GHSA-9VJP-V76F-G363 vulnerabilities

Vulnerabilities for packages: druid...

PT-2026-79042

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

PT-2026-79043

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

PT-2026-79052

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An authenticated user, regardless of whether they possess an administrative role, can trigger the InLong Manager server to initiate outbound HTTP requests or TCP connections to arbitrary...

PT-2026-79199

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

PT-2026-79045

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

PT-2026-79041

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

PT-2026-79040

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

PT-2026-79044

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

PT-2026-79051

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...

PT-2026-79046

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

GHSA-RXJR-6C9Q-H67X

creationtimestamp| type| source ---|---|--- 2026-08-19 21:16:30+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mthnpgazgt2v...

CVE-2026-46453

A flaw was found in the camel-elasticsearch-rest-client component of Apache Camel. An untrusted HTTP client can exploit this vulnerability by sending specific, unprefixed Exchange headers directly on its request when a Camel route exposes an HTTP entry point. This improper input validation allows...

CVE-2026-42527

A flaw was found in Apache Camel. This deserialization of untrusted data vulnerability allows a remote attacker to trigger out-of-band DNS queries to an attacker-controlled host. By sending a specially crafted Java-serialized payload to an affected Camel consumer, the system's Java Virtual Machin...

CVE-2024-41909 vulnerabilities

Vulnerabilities for packages: hadoop-fips...

CVE-2026-48203

A flaw was found in the Apache Camel Solr component. A remote unauthenticated attacker can inject Solr query parameters and document fields into requests by utilizing specific header prefixes SolrParam. and SolrField. that bypass the HTTP header filter. This improper input validation allows for...

CVE-2026-49099

A flaw was found in Apache Camel Salesforce. Due to improper neutralization of special elements, non-Camel-prefixed HTTP headers are not filtered, allowing them to pass from an inbound HTTP request. A remote, unauthenticated attacker can exploit this by injecting malicious headers to override...

CVE-2026-46456

A flaw was found in Apache Camel AWS2-SQS Component. This vulnerability allows a remote attacker, with permissions to send messages to a consumed SQS queue, to inject arbitrary Camel control headers into the message exchange. This is due to a missing inbound header filter strategy. The injected...

CVE-2026-46457

A flaw was found in Apache Camel NATS component. Due to improper input validation, a client capable of publishing to a NATS subject can inject arbitrary Camel control headers into the Camel Exchange. These injected headers can then influence the behavior of downstream producers in the route,...

Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

Summary The default .htaccess shipped with Grav and the reference webserver-configs/htaccess.txt contains security rules that block direct HTTP access to sensitive file types .yaml, .yml, .php, .json, .twig, etc. under user/ and system/vendor/ directories. However, these rules lack the NC No Case...