Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the /skin/ action endpoint when running on Jetty 12 or later. An attacker can access arbitrary files on the server by crafting a URL containing encoded directory traversal sequences. This is only exploitable if th...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17879243...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: GHSA-MRRP-9GJM-749V...

org.apache.camel.kafkaconnector:camel-cxfrs-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:itests-cxf (>=4.0.0, <=4.14.5) +7 more potentially affected by CVE-2026-46592 via org.apache.camel:camel-cxf-rest (>=4.0.0, <=4.14.7)

org.apache.camel:camel-cxf-rest MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.7.0, =4.7.0, =4.7.0, =4.10.7, =4.0.0, =4.0.0, =4.14.7 Source cves: CVE-2026-46592 Source advisory: OSV:GHSA-MRRP-9GJM-749V...

PT-2026-56212

Name of the Vulnerable Software and Affected Versions xWiki versions prior to 17.10.5 xWiki versions prior to 18.2.0 Description When used with Jetty 12+, a user can craft a URL to access any resource the Jetty instance is permitted to access. This allows for the unauthorized download of sensitiv...

Apache ActiveMQ authorization issue vulnerability (CNVD-2026-28240)

Apache ActiveMQ is a message queue middleware product developed by the Apache Foundation. There is an authorization issue in Apache ActiveMQ; this vulnerability stems from improper authorization practices. As a result, low-privilege Web Console users who are authenticated may have access to the...

AlmaLinux 9 : jmc (ALSA-2026:20568)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:20568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling vi...

DEBIAN-CVE-2026-49877

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from...

CVE-2026-49877

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from...

CVE-2026-49877

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from...

CVE-2026-49877

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from...

CVE-2026-49877: Improper Authorization

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from...

CVE-2026-49877

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/ paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from...

PT-2026-53840

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Description An improper authorization issue exists where an authenticated user with low privileges can access the /admin/ endpoints in the Web Console. This...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and ifix. Vulnerability Details CVEID:CVE-2026-1605 DESCRIPTION: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP...

org.apache.nifi:nifi-framework-nar (>=1.12.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.12.0, <=1.15.3) +3 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-web-api (>=1.12.0, <=2.8.0)

org.apache.nifi:nifi-web-api MAVEN version =1.12.0, =1.12.0, =1.12.0, =1.13.0, =1.12.0, =1.12.0, =2.8.0 Source cves: CVE-2026-44914 Source advisory: OSV:GHSA-R2G5-993Q-664G...

org.apache.nifi:nifi-framework-nar (>=1.12.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.12.0, <=1.15.3) +3 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-web-api (>=1.12.0, <=2.8.0)

org.apache.nifi:nifi-web-api MAVEN version =1.12.0, =1.12.0, =1.12.0, =1.13.0, =1.12.0, =1.12.0, =2.8.0 Source cves: CVE-2026-44914 Source advisory: GHSA-R2G5-993Q-664G...

org.apache.nifi:nifi-framework-nar (1.11.2), org.apache.nifi:nifi-system-test-suite (1.11.2) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.11.2)

org.apache.nifi:nifi-jetty MAVEN version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.11.2 - org.apache.nifi:nifi-system-test-suite 1.11.2 Source cves:...

org.apache.nifi:nifi-framework-nar (1.12.0), org.apache.nifi:nifi-system-test-suite (1.12.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.12.0)

org.apache.nifi:nifi-jetty MAVEN version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-framework-nar 1.12.0 - org.apache.nifi:nifi-system-test-suite 1.12.0 Source cves:...

org.apache.nifi:nifi-server-nar (1.13.0), org.apache.nifi:nifi-system-test-suite (1.13.0) potentially affected by CVE-2026-54665 via org.apache.nifi:nifi-jetty (1.13.0)

org.apache.nifi:nifi-jetty MAVEN version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-jetty and may be impacted: - org.apache.nifi:nifi-server-nar 1.13.0 - org.apache.nifi:nifi-system-test-suite 1.13.0 Source cves:...