You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Release Apache OpenDAL 0.58.1 - posted by Erick Guan <er...@apache.org> on 2026/08/01 02:14:14 UTC, 0 replies.
- [ANNOUNCE] Release Apache Paimon Rust 0.3.0 - posted by hope <ho...@apache.org> on 2026/08/01 03:34:56 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 4.0.33 Released - posted by Paul King <pa...@apache.org> on 2026/08/01 05:04:05 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 5.0.8 Released - posted by Paul King <pa...@apache.org> on 2026/08/01 06:00:55 UTC, 0 replies.
- [ANN] Apache Struts IntelliJ IDEA Plugin 262.19039.1 released - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/01 07:53:38 UTC, 0 replies.
- [ANNOUNCE] Apache StormCrawler 3.7.0 released - posted by Davide Polato <dp...@apache.org> on 2026/08/02 07:42:00 UTC, 0 replies.
- [ANNOUNCE] Apache Polaris 1.7.0 - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/08/02 13:52:46 UTC, 1 replies.
- [ANNOUNCE] Apache NiFi 2.11.0 Released - posted by Pierre Villard <pv...@apache.org> on 2026/08/03 07:48:33 UTC, 0 replies.
- CVE-2026-61372: Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions - posted by Andy Seaborne <an...@apache.org> on 2026/08/03 15:11:44 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.0.13 released - posted by Lari Hotari <lh...@apache.org> on 2026/08/03 16:08:49 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.2.4 released - posted by Lari Hotari <lh...@apache.org> on 2026/08/03 16:10:04 UTC, 0 replies.
- CVE-2026-68979: Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates - posted by David Handermann <ex...@apache.org> on 2026/08/03 19:44:58 UTC, 0 replies.
- CVE-2026-62354: Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests - posted by David Handermann <ex...@apache.org> on 2026/08/03 19:46:59 UTC, 0 replies.
- CVE-2026-68980: Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion - posted by David Handermann <ex...@apache.org> on 2026/08/03 19:48:39 UTC, 0 replies.
- CVE-2026-68981: Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests - posted by David Handermann <ex...@apache.org> on 2026/08/03 19:50:12 UTC, 0 replies.
- Fwd: [ANN] Apache Maven 4.0.0-rc-6 Released - posted by Guillaume Nodet <gn...@apache.org> on 2026/08/03 23:09:47 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-beta-1 Released - posted by Paul King <pa...@apache.org> on 2026/08/04 06:39:51 UTC, 0 replies.
- Apache ServiceMix is now retired - posted by Niall Pemberton <ni...@apache.org> on 2026/08/04 13:42:31 UTC, 0 replies.
- Apache Petri is now retired - posted by Niall Pemberton <ni...@apache.org> on 2026/08/04 14:43:59 UTC, 0 replies.
- [ANNOUNCE] Apache Qpid Proton-J 0.35.0 released - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:48:11 UTC, 0 replies.
- CVE-2026-66257: Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:48:57 UTC, 0 replies.
- CVE-2026-66273: Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:49:39 UTC, 0 replies.
- CVE-2026-66274: Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:50:05 UTC, 0 replies.
- CVE-2026-66275: Apache Qpid Proton-J: Incoming session flow control window can be exceeded - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:50:32 UTC, 0 replies.
- CVE-2026-66276: Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:50:55 UTC, 0 replies.
- CVE-2026-66277: Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/04 17:51:15 UTC, 0 replies.
- CVE-2026-68060: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:12:16 UTC, 0 replies.
- CVE-2026-68073: Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:13:57 UTC, 0 replies.
- CVE-2026-68074: Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:14:24 UTC, 0 replies.
- CVE-2026-68075: Apache Qpid Broker-J: Incoming session flow control window can be exceeded - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:14:49 UTC, 0 replies.
- CVE-2026-68077: Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:15:18 UTC, 0 replies.
- CVE-2026-68078: Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:15:32 UTC, 0 replies.
- CVE-2026-68080: Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service - posted by Daniil Kirilyuk <da...@apache.org> on 2026/08/04 18:15:44 UTC, 0 replies.
