07/07 01:05:54 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.3.0 Released - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 04:36:43 UTC, 0 replies.
- CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:19:19 UTC, 0 replies.
- CVE-2026-49487: Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:25:46 UTC, 0 replies.
- CVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:26:54 UTC, 0 replies.
- CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:28:19 UTC, 0 replies.
- CVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:29:32 UTC, 0 replies.
- CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options - posted by Rahul Vats <ra...@apache.org> on 2026/07/07 08:31:23 UTC, 0 replies.
- [ANNOUNCE] Apache Daffodil 4.2.0 Released - posted by Olabusayo Kilo <ol...@apache.org> on 2026/07/07 18:42:45 UTC, 1 replies.
- [ANN] Apache Tomcat 9.0.120 available - posted by Rémy Maucherat <re...@apache.org> on 2026/07/07 21:03:40 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.24 Available - posted by Mark Thomas <ma...@apache.org> on 2026/07/08 09:47:42 UTC, 0 replies.
- CVE-2026-41042: Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter - posted by Jerry Shao <js...@apache.org> on 2026/07/08 11:32:54 UTC, 0 replies.
- CVE-2026-57111: Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin - posted by Junkai Xue <jx...@apache.org> on 2026/07/08 17:30:14 UTC, 0 replies.
- [ANNOUNCE] Apache Accumulo 2.1.5 - posted by Christopher <ct...@apache.org> on 2026/07/09 01:51:34 UTC, 0 replies.
- [ANNOUNCE] Apache IoTDB 2.0.10 released - posted by Haonan Hou <ha...@apache.org> on 2026/07/09 02:34:11 UTC, 0 replies.
- Apache Beam 2.75.0 Released! - posted by Vitalii Terentev <vt...@apache.org> on 2026/07/09 08:34:00 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 2.19.0 released - posted by Thomas Wolf <tw...@apache.org> on 2026/07/09 15:18:46 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 3.0.0-M5 released - posted by Thomas Wolf <tw...@apache.org> on 2026/07/09 15:20:44 UTC, 0 replies.
- [ANNOUNCE] Apache Polaris 1.6.0 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/07/10 05:29:17 UTC, 0 replies.
- CVE-2026-28564: Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:25:54 UTC, 0 replies.
- CVE-2026-40005: Apache IoTDB: Path Traversal in Pipe File Transfer Receiver - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:29:24 UTC, 0 replies.
- CVE-2026-40006: Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:30:08 UTC, 0 replies.
- CVE-2026-40007: Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:30:56 UTC, 0 replies.
- CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:31:54 UTC, 1 replies.
- CVE-2026-40009: Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:33:47 UTC, 0 replies.
- CVE-2026-40452: Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:34:47 UTC, 0 replies.
- CVE-2026-40454: Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data - posted by Haonan Hou <ha...@apache.org> on 2026/07/10 06:35:33 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.57 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/07/10 13:55:26 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-07-06 are released - posted by Vincent Beck <vi...@apache.org> on 2026/07/10 17:33:12 UTC, 0 replies.
- CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() - posted by Piotr Karwasz <pk...@apache.org> on 2026/07/10 21:14:08 UTC, 0 replies.
- [ANNOUNCE] Apache PDFBox 3.0.8 released - posted by Andreas Lehmkühler <le...@apache.org> on 2026/07/11 10:34:17 UTC, 0 replies.
- CVE-2026-41041: Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints. - posted by Jerry Shao <js...@apache.org> on 2026/07/13 02:08:15 UTC, 0 replies.
- CVE-2026-49876: Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs - posted by Yu Qi <yu...@apache.org> on 2026/07/13 02:17:45 UTC, 0 replies.
- [ANN] Apache Struts IntelliJ IDEA Plugin 261.19027.1 released - posted by Lukasz Lenart <lu...@apache.org> on 2026/07/13 07:55:21 UTC, 0 replies.
