CVE-2025-26795 Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver

Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This issue affects iotdb-jdbc: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 2.0.2 and...

CVE-2025-26795

CVE-2025-26795 affects Apache IoTDB JDBC driver (iotdb-jdbc) versions 0.10.0–1.3.3 and 2.0.1-beta before 2.0.2. Root cause: insertion of sensitive information into log files, leading to exposure to unauthorized actors. Impact is High confidentiality (C:H, I/N/A:N). Affected component is iotdb-jdb...

CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes...

PT-2025-21136 · Apache · Iotdb-Jdbc

Name of the Vulnerable Software and Affected Versions: iotdb-jdbc versions 0.10.0 through 1.3.3 iotdb-jdbc versions 2.0.1-beta through 2.0.2 Description: The issue is related to the exposure of sensitive information to an unauthorized actor and the insertion of sensitive information into log file...

Alibaba Cloud Linux 3 : 0017: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0017)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0017 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-4696: There exists a use-after-free...

PT-2025-25564

Name of the Vulnerable Software and Affected Versions Protobuf versions prior to 6.31.1 Description The issue affects projects that use the Protobuf Pure-Python backend to parse untrusted Protocol Buffers data. This data can contain an arbitrary number of recursive groups, recursive messages, or ...

PT-2025-21137 · Apache · Apache Iotdb

Name of the Vulnerable Software and Affected Versions: Apache IoTDB versions 0.10.0 through 1.3.3 Apache IoTDB versions 2.0.1-beta through 2.0.2 Description: The issue is related to the exposure of sensitive information to an unauthorized actor and the insertion of sensitive information into log...

CVE-2025-27696 Apache Superset: Incorrect authorization leading to resource ownership takeover

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue...

CVE-2025-27696

The CVE-2025-27696 entry concerns Apache Superset up to version 4.1.1, where an Incorrect Authorization vulnerability lets authenticated users with read permissions take ownership of dashboards, charts, or datasets. A fix is available in 4.1.2 and later. The public details consistently describe t...

CVE-2025-27696 Apache Superset: Incorrect authorization leading to resource ownership takeover

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue...

CVE-2025-27696 Apache Superset: Incorrect authorization leading to resource ownership takeover

Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue...

PT-2025-20825 · Openssl +2 · Openssl +2

Name of the Vulnerable Software and Affected Versions: Actualizer versions prior to 1.2.0 Description: The issue concerns the use of OpenSSL's -passwd function, which utilizes SHA512 for password hashing, a less suitable algorithm. All Actualizer users building a full Debian Operating System are...

PT-2025-21026 · Apache · Apache Orc

Name of the Vulnerable Software and Affected Versions: Apache ORC versions 1.8.0 through 1.8.8 Apache ORC versions 1.9.0 through 1.9.5 Apache ORC versions 2.0.0 through 2.0.4 Apache ORC versions 2.1.0 through 2.1.1 Description: A Heap-based Buffer Overflow vulnerability has been identified in the...

PT-2025-20689

Name of the Vulnerable Software and Affected Versions open-vm-tools versions prior to 13.0.5-alt1 open-vm-tools versions 12.5.2 Description The Open Virtual Machine Tools contain an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper...

Apache Commons Configuration Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuratio...

OESA-2025-1484 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Input Validation...

CVE-2025-46392

Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons Configuratio...

CVE-2025-27533 Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service DoS by depleting process memor...

CVE-2025-27533

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service DoS by depleting process memor...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in axios

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of axios Vulnerability Details CVEID:CVE-2024-57965 DESCRIPTION: In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute'href',hr...