Apache ActiveMQ < 5.19.12 / 6.x < 6.3.3 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is prior to 5.19.12, or 6.x prior to 6.3.3. It is, therefore, affected by multiple vulnerabilities: - Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime...

Linux Distros Unpatched Vulnerability : CVE-2026-111822

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes ...

CVE-2026-111822

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

CVE-2026-111822

Apache ActiveMQ and Apache ActiveMQ Runtime Config are vulnerable to improper invalidation of cached authorizations . When the runtime configuration plugin removes a principal's write grant on a destination via a live ACL update, the system fails to invalidate the existing cache. This allows an a...

CVE-2026-111822 Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

EUVD-2026-116827

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

PT-2026-136919

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

CVE-2026-111822: Apache Software Foundation: Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config

Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to that destination,...

NPM: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

NPM: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients vulnerability discovered by ? in WordPress Npm nuxt-ollama versions = 1.2.26, 1.3.1...

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including apikey — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payload...

GHSA-FXG7-897C-57MP Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including apikey — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payload...

PT-2026-89210

Name of the Vulnerable Software and Affected Versions nuxt-ollama versions prior to 1.3.1 Description A design flaw in src/module.ts causes the module to unconditionally merge all options, including the api key, into the public runtime configuration runtimeConfig.public.ollama. Because Nuxt...

CVE-2026-43528

OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the sourceConfig and runtimeConfig alias fields, which were not properly redacted. An attacker can obtain sensitive...

PT-2026-37014

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.14 Description A redaction bypass exists that allows authenticated gateway clients with config read access to receive unredacted secrets. This occurs through the sourceConfig and runtimeConfig alias fields,...

EUVD-2018-7483

Malware in sbrugna...

Important: unbound

Issue Overview: A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Avaya Aura Orchestration Designer Runtime Config Component Cross-Site Request Forgery Vulnerability

Avaya Aura Orchestration Designer is a suite of full-featured graphical development environments from Avaya, Inc. It is used to develop applications that run on media processing servers, voice portals, and interactive response software platforms.Runtime Config is one of the runtime environment...

CVE-2018-15612 Orchestration Designer Runtime Config CSRF

A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...