- [ANN] ASF Maven 3.10.0-rc-1 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/07/13 09:18:42 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Helm Chart version 4.7.0 Released - posted by Lari Hotari <lh...@apache.org> on 2026/07/13 12:58:32 UTC, 0 replies.
- CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification - posted by Vincent Beck <vi...@apache.org> on 2026/07/13 14:17:24 UTC, 0 replies.
- CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) - posted by Vincent Beck <vi...@apache.org> on 2026/07/13 14:18:49 UTC, 0 replies.
- CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API - posted by Mingyu Chen <mo...@apache.org> on 2026/07/14 01:29:59 UTC, 0 replies.
- CVE-2026-62390: Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API - posted by Li Yang <li...@apache.org> on 2026/07/14 03:03:43 UTC, 0 replies.
- CVE-2026-62392: Apache Kylin: OS Command Injection via Async Query API - posted by Li Yang <li...@apache.org> on 2026/07/14 03:29:39 UTC, 0 replies.
- CVE-2026-62393: Apache Kylin: Improper authorization in job information retrieval - posted by Li Yang <li...@apache.org> on 2026/07/14 03:54:13 UTC, 0 replies.
- [SECURITY] CVE-2026-59083 Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass - posted by Mark Thomas <ma...@apache.org> on 2026/07/14 08:08:22 UTC, 0 replies.
- [SECURITY] CVE-2026-59084 Apache Tomcat - EncryptInterceptor requirements not clearly documented - posted by Mark Thomas <ma...@apache.org> on 2026/07/14 08:08:31 UTC, 0 replies.
- [ANNOUNCE] Apache OpenMeetings 9.1.0 is released - posted by Maxim Solodovnik <so...@apache.org> on 2026/07/14 09:10:16 UTC, 0 replies.
- CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read - posted by Maxim Solodovnik <so...@apache.org> on 2026/07/14 09:48:36 UTC, 0 replies.
- [ANNOUNCE] Apache Fineract 1.15.0 Release - posted by Adam Monsen <me...@apache.org> on 2026/07/14 17:58:54 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.14 - posted by James Daugherty <jd...@apache.org> on 2026/07/14 23:22:32 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.4 - posted by James Daugherty <jd...@apache.org> on 2026/07/14 23:22:35 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.2.1 - posted by James Daugherty <jd...@apache.org> on 2026/07/14 23:22:38 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit Oak 2.4.0 released - posted by Julian Reschke <re...@apache.org> on 2026/07/15 04:21:41 UTC, 0 replies.
- CVE-2026-56287: Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure - posted by Terence Monteiro <te...@apache.org> on 2026/07/15 05:01:34 UTC, 0 replies.
- CVE-2026-35152: Apache Fineract: SQL injection in runreports endpoint - posted by Terence Monteiro <te...@apache.org> on 2026/07/15 05:15:06 UTC, 0 replies.
- CVE-2026-57821: Apache Fineract: Office list: SQL Injection via Subquery in orderBy - posted by Terence Monteiro <te...@apache.org> on 2026/07/15 05:21:11 UTC, 0 replies.
- [ANNOUNCE] Apache PDFBox 2.0.37 released - posted by Andreas Lehmkühler <le...@apache.org> on 2026/07/15 10:07:30 UTC, 0 replies.
- [ANN] Apache Ivy 2.6.0 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/07/15 15:17:10 UTC, 0 replies.
- CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability - posted by Stefan Bodewig <bo...@apache.org> on 2026/07/15 15:20:15 UTC, 0 replies.
- [ANNOUNCE] Release Apache OpenDAL 0.58.0 - posted by Xuanwo <xu...@apache.org> on 2026/07/16 17:17:46 UTC, 0 replies.
- [ANNOUNCE] Apache Traffic Server 10.1.3 Release - posted by Chris McFarlen <cm...@apache.org> on 2026/07/17 03:07:13 UTC, 0 replies.
- [ANNOUNCE] Apache Accumulo 2.1.6 - posted by Christopher <ct...@apache.org> on 2026/07/17 05:55:46 UTC, 0 replies.