- [ANNOUNCE] Apache Qpid proton-dotnet 1.1.0 released - posted by Timothy Bish <ta...@apache.org> on 2026/08/04 18:39:01 UTC, 0 replies.
- CVE-2026-67465: Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:41:59 UTC, 0 replies.
- CVE-2026-67551: Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:43:40 UTC, 0 replies.
- CVE-2026-67552: Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:44:06 UTC, 0 replies.
- CVE-2026-67553: Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:44:35 UTC, 0 replies.
- CVE-2026-67554: Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:45:07 UTC, 0 replies.
- CVE-2026-67555: Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:45:34 UTC, 0 replies.
- [ANNOUNCE] Apache Qpid protonj2 1.2.0 released - posted by Timothy Bish <ta...@apache.org> on 2026/08/04 18:46:07 UTC, 0 replies.
- CVE-2026-67588: Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:47:56 UTC, 0 replies.
- CVE-2026-67589: Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:48:22 UTC, 0 replies.
- CVE-2026-67590: Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:48:48 UTC, 0 replies.
- CVE-2026-67591: Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:49:14 UTC, 0 replies.
- CVE-2026-67592: Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery - posted by "Timothy A. Bish" <ta...@apache.org> on 2026/08/04 18:49:34 UTC, 0 replies.
- [ANNOUNCE] Apache BVal 3.1.0 - posted by Markus Jung <ju...@apache.org> on 2026/08/05 05:34:25 UTC, 0 replies.
- CVE-2026-61483: Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS - posted by Piotr Karwasz <pk...@apache.org> on 2026/08/05 06:34:57 UTC, 0 replies.
- CVE-2026-61484: Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS - posted by Piotr Karwasz <pk...@apache.org> on 2026/08/05 06:39:40 UTC, 0 replies.
- CVE-2026-61485: Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index - posted by Piotr Karwasz <pk...@apache.org> on 2026/08/05 06:41:03 UTC, 0 replies.
- CVE-2026-61486: Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input - posted by Piotr Karwasz <pk...@apache.org> on 2026/08/05 06:41:24 UTC, 0 replies.
- [ANNOUNCE] Apache Sedona 1.9.1 released - posted by Jia Yu <ji...@apache.org> on 2026/08/05 07:42:35 UTC, 0 replies.
- CVE-2026-48834: Apache Answer: Denial of service via crafted Accept-Language header parsing - posted by Enxin Xie <li...@apache.org> on 2026/08/05 14:25:42 UTC, 0 replies.
- CVE-2026-48911: Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow - posted by Enxin Xie <li...@apache.org> on 2026/08/05 14:26:04 UTC, 0 replies.
- CVE-2026-48912: Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL - posted by Enxin Xie <li...@apache.org> on 2026/08/05 14:26:28 UTC, 0 replies.
- CVE-2026-50749: Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions - posted by Enxin Xie <li...@apache.org> on 2026/08/05 14:26:49 UTC, 0 replies.
- CVE-2026-60023: Apache Answer: Unauthorized disclosure of deleted or pending answer content - posted by Enxin Xie <li...@apache.org> on 2026/08/05 14:27:08 UTC, 0 replies.
- CVE-2026-60053: Apache Answer: Residual Administrative API Key Access After Role or Account Revocation - posted by Enxin Xie <li...@apache.org> on 2026/08/05 14:27:26 UTC, 0 replies.
- [ANNOUNCE] Apache HBase 3.0.0 is now available for download - posted by Duo Zhang <zh...@apache.org> on 2026/08/06 02:07:04 UTC, 0 replies.
- CVE-2026-64640: Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation - posted by Alexandre Dutra <ad...@apache.org> on 2026/08/06 08:53:34 UTC, 0 replies.
- CVE-2026-54225: Apache CXF: Denial of Service attack via large attachments - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 09:59:14 UTC, 0 replies.
- CVE-2026-57819: Apache CXF: No default restriction on the amount of form parameters per message - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:04:42 UTC, 0 replies.
- CVE-2026-64958: Apache CXF: Denial of service via message header attachments - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:09:43 UTC, 0 replies.
- CVE-2026-65432: Apache CXF: XXE via WSDL/XSD import parsing - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:14:02 UTC, 0 replies.
- CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:17:10 UTC, 0 replies.
- CVE-2026-57817: Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:21:01 UTC, 0 replies.
- CVE-2026-57818: Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:27:03 UTC, 0 replies.
- CVE-2026-61466: Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:29:33 UTC, 0 replies.
- CVE-2026-63687: Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:42:10 UTC, 0 replies.
- CVE-2026-65583: Apache CXF: Self-issued ID token claims validation skipped - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:44:32 UTC, 0 replies.
- CVE-2026-68079: Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:46:55 UTC, 0 replies.
- CVE-2026-68481: Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/08/06 10:49:28 UTC, 0 replies.
- [ANNOUNCEMENT] Apache Portable Runtime Utility 1.6.4 Released - posted by covener <co...@apache.org> on 2026/08/06 12:48:55 UTC, 0 replies.
- CVE-2025-49506: Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack - posted by Eric Covener <co...@apache.org> on 2026/08/06 14:04:32 UTC, 0 replies.
- CVE-2026-32327: Apache Portable Runtime Utility: apr-util XML stack recursion crash - posted by Eric Covener <co...@apache.org> on 2026/08/06 14:04:48 UTC, 0 replies.
- CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle - posted by Eric Covener <co...@apache.org> on 2026/08/06 14:05:55 UTC, 0 replies.
- CVE-2026-34501: Apache Portable Runtime Utility: Heap buffer overflow in APR redis client - posted by Eric Covener <co...@apache.org> on 2026/08/06 14:06:11 UTC, 0 replies.
- CVE-2026-34502: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client - posted by Eric Covener <co...@apache.org> on 2026/08/06 14:06:24 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.15 - posted by James Fredley <ja...@apache.org> on 2026/08/06 16:08:10 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.5 - posted by James Fredley <ja...@apache.org> on 2026/08/06 16:09:57 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 8.0.0-M5 - posted by James Fredley <ja...@apache.org> on 2026/08/06 16:10:58 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.2.2 - posted by James Fredley <ja...@apache.org> on 2026/08/06 16:11:50 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit 2.22.4 released - posted by Julian Reschke <re...@apache.org> on 2026/08/06 16:53:41 UTC, 0 replies.
- [ANN] Maven Resolver Ant Tasks 2.0.0 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/08/06 19:23:56 UTC, 0 replies.
- [ANNOUNCEMENT] Apache SkyWalking Go 0.7.0 Released - posted by han liu <li...@apache.org> on 2026/08/07 01:51:01 UTC, 0 replies.
- [ANNOUNCE] Apache Paimon 2.0.0 released - posted by Jingsong Lee <lz...@apache.org> on 2026/08/07 05:56:30 UTC, 0 replies.
- CVE-2026-71560: Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path - posted by Chaokun Yang <ch...@apache.org> on 2026/08/07 07:30:13 UTC, 0 replies.
- CVE-2026-71558: Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization - posted by Chaokun Yang <ch...@apache.org> on 2026/08/07 07:32:46 UTC, 0 replies.
- CVE-2026-71559: Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata - posted by Chaokun Yang <ch...@apache.org> on 2026/08/07 07:39:30 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.6.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/08/07 08:12:46 UTC, 0 replies.
- CVE-2026-61899: Apache Tapestry: Possible classpath file download through URL manipulation - posted by Thiago Henrique De Paula Figueiredo <th...@apache.org> on 2026/08/08 14:02:17 UTC, 0 replies.
- [ANNOUNCE] Apache Ranger 2.9.0 released - posted by Madhan Neethiraj <ma...@apache.org> on 2026/08/08 17:40:17 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-06 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/08/09 01:03:22 UTC, 0 replies.
- CVE-2026-28672: Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:25:54 UTC, 0 replies.
- CVE-2026-32227: Apache Ranger: SQL Injection vulnerability in lookup functionality - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:26:41 UTC, 0 replies.
- CVE-2026-40920: Apache Ranger: Privilege Escalation via URL Parameter - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:27:08 UTC, 0 replies.
