You are viewing a plain text version of this content. The canonical link for it is here.

---

- CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening - posted by James Netherton <ja...@apache.org> on 2026/10/01 07:11:24 UTC, 0 replies.
- [ANN] Maven Resolver 2.0.24 Released - posted by Tamás Cservenák <cs...@apache.org> on 2026/10/01 08:11:14 UTC, 0 replies.
- [ANNOUNCE] Apache APISIX 3.19.0 has been released - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 08:23:41 UTC, 0 replies.
- CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 08:53:30 UTC, 0 replies.
- CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 08:55:30 UTC, 0 replies.
- CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 08:56:42 UTC, 0 replies.
- CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 08:57:22 UTC, 0 replies.
- CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 09:00:16 UTC, 0 replies.
- CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 09:02:43 UTC, 0 replies.
- CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue - posted by Abhishek Choudhary <sh...@apache.org> on 2026/10/01 09:03:31 UTC, 0 replies.
- [ANNOUNCE] Maven 3.10.0 released - posted by Tamás Cservenák <cs...@apache.org> on 2026/10/01 10:21:41 UTC, 0 replies.
- [ANNOUNCEMENT] Apache HTTP Server 2.4.69 Released - posted by covener <co...@apache.org> on 2026/10/01 14:29:07 UTC, 0 replies.
- CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:03:01 UTC, 0 replies.
- CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:03:08 UTC, 0 replies.
- CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:03:14 UTC, 0 replies.
- CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:03:21 UTC, 0 replies.
- CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:04:23 UTC, 0 replies.
- CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:04:43 UTC, 0 replies.
- CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:05:31 UTC, 0 replies.
- CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:05:40 UTC, 0 replies.
- CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:07:12 UTC, 0 replies.
- CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:07:17 UTC, 0 replies.
- CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:07:40 UTC, 0 replies.
- CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:07:46 UTC, 0 replies.
- CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:08:30 UTC, 0 replies.
- CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:08:36 UTC, 0 replies.
- CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:08:44 UTC, 0 replies.
- CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:09:33 UTC, 0 replies.
- CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:09:41 UTC, 0 replies.
- CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:09:49 UTC, 0 replies.
- CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:10:04 UTC, 0 replies.
- CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM - posted by Eric Covener <co...@apache.org> on 2026/10/01 18:13:29 UTC, 0 replies.
- [ANNOUNCE] Apache log4net 3.5.0 released - posted by Jan Friedrich <fr...@apache.org> on 2026/10/01 20:09:43 UTC, 0 replies.
- CVE-2026-61373: Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:45:53 UTC, 0 replies.
- CVE-2026-61374: Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:46:10 UTC, 0 replies.
- CVE-2026-63772: Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:46:17 UTC, 0 replies.
- CVE-2026-66054: Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:46:25 UTC, 0 replies.
- CVE-2026-66055: Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:46:33 UTC, 0 replies.
- CVE-2026-66081: Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:01 UTC, 0 replies.
- CVE-2026-66331: Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:06 UTC, 0 replies.
- CVE-2026-66837: Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:12 UTC, 0 replies.
- CVE-2026-66858: Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:19 UTC, 0 replies.
- CVE-2026-66859: Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:26 UTC, 0 replies.
- CVE-2026-82458: Apache Thrift: Container element count not bounded by the bytes available - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:39 UTC, 0 replies.
- CVE-2026-82459: Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:47 UTC, 0 replies.
- CVE-2026-83632: Apache Thrift: C++ THttpTransport grows its line buffer without bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:47:56 UTC, 0 replies.
- CVE-2026-83663: Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:03 UTC, 0 replies.
- CVE-2026-83745: Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:11 UTC, 0 replies.
- CVE-2026-85086: Apache Thrift: Perl TLS client disables certificate verification by default - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:18 UTC, 0 replies.
- CVE-2026-85087: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:27 UTC, 0 replies.
- CVE-2026-85088: Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:37 UTC, 0 replies.
- CVE-2026-85476: Apache Thrift: c_glib `read_all` spins when the underlying read returns 0 - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:51 UTC, 0 replies.
