EUVD-2026-51178

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

CVE-2026-44617 Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

EUVD-2026-51162

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

CVE-2026-44617 Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped. This is an incomplete fix of...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

EUVD-2026-51160

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-44613

Apache Zeppelin exposes CSRF in REST and WebSocket request handling due to default CORS configuration that allows cross-origin state-changing requests and text/plain bodies. Affected versions are 0.6.0 through 0.12.0; upgrade to 0.12.1 to fix the issue. The CVE describes an attacker luring an aut...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available (RHBQ 3.33.2.SP3)

An update for Red Hat Build of Apache Camel 4.18.3 for Quarkus 3.33 update is now available RHBQ 3.33.2.SP3. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks

A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system's configured header list size...

org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers

A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or...

CLEANSTART-2026-WS59157 Security fixes in apache-hive 4.0.1-r2

Package apache-hive version 4.0.1-r2 fixes 8 vulnerabilities: CVE-2026-41417, CVE-2026-40490, CVE-2026-42583, CVE-2026-42579, CVE-2026-42586...

CLEANSTART-2026-PO05374 Security fixes in apache-hive 4.2.0-r2

Package apache-hive version 4.2.0-r2 fixes 3 vulnerabilities: CVE-2026-41417, CVE-2026-40490, ghsa-cmxv-58fp-fm3g...

CLEANSTART-2026-IS96483 Security fixes in apache-hive 4.0.0-r1

Package apache-hive version 4.0.0-r1 fixes 27 vulnerabilities: CVE-2024-47561, CVE-2024-7254, CVE-2024-47554, CVE-2022-41881, CVE-2023-34462...

CLEANSTART-2026-DV46415 Security fixes in apache-hive 4.0.1-r5

Package apache-hive version 4.0.1-r5 fixes 11 vulnerabilities: CVE-2025-41242, CVE-2025-48924, CVE-2026-22745, CVE-2026-40563, CVE-2026-41603...

CLEANSTART-2026-OE12787 Security fixes in apache-superset 6.0.0-r5

Package apache-superset version 6.0.0-r5 fixes 18 vulnerabilities: ghsa-pwv6-vv43-88gr, ghsa-whj4-6x5x-4v2j, ghsa-cfh3-3jmp-rvhc, ghsa-5xmw-vc9v-4wf2, ghsa-wjx4-4jcj-g98j...

CLEANSTART-2026-SP51719 Security fixes in apache-nifi 2.7.2-r7

Package apache-nifi version 2.7.2-r7 fixes 13 vulnerabilities: CVE-2024-29371, CVE-2025-14763, CVE-2025-67721, CVE-2026-22746, CVE-2026-22748...

CLEANSTART-2026-IF26545 Security fixes in apache-hive 4.0.1-r1

Package apache-hive version 4.0.1-r1 fixes 27 vulnerabilities: CVE-2024-47561, CVE-2024-7254, CVE-2024-47554, CVE-2022-41881, CVE-2023-34462...

CLEANSTART-2026-PX22838 Security fixes in apache-hive 4.2.0-r5

Package apache-hive version 4.2.0-r5 fixes 21 vulnerabilities: CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45416...

CLEANSTART-2026-DU27033 Security fixes in apache-superset 5.0.0-r8

Package apache-superset version 5.0.0-r8 fixes 6 vulnerabilities: ghsa-537c-gmf6-5ccf, CVE-2026-34180, ghsa-6v7p-g79w-8964, CVE-2026-57585, CVE-2026-44405...