63683 matches found
CLEANSTART-2026-TX47991 Security fixes for CVE-2025-13151, CVE-2026-22695, CVE-2026-22801, CVE-2026-24515, CVE-2026-25210, CVE-2026-25646, CVE-2026-42583, ghsa-72hv-8253-57qq, ghsa-mj4r-2hfc-f8p6, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r5, 3.9.4-r6, 3.9.5-r0, 3.9.5-r1
Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...
Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
A flaw was found in Apache Tomcat. This vulnerability, categorized as Missing Encryption of Sensitive Data, arises from a bypass in the EncryptInterceptor, a component designed to ensure data encryption. This bypass, introduced as a fix for CVE-2026-29146, allows sensitive data to remain...
The vulnerability of the mod_proxy_ftp module in the Apache HTTP Server allows attackers to perform cross-site scripting attacks.
The vulnerability of the modproxyftp module in the Apache HTTP Server is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
PT-2026-57821
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.7.2 Description In the Apache Airflow FAB auth manager, a privilege escalation occurs when a DAG is created with a dag id of DAGs. This specific ID collides with the global all-DAGs permission...
PT-2026-57679
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Apache HTTP Server Path Traversal Contribut...
RCE (Remote Code Execution) at Apache ActiveMQ dependency in Bamboo Data Center
This High severity RCE Remote Code Execution vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...
RCE (Remote Code Execution) at Apache ActiveMQ dependency in Bamboo Data Center
This High severity RCE Remote Code Execution vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N...
Sonicwall - Pre-Authentication Arbitrary File Read
Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...
CVE-2026-49270 vulnerabilities
Vulnerabilities for packages: geoserver, apache-tomee...
GHSA-HF52-78X8-6W3W vulnerabilities
Vulnerabilities for packages: geoserver, apache-tomee...
GHSA-HG6C-8MVR-JQC9 vulnerabilities
Vulnerabilities for packages: geoserver, apache-tomee...
GHSA-V853-W46P-FV2H vulnerabilities
Vulnerabilities for packages: geoserver, apache-tomee...
CVE-2026-42588 vulnerabilities
Vulnerabilities for packages: geoserver, apache-tomee...
CVE-2026-45505 vulnerabilities
Vulnerabilities for packages: geoserver, apache-tomee...
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve
A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...
CVE-2026-40009
Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to internalauditor. This issue affects Apache IoTDB: from 2.0.8 before 2.0.10. Users are recommended to upgrade to version 2.0.10,...
CVE-2026-40008
Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName.newInstance without any validation or allowlisting. This issue affects Apache IoTDB:...
CVE-2026-40452
Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to...