- CVE-2026-85483: Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:48:56 UTC, 0 replies.
- CVE-2026-85493: Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:09 UTC, 0 replies.
- CVE-2026-85494: Apache Thrift: Framed transport and binary protocol size a read buffer from a peer-declared length with no effective maximum (multi-language) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:16 UTC, 0 replies.
- CVE-2026-86535: Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:20 UTC, 0 replies.
- CVE-2026-86536: Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:26 UTC, 0 replies.
- CVE-2026-86537: Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:31 UTC, 0 replies.
- CVE-2026-87117: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:35 UTC, 0 replies.
- CVE-2026-90440: Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:43 UTC, 0 replies.
- CVE-2026-91135: Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:49:56 UTC, 0 replies.
- CVE-2026-91137: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:05 UTC, 0 replies.
- CVE-2026-92834: Apache Thrift: C++ WebSocket server transport does not read a full request length - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:15 UTC, 0 replies.
- CVE-2026-93925: Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:20 UTC, 0 replies.
- CVE-2026-93926: Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:26 UTC, 0 replies.
- CVE-2026-94633: Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:34 UTC, 0 replies.
- CVE-2026-94634: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:50:40 UTC, 0 replies.
- CVE-2026-96289: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:16 UTC, 0 replies.
- CVE-2026-94652: Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:25 UTC, 0 replies.
- CVE-2026-94653: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:33 UTC, 0 replies.
- CVE-2026-94646: Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:42 UTC, 0 replies.
- CVE-2026-94648: Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:51:50 UTC, 0 replies.
- CVE-2026-94657: Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:18 UTC, 0 replies.
- CVE-2026-94658: Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:24 UTC, 0 replies.
- CVE-2026-96277: Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:32 UTC, 0 replies.
- CVE-2026-96286: Apache Thrift: Perl servers end `serve()` when serving one connection fails - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:52:39 UTC, 0 replies.
- CVE-2026-94635: Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:21 UTC, 0 replies.
- CVE-2026-94636: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:26 UTC, 0 replies.
- CVE-2026-94637: Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:33 UTC, 0 replies.
- CVE-2026-94638: Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:42 UTC, 0 replies.
- CVE-2026-94639: Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:53:48 UTC, 0 replies.
- CVE-2026-94654: Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:29 UTC, 0 replies.
- CVE-2026-94655: Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:35 UTC, 0 replies.
- CVE-2026-94656: Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:42 UTC, 0 replies.
- CVE-2026-96287: Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:54:53 UTC, 0 replies.
- CVE-2026-96288: Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:55:00 UTC, 0 replies.
- CVE-2026-96292: Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:55:43 UTC, 0 replies.
- CVE-2026-96294: Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:30 UTC, 0 replies.
- CVE-2026-96990: Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:36 UTC, 0 replies.
- CVE-2026-94642: Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:45 UTC, 0 replies.
- CVE-2026-94644: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:56:55 UTC, 0 replies.
- CVE-2026-94645: Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:57:01 UTC, 0 replies.
- CVE-2026-94650: Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion) - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:57:13 UTC, 0 replies.
- CVE-2026-94651: Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error - posted by Jens Geyer <je...@apache.org> on 2026/10/01 23:57:52 UTC, 0 replies.
- [ANNOUNCE] Apache Gravitino 1.3.1 released - posted by Bharath Krishna <bh...@apache.org> on 2026/10/02 06:50:31 UTC, 0 replies.
- CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode - posted by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:47:42 UTC, 0 replies.
- CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder - posted by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:47:56 UTC, 0 replies.
- CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements - posted by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:48:05 UTC, 0 replies.
- CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS - posted by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:48:13 UTC, 0 replies.
- CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords - posted by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:48:33 UTC, 0 replies.
- CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values - posted by Emmanuel Lécharny <el...@apache.org> on 2026/10/02 08:48:51 UTC, 0 replies.
- [ANN] Apache Struts 7.4.0 - posted by Lukasz Lenart <lu...@apache.org> on 2026/10/02 10:47:30 UTC, 0 replies.
