Apache Answer 授权问题漏洞

Apache Answer is a community platform of the Apache Foundation in the United States. Versions of Apache Answer 2.0.0 and earlier contained security vulnerabilities. These vulnerabilities were due to improper restrictions on security token allocation, which could allow administrator accounts to be...

PT-2026-48459

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches...

PT-2026-48456

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.1 Description Improper Restriction of Security Token Assignment occurs when administrative tokens are not invalidated after an administrator account is suspended, deleted, or deactivated. This allows continu...

PT-2026-48576

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.07 Description Improper Control of Generation of Code allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks. This can lead to Remote...

PT-2026-48575

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.07 Description A privilege escalation issue in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges. This is achieved through an authorization bypass in the updateOrRemove...

Apache OFBiz 授权问题漏洞

Apache OFBiz is an ERP system developed by the Apache Foundation in the United States. This system provides a complete set of Java-based web application components and tools. Versions of Apache OFBiz prior to 24.09.07 had an authorization vulnerability; this vulnerability stemmed from an issue wi...

VMware Spring for Apache Kafka 代码问题漏洞

VMware Spring for Apache Kafka is a Kafka messaging integration framework developed by VMware, Inc. Versions of VMware Spring for Apache Kafka prior to 4.0.0, as well as versions 3.3.0 and earlier, 3.2.0 and earlier, 2.9.0 and earlier, and 2.8.0 and earlier, contain code vulnerabilities. These...

VMware Spring for Apache Kafka 输入验证错误漏洞

VMware Spring for Apache Kafka is a Kafka messaging integration framework developed by VMware, Inc. Versions of Spring for Apache Kafka such as 4.0.0 and earlier, 3.3.0 and earlier, 3.2.0 and earlier, 2.9.0 and earlier, and 2.8.0 and earlier have a input validation vulnerability. This vulnerabili...

RHEL 9 : mod_http2 (RHSA-2026:25057)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:25057 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: HTTP/2: Remote...

Apache OFBiz 代码注入漏洞

Apache OFBiz is an ERP system developed by the Apache Foundation in the United States. This system provides a complete set of Java-based web application components and tools. Versions of Apache OFBiz prior to 24.09.07 had a code injection vulnerability. This vulnerability stemmed from improper co...

Important: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 For more details about the security issues, including the impact, a CVSS scor...

PT-2026-48436

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config file name form field that is passed straight through to config mod.master slave upload and restart... as the destination path. The validati...

ALSA-2026:25090 Important: httpd:2.4 security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 For more details about the security issues, including the impact, a CVSS scor...

GHSA-5XRH-QMMQ-W6CH vulnerabilities

Vulnerabilities for packages: tez, pinot, pinot-fips, apache-hop, trino, hadoop-fips, celeborn, apache-hop-fips, management-api-for-apache-cassandra-4.1, thingsboard, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-5.0, seata...

CVE-2026-46340 vulnerabilities

Vulnerabilities for packages: tez, pinot, pinot-fips, apache-hop, trino, hadoop-fips, celeborn, apache-hop-fips, management-api-for-apache-cassandra-4.1, thingsboard, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-5.0, seata...

Unsafe Reflection

Apache Calcite is vulnerable to Unsafe Reflection. The vulnerability is due to the use of externally controlled input to select and instantiate classes at runtime, allowing attackers to influence reflection-based operations and potentially execute unintended code paths or load unauthorized classe...

CVE-2026-44893 vulnerabilities

Vulnerabilities for packages: hono, tinkerpop, apache-activemq-artemis, trino, apache-hop-fips, request-9047-keycloak-fips, management-api-for-apache-cassandra-4.0, apache-pulsar-fips, seata, pinot, apicurio-registry, hadoop-fips, keycloak, apache-pulsar, knative-kafka-broker, tez, apache-hop,...

CVE-2026-45673 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, s3proxy, elasticsearch-fips, kayenta-fips, hono, opensearch, tinkerpop, s3proxy-fips, spark-kubernetes-operator, strimzi-kafka-operator-fips, trino, wildfly, apache-hop-fips, request-9047-keycloak-fips, management-api-for-apache-cassandra-4.0,...

GHSA-676X-F7GG-47VC vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, s3proxy, elasticsearch-fips, kayenta-fips, hono, opensearch, tinkerpop, s3proxy-fips, spark-kubernetes-operator, strimzi-kafka-operator-fips, trino, wildfly, apache-hop-fips, request-9047-keycloak-fips, management-api-for-apache-cassandra-4.0,...

GHSA-5PVG-856G-CP85 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, s3proxy, elasticsearch-fips, kayenta-fips, hono, opensearch, tinkerpop, s3proxy-fips, spark-kubernetes-operator, strimzi-kafka-operator-fips, trino, wildfly, apache-hop-fips, request-9047-keycloak-fips, management-api-for-apache-cassandra-4.0,...