CVE-2026-84716: Incorrect Privilege Assignment

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

CVE-2026-94251: Protection Mechanism Failure

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue...

PT-2026-97259

Name of the Vulnerable Software and Affected Versions Apache Sling Security Bundle versions prior to 1.3.2 Description The ReferrerFilter accepts evidence that is weaker than the origin, which may allow for security bypasses. Recommendations Upgrade to version 1.3.2...

PT-2026-97260

Name of the Vulnerable Software and Affected Versions Apache Sling Security Bundle versions prior to 1.3.12 Description The ContentDispositionFilter in the Apache Sling Security Bundle mediates only one address or API shape of a resource, which may lead to security bypasses. Recommendations Upgra...

PT-2026-97544

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description A flaw exists in the install-bundle endpoint. When a System Administrator downloads an install bundle for an execution or hop node, the controller signs an X.509 certificate usi...

CVE-2026-94243: Origin Validation Error

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue...

Malicious code in biundlet (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

BIT-NIFI-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

Malicious code in link-user-awk-bundle-throw (npm)

Source: amazon-inspector 13af1c15269c3456ca5cec6d14a4862505a34f1cf9fcfb6c89f3e739db65abe5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-54583 mport package bundle downloads allow unsafe destination filenames

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

Malicious code in kappa-lambda-bundle-omega-bad (npm)

Source: amazon-inspector 2b3516bb36d404921aab8ace5bf2b731d171a18c77988e5770e5d3d3db842d08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

PT-2026-95015

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains an issue where the create sample file function in libmport/bundle read install pkg.c fails to constrain absolute source and destination paths from the sample-fi...

PT-2026-95017

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description In the MidnightBSD Package Manager, directory assets handled as ASSET DIR or ASSET DIR OWNER MODE in the libmport/bundle read install pkg.c file utilize path-based mport mkdirp, ownership, and permissi...

PT-2026-95010

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains a flaw where the do actual install function in libmport/bundle read install pkg.c utilizes path-based lstat, chown, stat, and chmod operations during package...

org.apache.myfaces.core:myfaces-core-assembly (>=4.1.0, <=4.1.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=4.1.0, <=4.1.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.1.0, =4.1.0, =4.1.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3.1, <=2.3.11) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=2.3.1, <=2.3.11)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3.1, =2.3.1, =2.3.11 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=3.0.0, <=3.0.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=3.0.0, <=3.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =3.0.0, =3.0.0, =3.0.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=2.3-next-m1, <=2.3-next-m8) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-bundle MAVEN version =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

org.apache.myfaces.core:myfaces-core-assembly (>=4.0.0, <=4.0.3) potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-bundle (>=4.0.0, <=4.0.3)

org.apache.myfaces.core:myfaces-bundle MAVEN version =4.0.0, =4.0.0, =4.0.3 Source cves: CVE-2026-76646 Source advisory: MEND:CVE-2026-76646...

com.github.adminfaces:quarkus-omnifaces (>=1.1.0, <=1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (>=1.1.0, <=1.4.0) +15 more potentially affected by CVE-2026-76646 via org.apache.myfaces.core:myfaces-impl (>=2.3-next-m1, <=2.3-next-m8)

org.apache.myfaces.core:myfaces-impl MAVEN version =2.3-next-m1, =1.1.0, =1.1.0, =3.0.0, =3.0.0, =3.0.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.12.0, =2.3-next-m3, =2.3-next-m1, =2.3-next-m1, =2.3-next-m1, =2.3-next-m8 and more Source cves: CVE-2026-76646 Sou...