- [ANN] Apache Struts 6.12.0 - posted by Lukasz Lenart <lu...@apache.org> on 2026/10/02 10:48:05 UTC, 0 replies.
- CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover - posted by Dave Fisher <wa...@apache.org> on 2026/10/02 17:30:55 UTC, 0 replies.
- [ANNOUNCE] Grails Publish Gradle Plugin 1.0.0-RC2 - posted by Mattias Reichel <ma...@apache.org> on 2026/10/02 21:40:46 UTC, 0 replies.
- CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper - posted by Lukasz Lenart <lu...@apache.org> on 2026/10/05 07:11:49 UTC, 0 replies.
- CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters - posted by Lukasz Lenart <lu...@apache.org> on 2026/10/05 07:12:32 UTC, 0 replies.
- CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin - posted by Lukasz Lenart <lu...@apache.org> on 2026/10/05 07:13:06 UTC, 0 replies.
- CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests - posted by Lukasz Lenart <lu...@apache.org> on 2026/10/05 07:13:29 UTC, 0 replies.
- [ANNOUNCE] OpenDAL 0.59.4-rc.2 released - posted by xu...@apache.org on 2026/10/05 09:31:43 UTC, 0 replies.
- [ANN] Apache Tomcat Migration tool for Jakarta EE 1.0.13 - posted by Mark Thomas <ma...@apache.org> on 2026/10/05 13:14:24 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko (Core) 1.7.1 released - posted by PJ Fanning <fa...@apache.org> on 2026/10/05 14:40:10 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-02 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/10/05 18:17:26 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.2.5 released - posted by Lari Hotari <lh...@apache.org> on 2026/10/05 20:10:45 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.0.14 released - posted by Lari Hotari <lh...@apache.org> on 2026/10/05 20:11:33 UTC, 0 replies.
- [ANNOUNCE] Apache James 3.9.1 released - posted by "Benoit TELLIER (Apache)" <bt...@apache.org> on 2026/10/05 21:51:29 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 5.0.0 LTS released - posted by Lari Hotari <lh...@apache.org> on 2026/10/06 00:53:33 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Secure XML 1.1.0 - posted by Gary Gregory <gg...@apache.org> on 2026/10/06 11:04:28 UTC, 0 replies.
- CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser - posted by "Gary D. Gregory" <gg...@apache.org> on 2026/10/06 19:38:04 UTC, 0 replies.
- CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS - posted by "Gary D. Gregory" <gg...@apache.org> on 2026/10/06 19:38:23 UTC, 0 replies.
- CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records - posted by Jan Friedrich <fr...@apache.org> on 2026/10/06 19:42:36 UTC, 0 replies.
- CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records - posted by Jan Friedrich <fr...@apache.org> on 2026/10/06 19:42:55 UTC, 0 replies.
- CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch - posted by Jan Friedrich <fr...@apache.org> on 2026/10/06 19:43:05 UTC, 0 replies.
- CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter - posted by Jan Friedrich <fr...@apache.org> on 2026/10/06 19:43:14 UTC, 0 replies.
- CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded - posted by Jan Friedrich <fr...@apache.org> on 2026/10/06 19:43:24 UTC, 0 replies.
- CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content - posted by Jan Friedrich <fr...@apache.org> on 2026/10/06 19:43:34 UTC, 0 replies.
- [ANNOUNCE] Apache Impala 4.5.3 release - posted by Michael Smith <mi...@apache.org> on 2026/10/06 21:40:14 UTC, 0 replies.
- CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass - posted by Michael Smith <mi...@apache.org> on 2026/10/06 22:05:32 UTC, 0 replies.
- CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans - posted by Michael Smith <mi...@apache.org> on 2026/10/06 22:08:17 UTC, 0 replies.
- CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths - posted by Michael Smith <mi...@apache.org> on 2026/10/06 22:08:24 UTC, 0 replies.
- [ANNOUNCE] Apache YuniKorn v1.10.0 released - posted by Wilfred Spiegelenburg <wi...@apache.org> on 2026/10/07 06:40:20 UTC, 0 replies.
- CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation - posted by Wilfred Spiegelenburg <wi...@apache.org> on 2026/10/07 06:43:20 UTC, 0 replies.
- CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name - posted by Wilfred Spiegelenburg <wi...@apache.org> on 2026/10/07 06:44:20 UTC, 0 replies.
- CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery - posted by Wilfred Spiegelenburg <wi...@apache.org> on 2026/10/07 06:45:02 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit 2.23.6-beta released - posted by Julian Reschke <re...@apache.org> on 2026/10/07 08:29:57 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit 2.22.5 released - posted by Julian Reschke <re...@apache.org> on 2026/10/07 08:32:58 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit 2.20.18 released - posted by Julian Reschke <re...@apache.org> on 2026/10/07 08:34:55 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko HTTP 1.4.1 released - posted by PJ Fanning <fa...@apache.org> on 2026/10/07 10:20:16 UTC, 0 replies.
- CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens - posted by Julian Reschke <re...@apache.org> on 2026/10/07 15:07:32 UTC, 0 replies.
- CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies - posted by Julian Reschke <re...@apache.org> on 2026/10/07 15:08:27 UTC, 0 replies.
- CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File - posted by Jinwoo Hwang <ji...@apache.org> on 2026/10/07 17:19:53 UTC, 0 replies.
- CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） - posted by Wenjun Ruan <we...@apache.org> on 2026/10/08 01:45:32 UTC, 0 replies.
- CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint - posted by Wenjun Ruan <we...@apache.org> on 2026/10/08 01:45:45 UTC, 0 replies.
- CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint - posted by Wenjun Ruan <we...@apache.org> on 2026/10/08 01:45:58 UTC, 0 replies.
- CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords - posted by Wenjun Ruan <we...@apache.org> on 2026/10/08 01:46:12 UTC, 0 replies.
- CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials - posted by Wenjun Ruan <we...@apache.org> on 2026/10/08 01:46:24 UTC, 0 replies.
- CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information - posted by Wenjun Ruan <we...@apache.org> on 2026/10/08 01:46:36 UTC, 0 replies.
- Apache Beam 2.77.0 Released! - posted by Vitalii Terentev <vt...@apache.org> on 2026/10/08 14:10:21 UTC, 0 replies.
- [ANNOUNCE] Apache Maka 0.2.0 (incubating) released - posted by Yuhan Lei <as...@apache.org> on 2026/10/09 00:20:45 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.4 released - posted by David Jensen <dj...@apache.org> on 2026/10/09 07:31:57 UTC, 0 replies.
- CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:51:14 UTC, 0 replies.
- CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:52:15 UTC, 0 replies.
- CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:52:54 UTC, 0 replies.
- CVE-2026-79650: Apache CXF: OIDC RP Open Redirect - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:56:20 UTC, 0 replies.
- CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:57:13 UTC, 0 replies.
- CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 09:59:48 UTC, 0 replies.
- CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:02:25 UTC, 0 replies.
- CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:05:00 UTC, 0 replies.
- CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:06:03 UTC, 0 replies.
- CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:06:42 UTC, 0 replies.
- CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/10/09 10:10:49 UTC, 0 replies.
- CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/09 11:40:37 UTC, 0 replies.
- CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/09 11:41:37 UTC, 0 replies.
- CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch - posted by Lee Rhodes <le...@apache.org> on 2026/10/09 22:15:43 UTC, 0 replies.
- CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch - posted by Lee Rhodes <le...@apache.org> on 2026/10/09 22:16:46 UTC, 0 replies.
- CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch - posted by Lee Rhodes <le...@apache.org> on 2026/10/09 22:17:30 UTC, 0 replies.
- CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch - posted by Lee Rhodes <le...@apache.org> on 2026/10/09 22:18:43 UTC, 0 replies.
- CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch - posted by Lee Rhodes <le...@apache.org> on 2026/10/09 22:19:23 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Codec 1.23.0 - posted by Gary Gregory <gg...@apache.org> on 2026/10/11 16:17:02 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.18.5 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/10/11 18:55:25 UTC, 0 replies.
