EUVD-2026-46173

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the...

CVE-2026-64606

CVE-2026-64606 describes a deserialization of untrusted data issue in Apache Fory prior to 1.4.0, where Java lambda deserialization may bypass class-registration checks, affecting the lambda capture class. The vulnerability pattern is a risk to confidentiality, integrity, and availability (per th...

CVE-2026-64609

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64608

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

EUVD-2026-46172

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64609

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64609

CVE-2026-64609 affects Apache Fory (formerly Apache Fury). The issue is an out-of-bounds read via sun.misc.Unsafe when using the opt-in out-of-band zero-copy deserialization; readAlignedVarUint() may read beyond the underlying buffer. Affected range is 0.5.0 up to 1.3.x, with 1.4.0+ fixed. Versio...

CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64609 Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This iss...

CVE-2026-64608 Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

CVE-2026-64608

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

CLEANSTART-2026-RS65756 Security fixes for CVE-2018-10237, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2022-3171, CVE-2022-3509, CVE-2022-3510, CVE-2023-2976, CVE-2023-44981, CVE-2024-23454, CVE-2024-23944, CVE-2024-38827, CVE-2024-47554, CVE-2024-6763, CVE-2024-7254, CVE-2025-11143, CVE-2025-24970, CVE-2025-25193, CVE-2025-27821, CVE-2025-41249, CVE-2025-48734, CVE-2025-48924, CVE-2025-49128, CVE-2025-52999, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-59419, CVE-2025-67735, CVE-2025-68161, CVE-2025-8916, CVE-2026-0636, CVE-2026-2332, CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-40490, CVE-2026-41417, CVE-2026-42578, CVE-2026-42579, CVE-2026-42583, CVE-2026-42586, CVE-2026-43869, CVE-2026-44248, CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45205, CVE-2026-45300, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-46340, CVE-2026-47691, CVE-2026-5588, ghsa-2r2c-cx56-8933, ghsa-3244-j874-rhc2, ghsa-3qp7-7mw8-wx86, ghsa-45q3-82m4-75jr, ghsa-47qp-hqvx-6r3f, ghsa-5jmj-h7xm-6q6v, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-5xrh-qmmq-w6ch, ghsa-676x-f7gg-47vc, ghsa-6ghj-frrj-jjj3, ghsa-72hv-8253-57qq, ghsa-7pwc-h2j2-rjgj, ghsa-cc37-9q2j-3hfv, ghsa-cm33-6792-r9fm, ghsa-cmxv-58fp-fm3g, ghsa-fmxf-pm6p-7xgm, ghsa-hvcg-qmg6-jm4c, ghsa-jfg9-48mv-9qgx, ghsa-mj4r-2hfc-f8p6, ghsa-rgrr-p7gp-5xj7, ghsa-w573-9ffj-6ff9, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 4.2.0-r0, 4.2.0-r1, 4.2.0-r2, 4.2.0-r3, 4.2.0-r4, 4.2.0-r5, 4.2.0-r6, 4.2.0-r7

Multiple security vulnerabilities affect the apache-hive package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JU43269 Security fixes for CVE-2026-27205, CVE-2026-28684, CVE-2026-34180, CVE-2026-41205, CVE-2026-44307, CVE-2026-44405, CVE-2026-44431, CVE-2026-44432, CVE-2026-4539, CVE-2026-45409, CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-48526, CVE-2026-57585, CVE-2026-7246, ghsa-2h4p-vjrc-8xpq, ghsa-5239-wwwm-4pmq, ghsa-537c-gmf6-5ccf, ghsa-65pc-fj4g-8rjx, ghsa-68rp-wp8r-4726, ghsa-6v7p-g79w-8964, ghsa-mf9v-mfxr-j63j, ghsa-mf9w-mj56-hr94, ghsa-qccp-gfcp-xxvc, ghsa-v92g-xgxw-vvmm applied in versions: 5.0.0-r7, 5.0.0-r8

Multiple security vulnerabilities affect the apache-superset package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NM97614 Security fixes for CVE-2025-13151, CVE-2026-22695, CVE-2026-22801, CVE-2026-2332, CVE-2026-24515, CVE-2026-25210, CVE-2026-25646, ghsa-72hv-8253-57qq applied in versions: 3.7.2-r4, 3.7.2-r5, 3.7.2-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DH82894 Security fixes for CVE-2026-54512, CVE-2026-54513, ghsa-2r2c-cx56-8933, ghsa-47qp-hqvx-6r3f applied in versions: 3.8.6-r4

