CVE-2026-105111

The Apache Commons BCEL library is vulnerable to a stored cross-site scripting (XSS) flaw in versions before 6.13.0 . The issue occurs when using the Class2HTML component to generate webpages from potentially attacker-controlled class files. Specifically, the Class2HTML emitters fail to properly ...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

EUVD-2026-93972

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

CVE-2026-94114

Apache Commons BCEL versions before 6.13.0 are vulnerable to a symbolic name mapping issue. The BCEL component caches attacker-controlled classes using self-declared names without sufficient validation. This flaw allows subsequent lookups and name-keyed verification results to point to different ...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

EUVD-2026-93970

Symbolic name not mapping to correct object vulnerability in Apache Commons. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

CVE-2026-94114

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

Exploit for Missing Authentication for Critical Function in Apache Artemis

CVE-2026-57967 — Apache ActiveMQ Artemis Unauthenticated Sessi...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in zstd-jni, snappy-java, and Apache Parquet. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-90559 DESCRIPTION: snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in...

CVE-2026-102795

A flaw was found in Apache Traffic Server. Due to improper access controls, an unauthenticated remote attacker can bypass intended access restrictions. This vulnerability may allow an attacker to modify sensitive data or gain unauthorized access to protected resources. Mitigation Mitigation for...

K000163569: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-75973 Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to...

RLSA-2026:75581 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for...

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is...

BIT-APACHE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...