- CVE-2026-42537: Apache Ranger: Remote Code Execution via JDBC URL Injection - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:29:03 UTC, 0 replies.
- CVE-2026-44416: Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:29:27 UTC, 0 replies.
- CVE-2026-55799: Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:29:52 UTC, 0 replies.
- CVE-2026-55814: Apache Ranger: Download APIs expose plugin data without authentication - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:30:17 UTC, 0 replies.
- CVE-2026-65942: Apache Ranger: Clients accept TLS certificates issued for other hostnames - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:30:43 UTC, 0 replies.
- CVE-2026-65945: Apache Ranger: Logs contain replayable JWT bearer tokens - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:31:05 UTC, 0 replies.
- CVE-2026-65948: Apache Ranger: UnixAuth lacks brute-force protection - posted by Velmurugan Periasamy <ve...@apache.org> on 2026/08/09 04:31:24 UTC, 0 replies.
- CVE-2026-44630: Apache IoTDB: RPC service denial of service via unchecked Thrift string length - posted by Haonan Hou <ha...@apache.org> on 2026/08/10 06:47:22 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Client 5.6.4 Released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/08/10 10:13:03 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 5.19.10 has been released! - posted by Christopher Shannon <cs...@apache.org> on 2026/08/10 13:20:44 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.9 has been released! - posted by Christopher Shannon <cs...@apache.org> on 2026/08/10 13:21:02 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.3.1 has been released! - posted by Christopher Shannon <cs...@apache.org> on 2026/08/10 13:23:04 UTC, 0 replies.
- CVE-2026-68872: Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable - posted by Jarek Potiuk <po...@apache.org> on 2026/08/10 16:01:09 UTC, 0 replies.
- CVE-2026-68871: Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable - posted by Jarek Potiuk <po...@apache.org> on 2026/08/10 16:01:36 UTC, 0 replies.
- CVE-2026-68870: Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable - posted by Jarek Potiuk <po...@apache.org> on 2026/08/10 16:03:48 UTC, 0 replies.
- Fwd: [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-08 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/08/11 02:54:29 UTC, 0 replies.
- [ANN] Apache Struts 7.3.0 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/11 12:08:24 UTC, 0 replies.
- [ANN] Apache Struts 6.11.0 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/11 12:09:03 UTC, 0 replies.
- CVE-2026-69223: Apache Allura: Server-side request forgery - posted by Dave Brondsema <br...@apache.org> on 2026/08/11 13:12:02 UTC, 0 replies.
- [ANNOUNCE] Apache Qpid JMS 1.17.0 released - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/11 15:09:15 UTC, 0 replies.
- [ANNOUNCE] Apache Qpid JMS 2.11.0 released - posted by Robbie Gemmell <ro...@apache.org> on 2026/08/11 15:10:26 UTC, 0 replies.
- CVE-2026-68868: Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables - posted by Jarek Potiuk <po...@apache.org> on 2026/08/12 08:26:47 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.3.1 Released - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 09:36:27 UTC, 0 replies.
- CVE-2026-58076: Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:22:24 UTC, 0 replies.
- CVE-2026-59244: Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:23:58 UTC, 0 replies.
- CVE-2026-59242: Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:26:17 UTC, 0 replies.
- CVE-2026-54183: Apache Airflow: Airflow Variables were not masked in the UI for authenticated users - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:27:44 UTC, 0 replies.
- CVE-2026-67260: Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:43:31 UTC, 0 replies.
- CVE-2026-67587: Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:45:53 UTC, 0 replies.
- CVE-2026-65017: Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:48:27 UTC, 0 replies.
- CVE-2026-68968: Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:49:21 UTC, 0 replies.
- CVE-2026-68969: Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:51:41 UTC, 0 replies.
- CVE-2026-68970: Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:52:16 UTC, 0 replies.
- CVE-2026-68971: Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:53:06 UTC, 0 replies.
- CVE-2026-68076: Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection - posted by Rahul Vats <ra...@apache.org> on 2026/08/12 13:53:59 UTC, 0 replies.
- Fwd: [ANNOUNCE] Apache Commons Collections 4.6.0 - posted by Gary Gregory <gg...@apache.org> on 2026/08/12 15:03:40 UTC, 0 replies.
