Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access or information disclosure due to Jetty (CVE-2026-8384)

Summary Eclipse Jetty path traversal/path normalization vulnerability can allow crafted URIs containing semicolon path parameters and .. sequences to bypass path-based authorization checks in applications relying on Jetty's canonicalized paths. IBM Sterling Secure Proxy has addressed the applicab...

CLEANSTART-2026-AB17721 Security fixes in solr 10.0.0-r6

Package solr version 10.0.0-r6 fixes 4 vulnerabilities: CVE-2026-8384, CVE-2026-6790, CVE-2026-10051, CVE-2026-10050...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: confluent-kafka, dependency-track, akhq, trino, strimzi-kafka-operator, druid, neo4j, solr...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: confluent-kafka, dependency-track, apache-jena-fuseki, spark-kubernetes-operator-fips, spark-fips, traccar, trino, traccar-fips, kafka-fips, solr, apache-hop-fips, reposilite, spark, spark-kubernetes-operator, akhq, strimzi-kafka-operator, druid, kafka, wso2is,...

ai.agentscentral:agentj-jetty (>=0.0.4, <=0.0.6), app.cash.tempest:tempest-testing-jvm (>=1.4.0, <=2025.04.17.121601-f8f94b6) +2353 more potentially affected by CVE-2026-8384 via org.eclipse.jetty:jetty-util (>=12.0.0, <=12.0.34)

org.eclipse.jetty:jetty-util MAVEN version =12.0.0, =0.0.4, =1.4.0, =1.4.0, =7.0.0, =4.2.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-8384 Source advisory: GHSA-W7X5-G22V-XQHR...

CVE-2026-8384

creationtimestamp| type| source ---|---|--- 2026-07-14 11:58:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqm5q2hfk72w 2026-07-20 05:39:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr2ldikcy42i 2026-07-20 05:44:37+00:00| seen|...

DEBIAN-CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +1973 more potentially affected by CVE-2026-8384 via org.eclipse.jetty:jetty-util (>=12.1.0, <=12.1.8)

org.eclipse.jetty:jetty-util MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.1 and more Source cves: CVE-2026-8384 Source advisory: MEND:CVE-2026-8384...

ECHO-0C9C-8384-9544

Bulletin has no description...

MiracleLinux 9 : thunderbird-128.2.0-1.el9_4.ML.1 (AXSA:2024-8860:21)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8860:21 advisory. thunderbird: 115.15/128.2 mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces...

MiracleLinux 8 : firefox-128.2.0-1.el8_10.ML.1 (AXSA:2024-8869:31)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8869:31 advisory. firefox: 115.15/128.2 ESR mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces...

MAL-2025-8384 Malicious code in @leaffm/leaf-connect-elle-sera (npm)

The package @leaffm/leaf-connect-elle-sera was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2024-8384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could hav...

Mageia: Security Advisory (MGASA-2024-0334)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:3507-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : thunderbird (ALAS-2024-2638)

The version of thunderbird installed on the remote host is prior to 115.15.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2638 advisory. An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion,...

Important: thunderbird

Issue Overview: An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2024:3507-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3507-1 advisory. - Mozilla Thunderbird 128.2.3 MFSA 2024-43 bsc1229821 CVE-2024-8394: Crash when aborting...

SUSE-SU-2024:3507-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 128.2.3 MFSA 2024-43 bsc1229821 CVE-2024-8394: Crash when aborting verification of OTR chat. CVE-2024-8385: WASM type confusion involving ArrayTypes. CVE-2024-8381: Type confusion when looking up a property name ...