- CVE-2026-62764: Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions - posted by Christopher Tubbs <ct...@apache.org> on 2026/07/17 06:03:41 UTC, 0 replies.
- [ANN] Apache TomEE 10.2.0 - posted by Richard Zowalla <rz...@apache.org> on 2026/07/17 11:48:25 UTC, 0 replies.
- [ANNOUNCE] Apache HBase 3.0.0-beta-2 is now available for download - posted by Duo Zhang <zh...@apache.org> on 2026/07/18 08:40:14 UTC, 0 replies.
- [ANNOUNCE] Apache Magpie 0.1.0 released - posted by Jarek Potiuk <po...@apache.org> on 2026/07/18 23:12:16 UTC, 0 replies.
- [ANNOUNCE] Apache Auron (Incubating) v8.0.0 available - posted by slfan1989 <sl...@apache.org> on 2026/07/19 07:28:53 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.4.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/07/20 06:26:30 UTC, 0 replies.
- [ANN] Apache Syncope 4.1.2 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:09:14 UTC, 0 replies.
- CVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:20:15 UTC, 0 replies.
- CVE-2026-53421: Apache Syncope: Remote Code Execution via Scripted Connector - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:20:25 UTC, 0 replies.
- CVE-2026-57308: Apache Syncope: SQL injection vulnerability in Audit Events search - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:20:38 UTC, 0 replies.
- CVE-2026-62183: Apache Syncope: User self-service privilege escalation - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:20:56 UTC, 0 replies.
- CVE-2026-62418: Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:21:05 UTC, 0 replies.
- CVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypass - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 09:21:14 UTC, 0 replies.
- [ANN] Apache Syncope 4.0.7 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/07/20 11:48:07 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Go Client 0.21.0 released - posted by Zike Yang <zi...@apache.org> on 2026/07/20 12:26:55 UTC, 0 replies.
- CVE-2026-56452: Apache MINA SSHD: Path traversal in SCP file reception - posted by Thomas Wolf <tw...@apache.org> on 2026/07/20 20:19:10 UTC, 0 replies.
- CVE-2026-56623: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows - posted by Thomas Wolf <tw...@apache.org> on 2026/07/20 20:19:18 UTC, 0 replies.
- CVE-2026-56624: Apache MINA SSHD: SSH certificate options lack validations - posted by Thomas Wolf <tw...@apache.org> on 2026/07/20 20:19:33 UTC, 0 replies.
- CVE-2026-58624: Apache MINA SSHD: Remote execution of JGit commands can write files on the server - posted by Thomas Wolf <tw...@apache.org> on 2026/07/20 20:19:51 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow JS 21.2.0 released - posted by Sutou Kouhei <ko...@apache.org> on 2026/07/21 01:41:51 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow 25.0.0 released - posted by Raúl Cumplido <ra...@apache.org> on 2026/07/21 08:00:04 UTC, 0 replies.
- [ANN] Maven Resolver Ant Tasks 1.6.1 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/07/21 09:03:48 UTC, 0 replies.
- CVE-2026-64609: Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization - posted by Chaokun Yang <ch...@apache.org> on 2026/07/21 09:19:08 UTC, 0 replies.
- CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths - posted by Chaokun Yang <ch...@apache.org> on 2026/07/21 09:19:51 UTC, 0 replies.
- CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface - posted by Chaokun Yang <ch...@apache.org> on 2026/07/21 09:58:09 UTC, 0 replies.
- [ANNOUNCE] Apache Mynewt 1.15.0 and Apache Mynewt NimBLE 1.10.0 released - posted by Szymon Janc <ja...@apache.org> on 2026/07/21 10:05:57 UTC, 0 replies.
- [ANNOUNCE] Apache Answer 2.0.2 released - posted by Robin Ren <ro...@apache.org> on 2026/07/21 10:47:04 UTC, 0 replies.