- [ANNOUNCE] Apache Lucene 10.5.1 released - posted by Ignacio Vera <iv...@apache.org> on 2026/08/12 15:13:21 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow 25.0.1 released - posted by Raúl Cumplido <ra...@apache.org> on 2026/08/12 15:33:38 UTC, 0 replies.
- CVE-2026-73237: Apache Allura: XSS in markdown pipeline - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:25:38 UTC, 0 replies.
- CVE-2026-73238: Apache Allura: XSS in code display - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:28:11 UTC, 0 replies.
- CVE-2026-73239: Apache Allura: Missing permission checks IDOR - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:29:42 UTC, 0 replies.
- CVE-2026-73240: Apache Allura: Git command injection - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:34:23 UTC, 0 replies.
- CVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/08/13 08:52:34 UTC, 0 replies.
- CVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/08/13 08:56:11 UTC, 0 replies.
- CVE-2026-66256: Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API) - posted by Arnout Engelen <en...@apache.org> on 2026/08/13 13:52:35 UTC, 0 replies.
- [ANNOUNCE] Apache Bigtop 3.6.0 released - posted by Masatake Iwasaki <iw...@apache.org> on 2026/08/14 06:19:13 UTC, 0 replies.
- [ANN] CVE-2026-73631: Apache Struts: Shared parsing state in the JSON plugin - S2-070 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/14 06:58:06 UTC, 0 replies.
- [ANN] CVE-2026-73632: Apache Struts: Shared serialization state in the JSON plugin - S2-071 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/14 06:59:09 UTC, 0 replies.
- [ANN] CVE-2026-73633: Apache Struts: Unbounded read of a JSON request body - S2-072 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/14 06:59:54 UTC, 0 replies.
- [ANN] CVE-2026-73634: Apache Struts: Unbounded read of a Content Security Policy violation report - S2-073 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/14 07:00:41 UTC, 0 replies.
- [ANN] CVE-2026-73635: Apache Struts: Unbounded growth of localized-text caches driven by the request locale - S2-074 - posted by Lukasz Lenart <lu...@apache.org> on 2026/08/14 07:02:01 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.2 released - posted by David Jensen <dj...@apache.org> on 2026/08/14 09:11:36 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 5.1.0 Released - posted by Paul King <pa...@apache.org> on 2026/08/15 04:35:33 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-beta-2 Released - posted by Paul King <pa...@apache.org> on 2026/08/15 06:02:57 UTC, 0 replies.
- [ANNOUNCE] Apache Texera 1.2.0-incubating released - posted by Xuan Gu <xu...@apache.org> on 2026/08/15 06:53:17 UTC, 0 replies.
- [ANNOUNCE] Apache Ratis 3.3.0 Release - posted by Xinyu Tan <ta...@apache.org> on 2026/08/15 08:53:31 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.14.9 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/08/16 14:35:42 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.6.1 released - posted by Shawn Yang <ch...@apache.org> on 2026/08/17 10:11:12 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.18.4 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/08/17 10:58:45 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Client 5.7-alpha1 Released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/08/17 12:41:16 UTC, 0 replies.
- [ANNOUNCE] Apache Qpid protonj2 1.3.0 released - posted by Timothy Bish <ta...@apache.org> on 2026/08/17 16:07:57 UTC, 0 replies.
- [ANNOUNCE] Apache Traffic Server 10.2.0 Release - posted by Chris McFarlen <cm...@apache.org> on 2026/08/17 20:31:31 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.25 Available - posted by Mark Thomas <ma...@apache.org> on 2026/08/18 11:02:38 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.121 available - posted by Rémy Maucherat <re...@apache.org> on 2026/08/18 11:22:31 UTC, 0 replies.
- [ANNOUNCE] Apache APISIX Ingress controller v2.2.0 released - posted by Xin Rong <al...@apache.org> on 2026/08/18 15:40:00 UTC, 0 replies.
- [ANNOUNCE] Apache DataSketches Rust 0.4.0 released - posted by tison <ti...@apache.org> on 2026/08/19 03:33:11 UTC, 0 replies.