- [ANNOUNCE] Apache CouchDB 3.5.3 released - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/12 09:23:56 UTC, 1 replies.
- [ANN] Apache Tomcat 11.0.27 Available - posted by Mark Thomas <ma...@apache.org> on 2026/10/12 10:48:18 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.61 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/10/12 10:49:22 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.123 available - posted by Rémy Maucherat <re...@apache.org> on 2026/10/12 13:08:59 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Client 5.6.5 Released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/10/12 18:11:29 UTC, 0 replies.
- CVE-2026-92116: Apache Allura: OAuth1 missing callback validation - posted by Dave Brondsema <br...@apache.org> on 2026/10/12 19:03:02 UTC, 0 replies.
- CVE-2026-92119: Apache Allura: REST API Mass Assignment - posted by Dave Brondsema <br...@apache.org> on 2026/10/12 19:04:40 UTC, 0 replies.
- CVE-2026-92120: Apache Allura: Oauth1 Replay Attack - posted by Dave Brondsema <br...@apache.org> on 2026/10/12 19:05:43 UTC, 0 replies.
- Subject: [ANNOUNCE] Release Apache Paimon Rust 0.4.0 - posted by hope <ho...@apache.org> on 2026/10/13 11:28:02 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Helm Chart version 4.8.0 Released - posted by Lari Hotari <lh...@apache.org> on 2026/10/13 12:04:13 UTC, 0 replies.
- CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding - posted by Shuxin Pan <ps...@apache.org> on 2026/10/13 12:05:06 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-06 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/10/13 12:50:24 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 3.3.3 released - posted by Tim Allison <ta...@apache.org> on 2026/10/13 18:57:39 UTC, 0 replies.
- [ANNOUNCE] Apache SIS 1.7 Release - posted by Martin Desruisseaux <de...@apache.org> on 2026/10/13 22:51:53 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Core 5.5-beta4 released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/10/14 15:11:31 UTC, 0 replies.
- [ANNOUNCE] Apache SedonaDB 0.5.0 released - posted by Dewey Dunnington <pa...@apache.org> on 2026/10/15 01:30:55 UTC, 0 replies.
- [ANNOUNCE] Apache SeaTunnel 3.0.0 Released — A Major Milestone Release - posted by lidongdai <li...@apache.org> on 2026/10/15 11:18:06 UTC, 0 replies.
- [ANNOUNCE] Apache Pekko HTTP 1.4.2 released - posted by PJ Fanning <fa...@apache.org> on 2026/10/15 11:35:40 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.23.0 Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/10/15 15:14:05 UTC, 0 replies.
- CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default - posted by Jarek Potiuk <po...@apache.org> on 2026/10/15 21:07:03 UTC, 0 replies.
- CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default - posted by Jarek Potiuk <po...@apache.org> on 2026/10/15 21:08:04 UTC, 1 replies.
- CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token - posted by Jarek Potiuk <po...@apache.org> on 2026/10/15 21:08:30 UTC, 0 replies.
- CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read - posted by Jarek Potiuk <po...@apache.org> on 2026/10/15 21:12:30 UTC, 0 replies.
- CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure - posted by Li Yang <li...@apache.org> on 2026/10/16 02:24:10 UTC, 0 replies.
- CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump - posted by Li Yang <li...@apache.org> on 2026/10/16 02:27:53 UTC, 0 replies.
- CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization - posted by Li Yang <li...@apache.org> on 2026/10/16 02:29:20 UTC, 0 replies.
- CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints - posted by Li Yang <li...@apache.org> on 2026/10/16 02:33:15 UTC, 0 replies.
- CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass - posted by Li Yang <li...@apache.org> on 2026/10/16 02:34:34 UTC, 0 replies.
- CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env - posted by Li Yang <li...@apache.org> on 2026/10/16 02:37:29 UTC, 0 replies.
- CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup - posted by Li Yang <li...@apache.org> on 2026/10/16 02:39:59 UTC, 0 replies.
- CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard - posted by Li Yang <li...@apache.org> on 2026/10/16 02:42:38 UTC, 0 replies.
- CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation - posted by Li Yang <li...@apache.org> on 2026/10/16 02:43:17 UTC, 0 replies.
- CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController - posted by Li Yang <li...@apache.org> on 2026/10/16 02:45:32 UTC, 0 replies.
- CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) - posted by Li Yang <li...@apache.org> on 2026/10/16 02:46:03 UTC, 0 replies.
- CVE-2026-108743: Apache Kylin: spark job OS command injection - posted by Li Yang <li...@apache.org> on 2026/10/16 03:00:12 UTC, 0 replies.
- CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass - posted by Li Yang <li...@apache.org> on 2026/10/16 03:00:58 UTC, 0 replies.
- CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF - posted by Li Yang <li...@apache.org> on 2026/10/16 03:03:11 UTC, 0 replies.
- CVE-2026-108766: Apache Kylin: missing JDBC-config authorization - posted by Li Yang <li...@apache.org> on 2026/10/16 03:03:55 UTC, 0 replies.
- CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization - posted by Li Yang <li...@apache.org> on 2026/10/16 03:05:10 UTC, 0 replies.
- CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection - posted by Li Yang <li...@apache.org> on 2026/10/16 03:09:33 UTC, 0 replies.
- CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue - posted by Li Yang <li...@apache.org> on 2026/10/16 03:10:21 UTC, 0 replies.
- CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement - posted by Li Yang <li...@apache.org> on 2026/10/16 03:10:54 UTC, 0 replies.
- CVE-2026-108833: Apache Kylin: default startup profile miss security settings - posted by Li Yang <li...@apache.org> on 2026/10/16 03:11:38 UTC, 0 replies.
- CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion - posted by Li Yang <li...@apache.org> on 2026/10/16 03:12:18 UTC, 0 replies.
- CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:30:52 UTC, 0 replies.
- CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:31:32 UTC, 0 replies.
- CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:32:02 UTC, 0 replies.
- CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:33:18 UTC, 0 replies.
- CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:33:51 UTC, 0 replies.
- CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:34:36 UTC, 0 replies.
- CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:35:21 UTC, 0 replies.
- CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:35:48 UTC, 0 replies.
- CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:36:42 UTC, 0 replies.
- CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:37:21 UTC, 0 replies.
- CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:37:51 UTC, 0 replies.
- CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:38:38 UTC, 0 replies.
- CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content - posted by Enxin Xie <li...@apache.org> on 2026/10/16 03:39:03 UTC, 0 replies.
- CVE-2026-71569: Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:19:10 UTC, 0 replies.
- CVE-2026-78162: Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:19:38 UTC, 0 replies.
- CVE-2026-78163: Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:19:58 UTC, 0 replies.
- CVE-2026-78164: Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:20:28 UTC, 0 replies.
- CVE-2026-78165: Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:20:43 UTC, 0 replies.
- CVE-2026-79983: Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:21:02 UTC, 0 replies.
- CVE-2026-79984: Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:23:16 UTC, 0 replies.
- CVE-2026-79985: Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:23:30 UTC, 0 replies.
- CVE-2026-79986: Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:23:47 UTC, 0 replies.
- CVE-2026-80312: Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:24:14 UTC, 0 replies.
- CVE-2026-80343: Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:24:31 UTC, 0 replies.
- CVE-2026-80344: Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:24:49 UTC, 0 replies.
- CVE-2026-83531: Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:25:12 UTC, 0 replies.
- CVE-2026-84176: Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:25:33 UTC, 0 replies.
- CVE-2026-84178: Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:02 UTC, 0 replies.
- CVE-2026-84180: Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:15 UTC, 0 replies.
- CVE-2026-84181: Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:30 UTC, 0 replies.
- CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:29:56 UTC, 0 replies.
- CVE-2026-85245: Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:30:18 UTC, 0 replies.
- CVE-2026-85246: Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:32:04 UTC, 0 replies.
- CVE-2026-85247: Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:32:51 UTC, 0 replies.
- CVE-2026-85248: Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:33:03 UTC, 0 replies.