- CVE-2026-60080: Apache Fory: Rust MetaString heap use-after-free - posted by Chaokun Yang <ch...@apache.org> on 2026/07/21 10:49:36 UTC, 0 replies.
- [ANNOUNCE] Release of Apache Doris Operator 26.0.0 - posted by Mingyu Chen <mo...@apache.org> on 2026/07/21 13:55:25 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow Go v18.7.0 Released - posted by Matt Topol <ze...@apache.org> on 2026/07/21 17:38:54 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 3.3.2 released - posted by Tim Allison <ta...@apache.org> on 2026/07/22 15:13:16 UTC, 0 replies.
- [ANN] Maven JAR Plugin 3.5.1 Released - posted by Tamás Cservenák <cs...@apache.org> on 2026/07/22 16:33:34 UTC, 0 replies.
- [ANNOUNCE] Apache Storm 2.8.9 and 3.0.0 Released (Storm 2.x End of Life) - posted by Rui Abreu <ra...@apache.org> on 2026/07/23 00:52:27 UTC, 0 replies.
- [ANNOUNCE] Apache TsFile 2.4.0 released - posted by Haonan Hou <ha...@apache.org> on 2026/07/23 07:09:11 UTC, 0 replies.
- CVE-2026-63317: Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML - posted by Richard Zowalla <rz...@apache.org> on 2026/07/24 07:10:22 UTC, 0 replies.
- [ANNOUNCE] OpenNLP 2.5.11 and 3.0.0-M5 released - posted by Richard Zowalla <rz...@apache.org> on 2026/07/24 07:13:36 UTC, 0 replies.
- [ANNOUNCE] Apache Grails GitHub Actions 1.0.3 - posted by Mattias Reichel <ma...@apache.org> on 2026/07/24 09:00:26 UTC, 0 replies.
- [ANN] Maven Resolver 2.0.21 Released - posted by Tamás Cservenák <cs...@apache.org> on 2026/07/24 09:38:08 UTC, 0 replies.
- [ANNOUNCE] Grails Publish Gradle Plugin 1.0.0-M2 - posted by Mattias Reichel <ma...@apache.org> on 2026/07/24 10:00:46 UTC, 0 replies.
- CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/07/24 10:51:11 UTC, 0 replies.
- CVE-2026-66143: Apache Neethi: Missing global alternative-output budget across policy computation paths - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/07/24 10:53:22 UTC, 0 replies.
- CVE-2026-66144: Apache Neethi: Remote PolicyReference fetch lacks resource bounds - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/07/24 11:03:49 UTC, 0 replies.
- CVE-2026-45811: Apache NimBLE: Buffer overflow in socket HCI transport - posted by Szymon Janc <ja...@apache.org> on 2026/07/24 11:07:58 UTC, 0 replies.
- CVE-2026-45812: Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler - posted by Szymon Janc <ja...@apache.org> on 2026/07/24 11:08:10 UTC, 0 replies.
- CVE-2026-45813: Apache NimBLE: Incorrect data validation in BASS add/modify source operation - posted by Szymon Janc <ja...@apache.org> on 2026/07/24 11:08:16 UTC, 0 replies.
- CVE-2026-45815: Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler - posted by Szymon Janc <ja...@apache.org> on 2026/07/24 11:08:25 UTC, 0 replies.
- CVE-2026-45816: Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request - posted by Szymon Janc <ja...@apache.org> on 2026/07/24 11:08:30 UTC, 0 replies.
- CVE-2026-46452: Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure - posted by Szymon Janc <ja...@apache.org> on 2026/07/24 11:08:43 UTC, 0 replies.
- CVE-2026-49326: Apache HBase: Missing scanner instance owner check in thrift delegation service - posted by Duo Zhang <zh...@apache.org> on 2026/07/24 14:49:09 UTC, 0 replies.
- [ANNOUNCE] Apache SystemDS 3.4.0 - posted by Jannik Lindemann <ja...@apache.org> on 2026/07/24 17:47:31 UTC, 0 replies.
