You are viewing a plain text version of this content. The canonical link for it is here.

---

- CVE-2026-69223: Apache Allura: Server-side request forgery - posted by Dave Brondsema <br...@apache.org> on 2026/08/11 13:12:02 UTC, 0 replies.
- CVE-2026-73237: Apache Allura: XSS in markdown pipeline - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:25:38 UTC, 0 replies.
- CVE-2026-73238: Apache Allura: XSS in code display - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:28:11 UTC, 0 replies.
- CVE-2026-73239: Apache Allura: Missing permission checks IDOR - posted by Dave Brondsema <br...@apache.org> on 2026/08/12 16:29:42 UTC, 0 replies.
- CVE-2026-73240: Apache Allura: Git command injection - posted by Dave Brondsema <da...@brondsema.net> on 2026/08/12 16:31:21 UTC, 0 replies.
- [ANNOUNCE] Apache Allura 1.20.0 released - posted by Dave Brondsema <da...@brondsema.net> on 2026/08/24 16:16:09 UTC, 0 replies.
- CVE-2026-75099: Apache Allura: Unauthenticated REST disclosure - posted by Dave Brondsema <br...@apache.org> on 2026/08/24 16:19:00 UTC, 0 replies.