- [ANNOUNCE] Release Apache Hop 2.19.0 - posted by Bart Maertens <ba...@apache.org> on 2026/08/20 09:10:21 UTC, 0 replies.
- [ANNOUNCE] Release Apache InLong 2.4.0 - posted by Verne Deng <ve...@apache.org> on 2026/08/20 10:41:40 UTC, 0 replies.
- CVE-2026-63015: Apache InLong: Non-template responsible persons can view template information - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:19:11 UTC, 0 replies.
- CVE-2026-63016: Apache InLong: Ordinary users can create new packages - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:20:56 UTC, 0 replies.
- CVE-2026-63037: Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:21:12 UTC, 0 replies.
- CVE-2026-63038: Apache InLong: SQL Injection via String Concatenation Vulnerability Report - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:21:18 UTC, 0 replies.
- CVE-2026-63039: Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:21:23 UTC, 0 replies.
- CVE-2026-63040: Apache InLong: Missing authorization in StreamSource forceDelete - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:21:27 UTC, 0 replies.
- CVE-2026-63042: Apache InLong: Missing authorization on DataNode management endpoints - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:21:31 UTC, 0 replies.
- CVE-2026-63044: Apache InLong: Authenticated SSRF via POST /api/node/testConnection - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:21:44 UTC, 0 replies.
- CVE-2026-63043: Apache InLong: Agent path traversal via unvalidated file source path - posted by Charles Zhang <do...@apache.org> on 2026/08/20 14:32:06 UTC, 0 replies.
- [ANNOUNCE] Release Apache OpenDAL 0.58.2 - posted by Erick Guan <er...@apache.org> on 2026/08/21 01:25:03 UTC, 0 replies.
- [ADVISORY] Apache CloudStack LTS Security Releases 4.20.3.1 and 4.22.1.1 - posted by Abhishek Kumar <sh...@apache.org> on 2026/08/21 08:13:15 UTC, 1 replies.
- [ANNOUNCE] Apache Pekko (Core) 1.7.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/08/21 09:21:31 UTC, 0 replies.
- [ANNOUNCE] Release Apache Paimon Vector Index 0.4.0 - posted by jerry jing <je...@apache.org> on 2026/08/21 09:38:46 UTC, 0 replies.
- [ANNOUNCE] Apache Casbin (Incubating) 3.11.0 released - posted by Yanrui Zhang <em...@apache.org> on 2026/08/21 13:25:25 UTC, 0 replies.
- [ANNOUNCE] Apache log4net 3.4.0 released - posted by Jan Friedrich <fr...@apache.org> on 2026/08/21 21:14:38 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 4.0.0 released - posted by Tim Allison <ta...@apache.org> on 2026/08/22 02:41:50 UTC, 0 replies.
- [ANNOUNCE] Apache SedonaDB 0.4.1 released - posted by Jia Yu <ji...@apache.org> on 2026/08/23 00:01:18 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko Connectors Kafka 1.2.0 released - posted by PJ Fanning <fa...@apache.org> on 2026/08/23 00:44:17 UTC, 0 replies.
- [ANNOUNCE] Apache Avro 1.12.2 released - posted by Ryan Skraba <rs...@apache.org> on 2026/08/23 12:27:59 UTC, 0 replies.
- Fwd: [ANNOUNCE] Apache JSPWiki 2.12.5 released - posted by Alex O'Ree <al...@apache.org> on 2026/08/23 14:44:24 UTC, 0 replies.
- Fwd: [ANNOUNCE] Apache JSPWiki 3.0.0 released - posted by Alex O'Ree <al...@apache.org> on 2026/08/23 14:44:51 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-18 are released - posted by Hussein Awala <hu...@apache.org> on 2026/08/23 20:56:19 UTC, 0 replies.
- [ANN] Maven Resolver 2.0.22 Released - posted by Tamás Cservenák <cs...@apache.org> on 2026/08/24 07:51:20 UTC, 0 replies.
- CVE-2026-59230: Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:04:30 UTC, 0 replies.
- CVE-2026-60093: Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:05:31 UTC, 0 replies.