- CVE-2026-85249: Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:33:23 UTC, 0 replies.
- CVE-2026-85250: Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:33:43 UTC, 0 replies.
- CVE-2026-85251: Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:34:10 UTC, 0 replies.
- CVE-2026-85254: Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:34:30 UTC, 0 replies.
- CVE-2026-85257: Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:34:56 UTC, 0 replies.
- CVE-2026-85260: Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:35:26 UTC, 0 replies.
- CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:38:24 UTC, 0 replies.
- CVE-2026-85300: Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:38:40 UTC, 0 replies.
- CVE-2026-85301: Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:38:58 UTC, 0 replies.
- CVE-2026-85312: Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:39:12 UTC, 0 replies.
- CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:39:34 UTC, 0 replies.
- CVE-2026-85314: Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:39:49 UTC, 0 replies.
- CVE-2026-85315: Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:40:02 UTC, 0 replies.
- CVE-2026-85316: Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:40:27 UTC, 0 replies.
- CVE-2026-85317: Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:41:05 UTC, 0 replies.
- CVE-2026-88901: Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:41:21 UTC, 0 replies.
- CVE-2026-91858: Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/16 07:42:01 UTC, 0 replies.
- [ANNOUNCE] Apache Johnzon 1.3.1 - posted by Markus Jung <ju...@apache.org> on 2026/10/16 14:50:21 UTC, 0 replies.
- CVE-2026-71253: Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON - posted by Markus Jung <ju...@apache.org> on 2026/10/16 14:56:43 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-14 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/10/17 19:38:40 UTC, 0 replies.
- [ANNOUNCE] OpenDAL 0.59.5-rc.2 released - posted by xu...@apache.org on 2026/10/18 05:29:32 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow 26.0.0 released - posted by Raúl Cumplido <ra...@apache.org> on 2026/10/19 07:47:40 UTC, 0 replies.
- CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/19 10:53:24 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-17 are released - posted by Jarek Potiuk <po...@apache.org> on 2026/10/19 11:33:07 UTC, 0 replies.
- CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account - posted by Jarek Potiuk <po...@apache.org> on 2026/10/19 15:47:28 UTC, 0 replies.
- [ANNOUNCE] Apache Commons JEXL 3.7.1 - posted by Gary Gregory <gg...@apache.org> on 2026/10/19 19:21:20 UTC, 0 replies.
- CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation - posted by Adam Reeve <ar...@apache.org> on 2026/10/19 22:24:52 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit Oak 2.8.0 released - posted by Julian Reschke <re...@apache.org> on 2026/10/20 09:03:39 UTC, 0 replies.
- CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure - posted by Arnout Engelen <en...@apache.org> on 2026/10/20 09:54:56 UTC, 0 replies.
- CVE-2026-108087: Apache Cocoon: SQL Injection - posted by Arnout Engelen <en...@apache.org> on 2026/10/20 09:55:05 UTC, 0 replies.
- CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning - posted by Arnout Engelen <en...@apache.org> on 2026/10/20 09:55:10 UTC, 0 replies.
- CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces - posted by Arnout Engelen <en...@apache.org> on 2026/10/20 09:55:14 UTC, 0 replies.
- CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/20 12:27:29 UTC, 0 replies.
- CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/20 12:28:32 UTC, 0 replies.
- CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/20 12:29:37 UTC, 0 replies.
- CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/20 12:30:34 UTC, 0 replies.
- CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/20 12:31:40 UTC, 0 replies.
- CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs - posted by Jan Lehnardt <ja...@apache.org> on 2026/10/20 12:32:37 UTC, 0 replies.
- [SECURITY] CVE-2026-74048 Apache Tomcat - OpenSSL-FFM FIPS failure does not prevent start-up - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:09 UTC, 0 replies.
- [SECURITY] CVE-2026-74049 Apache Tomcat - Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:16 UTC, 0 replies.
- [SECURITY] CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:22 UTC, 0 replies.
- [SECURITY] CVE-2026-88041 Apache Tomcat - HTTP/2 trailer header cross-contamination - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:27 UTC, 0 replies.
