You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@security.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/10/02 13:44:40 UTC

[PR] CVE updates from 2026-10-01 through 2026-10-02 [security-site]

ppkarwasz opened a new pull request, #111:
URL: https://github.com/apache/security-site/pull/111

   Regenerates the project pages with the latest public CVE data from cveprocess.apache.org, with no metadata changes.
   
   New advisories published in this period, by PMC:
   
   **Apache Directory**
   - CVE-2026-102731
   - CVE-2026-103552
   - CVE-2026-103877
   - CVE-2026-103878
   - CVE-2026-103880
   - CVE-2026-103885
   
   **Apache Thrift**
   - CVE-2026-61373
   - CVE-2026-61374
   - CVE-2026-63772
   - CVE-2026-66054
   - CVE-2026-66055
   - CVE-2026-66081
   - CVE-2026-66331
   - CVE-2026-66837
   - CVE-2026-66858
   - CVE-2026-66859
   - CVE-2026-82458
   - CVE-2026-82459
   - CVE-2026-83632
   - CVE-2026-83663
   - CVE-2026-83745
   - CVE-2026-85086
   - CVE-2026-85087
   - CVE-2026-85088
   - CVE-2026-85476
   - CVE-2026-85483
   - CVE-2026-85493
   - CVE-2026-85494
   - CVE-2026-86535
   - CVE-2026-86536
   - CVE-2026-86537
   - CVE-2026-87117
   - CVE-2026-90440
   - CVE-2026-91135
   - CVE-2026-91137
   - CVE-2026-92834
   - CVE-2026-93925
   - CVE-2026-93926
   - CVE-2026-94633
   - CVE-2026-94634
   - CVE-2026-94635
   - CVE-2026-94636
   - CVE-2026-94637
   - CVE-2026-94638
   - CVE-2026-94639
   - CVE-2026-94642
   - CVE-2026-94644
   - CVE-2026-94645
   - CVE-2026-94646
   - CVE-2026-94648
   - CVE-2026-94650
   - CVE-2026-94651
   - CVE-2026-94652
   - CVE-2026-94653
   - CVE-2026-94654
   - CVE-2026-94655
   - CVE-2026-94656
   - CVE-2026-94657
   - CVE-2026-94658
   - CVE-2026-96277
   - CVE-2026-96286
   - CVE-2026-96287
   - CVE-2026-96288
   - CVE-2026-96289
   - CVE-2026-96292
   - CVE-2026-96294
   - CVE-2026-96990
   
   ## Edits to already published records
   
   The generator caches each record on first fetch and never refetched it, so edits made on cveprocess after a record was first published only ever showed up as a changed "last updated" line (the "timestamp bumps only" lists in #101, #105 and #110 were not verified against the live records). For this run every cached record whose index timestamp was newer than the cached copy was refetched. The edits that surface as a result, by PMC:
   
   - **Apache Traffic Server** (31 records): the 8.x affected range now ends at 8.1.11 instead of 8.1.9, in both the structured affected list and the description. CVE-2026-33930, CVE-2026-57834, CVE-2026-58150, CVE-2026-58151, CVE-2026-58152, CVE-2026-58154, CVE-2026-58155, CVE-2026-58156, CVE-2026-58157, CVE-2026-58158, CVE-2026-58159, CVE-2026-58160, CVE-2026-58161, CVE-2026-58162, CVE-2026-58163, CVE-2026-58164, CVE-2026-58175, CVE-2026-58178, CVE-2026-58179, CVE-2026-58180, CVE-2026-58181, CVE-2026-58182, CVE-2026-58183, CVE-2026-58184, CVE-2026-58185, CVE-2026-58186, CVE-2026-58187, CVE-2026-58188, CVE-2026-58189, CVE-2026-65100, CVE-2026-65324.
   - **Apache Tomcat**: version typo fixes in CVE-2026-68569 (7.0.109), CVE-2026-73581 (8.5.100) and CVE-2026-77762 (8.5.59). CVE-2026-76183 now marks one version range as explicitly unaffected; the OSV converter does not support that construct, so the page drops the OSV link for it and the stale OSV file is removed.
   - **Apache Airflow** (27 records): package coordinates moved from collection URL and package name to a purl, reference tags swapped between the vendor advisory and the related CVE, credits reordered or added (CVE-2026-58065, CVE-2026-68968), and a retitled CVE-2026-41016. CVE-2026-48828, CVE-2026-48891, CVE-2026-48892, CVE-2026-49296, CVE-2026-49486, CVE-2026-49487, CVE-2026-54183, CVE-2026-58076, CVE-2026-59242, CVE-2026-59243, CVE-2026-59244, CVE-2026-59245, CVE-2026-65017, CVE-2026-67260, CVE-2026-67587, CVE-2026-68076, CVE-2026-68868, CVE-2026-68870, CVE-2026-68871, CVE-2026-68872, CVE-2026-68969, CVE-2026-68970, CVE-2026-68971, CVE-2026-75156.
   - **Apache Lucy**: CVE-2026-61483, CVE-2026-61484 and CVE-2026-61486 now say "before 0.8.0" instead of "all versions" and point at the lucysearch fork that fixed them.
   - **Apache CXF**: CVE-2026-50645 gains the 3.6.x range (before 3.6.12) next to 4.0.0 before 4.1.7.
   - **Apache Zeppelin**: CVE-2026-44616 fixed version moved from 0.12.1 to 0.12.2, with the patch PR added as a reference.
   - **Apache Ranger**: CVE-2025-59060 title and description narrowed to NiFiRegistryClient.
   - **Apache Tika**: CVE-2026-66755 credit corrected and version type changed to maven.
   - **Apache HttpComponents**: CVE-2026-64607 credit updated.
   - **Apache DolphinScheduler**: credits added on CVE-2026-32967 and CVE-2026-49050.
   - **Apache Fineract**: credit added on CVE-2026-35152.
   - **Apache Thrift**: finder credit added on CVE-2026-41608, CVE-2026-43869 and CVE-2026-43870.
   - **Apache ActiveMQ Artemis**: CVE-2026-75880 purl group id corrected.
   - **Apache PDFBox**: CVE-2026-23907 and CVE-2026-33929 package coordinates moved to purl and CPE.
   - **Apache Axis**: CVE-2026-66713 description reformatted from pasted rich text to plain paragraphs.
   - Metadata-only or wording changes with no visible effect on the pages: Apache APR CVE-2023-49582, Apache Logging CVE-2025-68161 and CVE-2026-34481, Apache NiFi CVE-2026-68979 and CVE-2026-68981, Apache Shiro CVE-2026-23903, Apache Submarine CVE-2024-36265.
   
   Updated records (verified timestamp bumps only, record content unchanged after refetch):
   
   - Apache HTTP Server: CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768, CVE-2026-93546
   
   No project gets a new advisory page with this run.
   
   Follows the CVE regeneration in #110.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@security.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CVE updates from 2026-10-01 through 2026-10-02 [security-site]

Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.

ppkarwasz merged PR #111:
URL: https://github.com/apache/security-site/pull/111


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@security.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org