- CVE-2026-63621: Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:06:18 UTC, 0 replies.
- CVE-2026-66906: Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:07:07 UTC, 0 replies.
- CVE-2026-66907: Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:07:39 UTC, 0 replies.
- CVE-2026-66908: Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:08:07 UTC, 0 replies.
- CVE-2026-71300: Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:08:32 UTC, 0 replies.
- CVE-2026-78329: Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes - posted by Andrea Cosentino <ac...@apache.org> on 2026/08/24 14:09:03 UTC, 0 replies.
- [ANNOUNCE] Apache Allura 1.20.0 released - posted by Dave Brondsema <br...@apache.org> on 2026/08/24 16:16:27 UTC, 0 replies.
- CVE-2026-75099: Apache Allura: Unauthenticated REST disclosure - posted by Dave Brondsema <br...@apache.org> on 2026/08/24 16:19:00 UTC, 0 replies.
- Fwd: [ANNOUNCE] Apache Hive 4.2.1 Released - posted by Sai Hemanth Gantasala <gs...@apache.org> on 2026/08/24 19:38:54 UTC, 0 replies.
- [ANNOUNCE] Apache XMLBeans 5.4.0 release - posted by PJ Fanning <fa...@apache.org> on 2026/08/25 11:44:46 UTC, 0 replies.
- [SECURITY] CVE-2026-65182 Apache Tomcat - Security constraint bypass - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:26 UTC, 0 replies.
- [SECURITY] CVE-2026-65183 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:32 UTC, 0 replies.
- [SECURITY] CVE-2026-65637 Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:39 UTC, 0 replies.
- [SECURITY] CVE-2026-65905 Apache Tomcat - Limited replay attack possible with DIGEST authentication - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:45 UTC, 0 replies.
- [SECURITY] CVE-2026-65927 Apache Tomcat - RewriteValve [N] restarts at the second rule and may bypass access control - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:50 UTC, 0 replies.
- [SECURITY] CVE-2026-66422 Apache Tomcat - Servlet role references can bypass declarative role constraints - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:55 UTC, 0 replies.
- [SECURITY] CVE-2026-68525 Apache Tomcat - Redirect after FORM authentication may bypass method specific constraints - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:32:59 UTC, 0 replies.
- [SECURITY] CVE-2026-68569 Apache Tomcat - Principal lookup can fail open in some cases - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:33:04 UTC, 0 replies.
- [SECURITY] CVE-2026-68763 Apache Tomcat - DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:33:08 UTC, 0 replies.
- [SECURITY] CVE-2026-73180 Apache Tomcat - Authenticated WebSocket session survives end of HTTP session - posted by Mark Thomas <ma...@apache.org> on 2026/08/25 21:33:13 UTC, 0 replies.
- [ANNOUNCE] Apache APISIX 3.18.0 has been released - posted by Abhishek Choudhary <sh...@apache.org> on 2026/08/26 04:16:40 UTC, 0 replies.
- CVE-2026-63041: Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers - posted by Abhishek Choudhary <sh...@apache.org> on 2026/08/26 04:42:48 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.3 released - posted by David Jensen <dj...@apache.org> on 2026/08/26 11:43:32 UTC, 0 replies.
- CVE-2026-74848: Apache APISIX: Cross-user response poisoning in serverless plugins - posted by Abhishek Choudhary <sh...@apache.org> on 2026/08/26 14:51:22 UTC, 0 replies.
- CVE-2026-75005: Apache APISIX: Unauthenticated CPU-exhaustion DoS - posted by Abhishek Choudhary <sh...@apache.org> on 2026/08/26 14:52:03 UTC, 0 replies.
- CVE-2026-75020: Apache APISIX: ldap-auth plugin cross-subtree identity impersonation - posted by Abhishek Choudhary <sh...@apache.org> on 2026/08/26 14:55:34 UTC, 0 replies.
- CVE-2026-49845: Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths - posted by Sai Hemanth Gantasala <gs...@apache.org> on 2026/08/26 17:50:58 UTC, 0 replies.