- CVE-2026-41608: Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:41:56 UTC, 0 replies.
- CVE-2026-43871: Apache Thrift: TCompactProtocol varint byte-count limit - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:42:03 UTC, 0 replies.
- CVE-2026-45112: Apache Thrift: Unbounded Read Leading to Denial of Service - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:42:09 UTC, 0 replies.
- CVE-2026-48144: Apache Thrift: c_glib TLS Client Missing Hostname Verification - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:42:19 UTC, 0 replies.
- CVE-2026-48145: Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:42:42 UTC, 0 replies.
- CVE-2026-48586: Apache Thrift: TZlibTransport Decompression Size Limit - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:42:50 UTC, 0 replies.
- CVE-2026-49158: Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:42:58 UTC, 0 replies.
- CVE-2026-55968: Apache Thrift: Node.js quadratic-time DoS in server receive transports - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:07 UTC, 0 replies.
- CVE-2026-55969: Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:14 UTC, 0 replies.
- CVE-2026-55970: Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:22 UTC, 0 replies.
- CVE-2026-55971: Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:30 UTC, 0 replies.
- CVE-2026-58023: Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:38 UTC, 0 replies.
- CVE-2026-58389: Apache Thrift: Rust binary protocol non-strict path missing string size limit - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:47 UTC, 0 replies.
- CVE-2026-58662: Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:43:54 UTC, 0 replies.
- CVE-2026-66053: Apache Thrift: Python TSSLSocket Hostname Matcher Import - posted by Jens Geyer <je...@apache.org> on 2026/07/24 21:44:01 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko HTTP 1.4.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/07/25 15:50:50 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 10.10.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/07/27 09:52:56 UTC, 0 replies.
- CVE-2026-66390: Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence - posted by Pedro Henrique Oliveira dos Santos <pe...@apache.org> on 2026/07/27 16:21:24 UTC, 0 replies.
- CVE-2026-66391: Apache Wicket: leaked and missing CSP headers - posted by Pedro Henrique Oliveira dos Santos <pe...@apache.org> on 2026/07/27 16:21:44 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 5.19.9 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/07/27 17:10:40 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.8 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/07/27 17:12:13 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.3.0 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/07/27 17:14:37 UTC, 0 replies.
- CVE-2026-59878: Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/07/27 17:17:52 UTC, 0 replies.
- CVE-2026-61487: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations - posted by "Christopher L. Shannon" <cs...@apache.org> on 2026/07/27 17:18:11 UTC, 0 replies.
- CVE-2026-66713: Apache Axis2/Java: deserialization of untrusted Data - posted by Robert Lazarski <ro...@apache.org> on 2026/07/27 17:58:08 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-07-22 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/07/28 08:40:22 UTC, 0 replies.
- CVE-2026-59243: Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) - posted by Shahar Epstein <sh...@apache.org> on 2026/07/28 10:24:07 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow ADBC 24 Released - posted by David Li <li...@apache.org> on 2026/07/28 11:51:26 UTC, 0 replies.
- [ANNOUNCE] Apache Kyuubi v1.12.0 is available - posted by Cheng Pan <ch...@apache.org> on 2026/07/28 12:28:38 UTC, 0 replies.
- [SECURITY] CVE-2026-66299 Apache Tomcat - DoS via WebSocket chat example - posted by Mark Thomas <ma...@apache.org> on 2026/07/28 14:26:56 UTC, 0 replies.
- CVE-2026-50622: Apache Atlas: Missing Authorization on Admin Endpoints - posted by Radhika Kundam <ra...@apache.org> on 2026/07/28 17:24:58 UTC, 0 replies.
- [ANNOUNCE] Apache Traffic Server 10.1.4 Release - posted by Chris McFarlen <cm...@apache.org> on 2026/07/28 18:59:36 UTC, 0 replies.
- [ANNOUNCE] Apache log4cxx 1.8.0 released - posted by Stephen Webb <sw...@apache.org> on 2026/07/29 00:16:50 UTC, 0 replies.
