CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791459292)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791459292 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...

UBUNTU-CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

PT-2026-107866

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

PT-2026-107810

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during...

PT-2026-107865

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

Apache Struts Command Injection Vulnerability

Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled...

Apache Avatica 1.29.0 JDBC Connection Property Injection

Apache Calcite Avatica versions 1.29.0 and 1.28.0 copy unauthenticated client-supplied JDBC connection properties into backend connections. The included proof of concept injects properties that may enable local file disclosure or deserialization under specific backend conditions. !/usr/bin/env...

Apache OzHera 2.2.6 Authenticated SQL Injection

Summary Apache OzHeraIncubating is an Application Performance Monitoring APM platform designed for the cloud-native era. It revolves around applications and integrates capabilities such as metric monitoring, distributed tracing, logging, and alerting. The platform's mission is to enhance the onli...

UBUNTU-CVE-2026-92415

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

ALSA-2026:79177 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791458607)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791458607 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-66142 DESCRIPTION: Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may...

CVE-2026-103371

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.4.1 version. Hence, IBM strongly recommends upgrading to 1.4.1...

Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System

Summary Multiple vulnerabilities affect IBM Cloud Pak System. These vulnerabilties have been addressed with IBM Cloud Pak System 2.3.5.1. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...

CVE-2026-103371 Apache Geode: Management REST API: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

EUVD-2026-94553

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

CVE-2026-103371

Apache Geode versions 2.0.0 through 2.0.3 are affected by a vulnerability where the Management REST API improperly inserts sensitive information into log files. This issue, identified as CWE-532 , could lead to the exposure of confidential data through system logs. To mitigate this risk, users ar...