- CVE-2026-53561: Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user - posted by Sai Hemanth Gantasala <gs...@apache.org> on 2026/08/26 17:54:24 UTC, 0 replies.
- CVE-2026-55976: Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url - posted by Sai Hemanth Gantasala <gs...@apache.org> on 2026/08/26 19:43:09 UTC, 0 replies.
- [ANNOUNCE] Apache XTable 0.4.0-incubating released - posted by Vinish Reddy <vi...@apache.org> on 2026/08/26 21:38:32 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.16 - posted by James Daugherty <jd...@apache.org> on 2026/08/27 01:26:12 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.6 - posted by James Daugherty <jd...@apache.org> on 2026/08/27 01:26:14 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.2.3 - posted by James Daugherty <jd...@apache.org> on 2026/08/27 01:26:16 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 5.1.1 Released - posted by Paul King <pa...@apache.org> on 2026/08/27 04:53:45 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-beta-3 Released - posted by Paul King <pa...@apache.org> on 2026/08/27 07:29:06 UTC, 0 replies.
- [ANNOUNCE] Apache Artemis 2.56.0 Released - posted by Domenico Francesco Bruscino <br...@apache.org> on 2026/08/27 08:29:49 UTC, 0 replies.
- [ANNOUNCE] Apache Shiro 3.0.1 released - posted by Lenny Primak <lp...@apache.org> on 2026/08/27 16:49:40 UTC, 0 replies.
- [ANNOUNCE] Apache Ozone 2.2.1 released - posted by Wei-Chiu Chuang <we...@apache.org> on 2026/08/27 22:08:43 UTC, 0 replies.
- [ANNOUNCEMENT] Apache SkyWalking BanyanDB 0.11.0 Released - posted by ha...@apache.org on 2026/08/28 02:51:24 UTC, 0 replies.
- [ANNOUNCE] Apache SkyWalking 11.0.0 released - posted by Kai Wan <wa...@apache.org> on 2026/08/28 03:04:58 UTC, 0 replies.
- [ANNOUNCE] Apache FreeMarker 2.3.35 is released - posted by Daniel Dekany <dd...@apache.org> on 2026/08/28 21:51:18 UTC, 0 replies.
- [ANNOUNCE] Apache Burr (Incubating) 0.43.0 released - posted by Jernej Frank <je...@apache.org> on 2026/08/29 20:35:37 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 8.0.0-M6 - posted by Mattias Reichel <ma...@apache.org> on 2026/08/29 21:51:56 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-25 are released - posted by Niko Oliveira <on...@apache.org> on 2026/08/30 00:49:10 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 8.19.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/08/30 11:18:31 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 9.24.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/08/30 11:19:49 UTC, 0 replies.
- [ANNOUNCE] Apache Wicket 10.11.0 released - posted by Andrea Del Bene <ad...@apache.org> on 2026/08/30 11:38:34 UTC, 0 replies.
- CVE-2026-70449: Apache Wicket: Path traversal in resource style/variation/locale - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/30 17:50:05 UTC, 0 replies.
- CVE-2026-71257: Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/30 17:52:49 UTC, 0 replies.
- CVE-2026-71378: Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/30 18:55:42 UTC, 0 replies.
- CVE-2026-58301: Apache Shiro: Server-side POST request may be steered to an alternate host - posted by Lenny Primak <lp...@apache.org> on 2026/08/30 20:02:27 UTC, 0 replies.
- CVE-2026-76986: Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/31 06:43:42 UTC, 0 replies.
- CVE-2026-76985: Apache Wicket: XSS in Palette via getAdditionalAttributes - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/31 06:43:54 UTC, 0 replies.
- CVE-2026-76984: Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/31 06:44:05 UTC, 0 replies.
- CVE-2026-76983: Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/31 06:44:13 UTC, 0 replies.
- CVE-2026-76982: Apache Wicket: XSS in Button via its model object - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/31 06:44:25 UTC, 0 replies.
- CVE-2026-75802: Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel - posted by Emond Papegaaij <pa...@apache.org> on 2026/08/31 06:45:03 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.7.0 released - posted by Shawn Yang <ch...@apache.org> on 2026/08/31 16:28:36 UTC, 0 replies.