- CVE-2026-23904: Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy - posted by Akira Ajisaka <aa...@apache.org> on 2026/07/29 04:00:05 UTC, 0 replies.
- [ANNOUNCE] Apache YuniKorn v1.9.0 released - posted by Wilfred Spiegelenburg <wi...@apache.org> on 2026/07/29 06:49:34 UTC, 0 replies.
- CVE-2026-44613: Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling - posted by Jongyoul Lee <jo...@apache.org> on 2026/07/30 01:32:15 UTC, 0 replies.
- CVE-2026-44615: Apache Zeppelin: Path traversal in NotebookRepo note and folder path composition - posted by Jongyoul Lee <jo...@apache.org> on 2026/07/30 01:37:33 UTC, 0 replies.
- CVE-2026-44616: Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction - posted by Jongyoul Lee <jo...@apache.org> on 2026/07/30 01:38:51 UTC, 0 replies.
- CVE-2026-44617: Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 - posted by Jongyoul Lee <jo...@apache.org> on 2026/07/30 07:13:22 UTC, 0 replies.
- CVE-2026-52680: Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write - posted by Akira Ajisaka <aa...@apache.org> on 2026/07/30 08:26:25 UTC, 0 replies.
- CVE-2026-23981: Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification - posted by Daniel Gaspar <dp...@apache.org> on 2026/07/30 09:16:47 UTC, 0 replies.
- CVE-2026-23985: Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser - posted by Daniel Gaspar <dp...@apache.org> on 2026/07/30 09:21:53 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Codec 1.22.1 - posted by Gary Gregory <gg...@apache.org> on 2026/07/30 10:09:30 UTC, 0 replies.
- [CVE-2026-28811] Error Handling - Reveals Error Details - posted by Juan Pablo Santos Rodríguez <ju...@apache.org> on 2026/07/30 12:14:06 UTC, 0 replies.
- [CVE-2026-28812] UserManager does not sanity-check user database at startup - posted by Juan Pablo Santos Rodríguez <ju...@apache.org> on 2026/07/30 12:14:22 UTC, 0 replies.
- [CVE-2026-28813] JSPWiki vulnerable to JSON hijacking - posted by Juan Pablo Santos Rodríguez <ju...@apache.org> on 2026/07/30 12:14:38 UTC, 0 replies.
- [CVE-2026-28814] Arbitrary Wiki Markup rendering due to lack of authentication - posted by Juan Pablo Santos Rodríguez <ju...@apache.org> on 2026/07/30 12:14:47 UTC, 0 replies.
- [CVE-2026-48910] Markdown parser allows XSS injection in Markdown error processing - posted by Juan Pablo Santos Rodríguez <ju...@apache.org> on 2026/07/30 12:14:53 UTC, 0 replies.
- [ANNOUNCE] Apache ManifoldCF 2.31 released - posted by Piergiorgio Lucidi <pi...@apache.org> on 2026/07/30 14:41:52 UTC, 0 replies.
- CVE-2026-66755: Apache Tika: Arbitrary Local File Read in ISArchiveParser - posted by Tim Allison <ta...@apache.org> on 2026/07/30 16:42:42 UTC, 0 replies.
- CVE-2026-66756: Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false - posted by Tim Allison <ta...@apache.org> on 2026/07/30 16:44:00 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Client 5.6.3 Released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/07/31 08:27:22 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.5.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/07/31 08:31:56 UTC, 0 replies.
- CVE-2026-62391: Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases - posted by Akira Ajisaka <aa...@apache.org> on 2026/07/31 09:19:29 UTC, 0 replies.
- [ANNOUNCE] Apache Jena 6.2.0 - posted by Andy Seaborne <an...@apache.org> on 2026/07/31 11:47:42 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Validator 1.11.0 - posted by Gary Gregory <gg...@apache.org> on 2026/07/31 12:51:43 UTC, 0 replies.