PT-2026-64282

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions prior to 1.10.0 Description A reachable assertion issue exists in the ATT parser. A specially crafted ATT Read Multiple Variable Response BLE ATT OP READ MULT VAR RSP can trigger an assert, provided the Device Under Test...

PT-2026-64280

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions prior to 1.10.0 Description An incorrect calculation of buffer size occurs when processing Legacy Advertising Report HCI events. When a single HCI advertising report event bundles multiple reports, the software...

PT-2026-64289

Name of the Vulnerable Software and Affected Versions Apache Neethi versions 3.2.2 through 3.2.2 Description Certain crafted policies can bypass the maximum number of normalized policy alternatives, potentially leading to a denial of service attack through excessive resource consumption...

PT-2026-64288

Name of the Vulnerable Software and Affected Versions Apache Neethi versions prior to 3.2.3 Description Uncontrolled recursion occurs when parsing policies that lack policy Ids or contain deeply nested structures. This can lead to a denial of service attack resulting from runtime memory exhaustio...

PT-2026-64312

Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetchpossible multiple times, close. The open step will return an id which will be passed back to server for identifying the scanner instances stored ...

EUVD-2026-40847

c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets...

SUSE-SU-2026:3225-1 Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni

This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: - CVE-2026-26032: improper pathname limitation in PackagerResolver allows for arbitrary files writes outside of the configured buildRoot directory bsc1271727. Other updates...

Updated apache packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...

Security Bulletin: Apache Lucene PRISMA-2021-0081 X-Force 216835 security vulnerability

Summary Apache Lucene PRISMA-2021-0081 X-Force 216835 security vulnerability in FileNet Content Manager FNCM / IBM Content CortexCCx Content Search Services CSS/Enterprise Content Management Text Search ECMTS. CSS/ECMTS is affected and is potentially vulnerable. Vulnerability Details Refer to the...

Security Bulletin: Apache uimaj-core.jar security vulnerability CVE-2022-32287 and CVE-2023-39913 in FileNet Content Manager (FNCM) / IBM Content Cortex(CCx) component Content Search Services (CSS) / Enterprise Content Management Text Search (ECMTS)

Summary Apache uimaj-core.jar security vulnerability CVE-2022-32287 and CVE-2023-39913 in FileNet Content Manager FNCM / IBM Content CortexCCx component Content Search Services CSS / Enterprise Content Management Text Search ECMTS Vulnerability Details Refer to the security bulletins listed in th...

USN-8322-2: Apache Commons BeanUtils regression

USN-8322-1 fixed a vulnerability in Apache Commons BeanUtils. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2014-0114 and CVE-2019-10086 was incorrectly dropped. This update reintroduces the fix for CVE-2014-0114 and CVE-2019-10086. We...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache HTTP Server Exploit This repository con...

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

Apache OFBiz - Improper Authorization & Remote Code Execution

Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

Oracle Primavera Unifier (July 2026 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Integration Lodash. Supported versions that are...

Oracle HTTP Server (July 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware component: WebLogic Server Proxy Plug-In for Third-Party W...

apache-sshd-2.19.0-2.1 on GA media (moderate)

apache-sshd-2.19.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:11327-1 Rating: moderate Cross-References: CVE-2026-56452 CVE-2026-56623 CVE-2026-56624 CVE-2026-58624 CVSS scores: CVE-2026-56452 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-56623 SUSE : 7.1...

thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...

USN-8589-1: Apache HTTP Server vulnerabilities

It was discovered that Apache HTTP Server's modldap module incorrectly handled memory when processing per-directory configurations. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-29167 It was discovered that Apache HTTP Server's...