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NM00046 Security fixes for CVE-2026-54512, CVE-2026-54513, ghsa-2r2c-cx56-8933, ghsa-47qp-hqvx-6r3f applied in versions: 3.9.5-r4

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VW49041 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WT54034 Security fixes for CVE-2025-8671, CVE-2026-0636, CVE-2026-10532, CVE-2026-13006, CVE-2026-1605, CVE-2026-22732, CVE-2026-2332, CVE-2026-24281, CVE-2026-33870, CVE-2026-33871, CVE-2026-3505, CVE-2026-40983, CVE-2026-40984, CVE-2026-54399, CVE-2026-54428, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-5588, CVE-2026-9828, ghsa-355h-qmc2-wpwf, ghsa-3677-xxcr-wjqv, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-45q3-82m4-75jr, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cj8j-37rh-8475, ghsa-cm33-6792-r9fm, ghsa-cmm3-54f8-px4j, ghsa-cq4q-cv5g-r8q5, ghsa-cvc6-q2cp-2xhw, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-qqpg-mvqg-649v, ghsa-rwm7-x88c-3g2p, ghsa-v8h7-rr48-vmmv, ghsa-vxf7-qj7q-83fh, ghsa-w573-9ffj-6ff9, ghsa-wg6q-6289-32hp, ghsa-x2wq-9x2f-fhj7, ghsa-x44p-gvrj-pj2r, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78, ghsa-xxqh-mfjm-7mv9 applied in versions: 2.10.0-r1, 2.10.0-r2, 2.7.2-r0, 2.7.2-r2, 2.9.0-r0, 2.9.0-r1

Multiple security vulnerabilities affect the apache-nifi package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SH44648 Security fixes for CVE-2018-10237, CVE-2020-8908, CVE-2021-22569, CVE-2021-22570, CVE-2022-2047, CVE-2022-3171, CVE-2022-3509, CVE-2022-3510, CVE-2022-36364, CVE-2022-41881, CVE-2023-20861, CVE-2023-20863, CVE-2023-26048, CVE-2023-26049, CVE-2023-2976, CVE-2023-34462, CVE-2023-36479, CVE-2023-40167, CVE-2023-41900, CVE-2023-42503, CVE-2023-44981, CVE-2024-13009, CVE-2024-23454, CVE-2024-23944, CVE-2024-25710, CVE-2024-26308, CVE-2024-29131, CVE-2024-29133, CVE-2024-38808, CVE-2024-38820, CVE-2024-38827, CVE-2024-47554, CVE-2024-47561, CVE-2024-52046, CVE-2024-6763, CVE-2024-7254, CVE-2024-8184, CVE-2025-11143, CVE-2025-22233, CVE-2025-24970, CVE-2025-25193, CVE-2025-27821, CVE-2025-41242, CVE-2025-41249, CVE-2025-48734, CVE-2025-48924, CVE-2025-49128, CVE-2025-52999, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057, CVE-2025-59419, CVE-2025-67735, CVE-2025-68161, CVE-2025-8916, CVE-2026-0636, CVE-2026-22745, CVE-2026-2332, CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-40490, CVE-2026-40563, CVE-2026-41417, CVE-2026-41603, CVE-2026-42578, CVE-2026-42579, CVE-2026-42583, CVE-2026-42586, CVE-2026-43869, CVE-2026-44248, CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44893, CVE-2026-45300, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-46340, CVE-2026-47244, CVE-2026-47691, CVE-2026-50193, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-5588, ghsa-3244-j874-rhc2, ghsa-3qp7-7mw8-wx86, ghsa-58qw-p7qm-5rvh, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-5xrh-qmmq-w6ch, ghsa-676x-f7gg-47vc, ghsa-6ghj-frrj-jjj3, ghsa-72hv-8253-57qq, ghsa-cc37-9q2j-3hfv, ghsa-fmxf-pm6p-7xgm, ghsa-mj4r-2hfc-f8p6, ghsa-w573-9ffj-6ff9, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 4.0.1-r0, 4.0.1-r1, 4.0.1-r2, 4.0.1-r3, 4.0.1-r4, 4.0.1-r5

Multiple security vulnerabilities affect the apache-hive package. These issues are resolved in later releases. See references for individual vulnerability details...

Apache Solr <=8.3.1 - Remote Code Execution

Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable,...