USN-8571-1: Apache HTTP Server vulnerabilities

Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in modauthnsocache. A remote attacker could possibly use this issue to cause a denial of service. CVE-2026-33007 Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apach...

USN-8571-1 apache2 vulnerabilities

Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in modauthnsocache. A remote attacker could possibly use this issue to cause a denial of service. CVE-2026-33007 Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apach...

Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management

A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer...

[R3] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2 and 6.8.0: SC202607.1

R3 Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2 and 6.8.0: SC202607.1 Arnie Cabral Mon, 07/20/2026 - 13:01 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components apache, OpenSSL,...

Security Bulletin: Code injection, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to code injection, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-62183

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-62418

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-53421

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' REST and SQL capability to run Groovy scripts. This issue affects Apache...

CVE-2026-53405

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

CVE-2026-62418

CVE-2026-62418 describes a low-privileged authenticated SSRF vulnerability in Apache Syncope, exploitable via Connectors and Resources checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue, if exploited, can impact confidentiality...

EUVD-2026-45964

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

CVE-2026-62183

CVE-2026-62183 describes an Improper Privilege Management flaw in Apache Syncope. When the all-Java user workflow adapter or the Flowable user workflow adapter is used with a BPMN that does not require admin approval for self-registration or self-update requests, a REST call can let a user grant ...

EUVD-2026-45962

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-62183 Apache Syncope: User self-service privilege escalation

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-62183 Apache Syncope: User self-service privilege escalation

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...