- [SECURITY] CVE-2026-93446 Apache Tomcat - Possible TLS 1.3 connection failures - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:30 UTC, 0 replies.
- [SECURITY] CVE-2026-101296 Apache Tomcat - JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:35 UTC, 0 replies.
- [SECURITY] CVE-2026-101356 Apache Tomcat - HTTP/2 request/response mix-up after error during async processing - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:38 UTC, 0 replies.
- [SECURITY] CVE-2026-103119 Apache Tomcat - AJP response mix-up - posted by Mark Thomas <ma...@apache.org> on 2026/10/20 13:28:42 UTC, 0 replies.
- [ANNOUNCE] Apache Casbin SQLx Adapter (Incubating) 1.9.0 - posted by em...@apache.org on 2026/10/20 15:22:39 UTC, 0 replies.
- [ANNOUNCE] Apache BookKeeper 4.18.2 released - posted by Matteo Merli <mm...@apache.org> on 2026/10/20 21:01:27 UTC, 0 replies.
- Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 - posted by Weibing Wang <ww...@apache.org> on 2026/10/21 03:00:16 UTC, 0 replies.
- [ANNOUNCE] Apache Jackrabbit Oak 1.22.25 released - posted by Julian Reschke <re...@apache.org> on 2026/10/21 07:04:17 UTC, 0 replies.
- CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface - posted by Haonan Hou <ha...@apache.org> on 2026/10/21 10:38:44 UTC, 0 replies.
- CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver - posted by Haonan Hou <ha...@apache.org> on 2026/10/21 10:55:10 UTC, 0 replies.
- CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC - posted by Haonan Hou <ha...@apache.org> on 2026/10/21 11:07:48 UTC, 0 replies.
- CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation - posted by Haonan Hou <ha...@apache.org> on 2026/10/21 11:10:36 UTC, 0 replies.
- CVE-2026-105869: Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:46:48 UTC, 0 replies.
- CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:00 UTC, 0 replies.
- CVE-2026-105927: Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:13 UTC, 0 replies.
- CVE-2026-105930: Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:23 UTC, 0 replies.
- CVE-2026-105931: Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:33 UTC, 0 replies.
- CVE-2026-105932: Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:44 UTC, 0 replies.
- CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:52 UTC, 0 replies.
- CVE-2026-105934: Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:00 UTC, 0 replies.
- CVE-2026-105935: Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:09 UTC, 0 replies.
- CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:18 UTC, 0 replies.
- CVE-2026-105937: Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:26 UTC, 0 replies.
- CVE-2026-105938: Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:35 UTC, 0 replies.
- CVE-2026-105942: Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:43 UTC, 0 replies.
- CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:51 UTC, 0 replies.
- CVE-2026-105945: Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:59 UTC, 0 replies.
- [ANNOUNCE] Release Apache Paimon Terraform 0.1.0 - posted by Jiajia Li <pl...@apache.org> on 2026/10/22 10:00:01 UTC, 0 replies.
- CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing - posted by Piotr Karwasz <pk...@apache.org> on 2026/10/22 13:26:21 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.22.2 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/10/22 14:54:32 UTC, 0 replies.
- CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:27:49 UTC, 0 replies.
- CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:29:19 UTC, 0 replies.
- CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:32:12 UTC, 0 replies.
- CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:33:26 UTC, 0 replies.
- CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:36:09 UTC, 0 replies.
- CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:41:15 UTC, 0 replies.
- CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved - posted by Andrea Cosentino <ac...@apache.org> on 2026/10/23 07:42:06 UTC, 0 replies.
- [ANNOUNCE] Apache POI 6.0.0 release - posted by PJ Fanning <fa...@apache.org> on 2026/10/23 12:33:27 UTC, 0 replies.
- CVE-2026-115721: Apache Vysper: Unbounded allocation - posted by Thomas Wolf <tw...@apache.org> on 2026/10/23 13:14:04 UTC, 0 replies.
- CVE-2026-115748: Apache Vysper: Authorization bypass - posted by Thomas Wolf <tw...@apache.org> on 2026/10/23 13:14:25 UTC, 0 replies.