CVE-2026-41842 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, kafbat-ui-fips, camunda-zeebe, apache-activemq, apache-activemq-fips, kafbat-ui...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, zipkin, camunda, kafbat-ui-fips, camunda-zeebe, keycloak-config-cli, apache-activemq, apache-camel-karavan-devmode, apache-activemq-fips, jenkins, kafbat-ui...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, zipkin, camunda, kafbat-ui-fips, camunda-zeebe, keycloak-config-cli, apache-activemq, apache-camel-karavan-devmode, apache-activemq-fips, jenkins, kafbat-ui...

GHSA-X23C-287F-QQV5 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, kafbat-ui-fips, camunda-zeebe, apache-activemq, apache-activemq-fips, kafbat-ui...

CVE-2026-41843 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, kafbat-ui-fips, camunda-zeebe, apache-activemq, apache-activemq-fips, kafbat-ui...

CVE-2026-41844 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, kafbat-ui-fips, camunda-zeebe, apache-activemq, apache-activemq-fips, kafbat-ui...

GHSA-72PG-X5F8-J25J vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, kafbat-ui-fips, camunda-zeebe, apache-activemq, apache-activemq-fips, kafbat-ui...

GHSA-MQ64-J8F9-9GCJ vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda, kafbat-ui-fips, camunda-zeebe, apache-activemq, apache-activemq-fips, kafbat-ui...

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the en...

EUVD-2026-51626

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

GHSA-HJCP-JMPX-G3QM Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

UBUNTU-CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF001 Vulnerability Details CVEID:CVE-2026-41602 DESCRIPTION: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. User...

EUVD-2026-51519

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

EUVD-2026-51518

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-62391 Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-55971

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...