CVE-2026-41280 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...

CVE-2026-41280

CVE-2026-41280 affects Apache DolphinScheduler prior to 3.4.2. The issue is an Incorrect Authorization vulnerability where users with system login privileges can delete task definitions in unauthorized projects due to insufficient access controls. The documented impact is deletion of task definit...

CVE-2026-41280 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...

CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names

A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...

PT-2026-54556

Уязвимость класса DefaultLdapRealm фреймворка Apache Shiro связана с непринятием мер по нейтрализации специальных элементов в запросе LDAP. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти ограничения безопасности и осуществить подмену данных...

httpd:2.4 security update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

GHSA-4GRM-H2QV-H6W6 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

Security Bulletin: The Apache Tomcat application server that is shipped with IBM ApplinX is vulnerable to multiple vulnerabilities.

Summary The Apache Tomcat application server that is shipped with IBM ApplinX is vulnerable to multiple vulnerabiltiies CVE-2026-29146, CVE-2026-34487, CVE-2026-24880, CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-32990, CVE-2026-34483, CVE-2026-34500, CVE-2026-41284, CVE-2026-41293,...

Security Bulletin: Multiple Vulnerabilities in IBM Datacap

Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.9 Interim Fix 008. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...

CVE-2026-50560 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, wazuh-indexer, kafbat-ui, strimzi-kafka-operator, neo4j, celeborn, elasticsearch, thingsboard, management-api-for-apache-cassandra-5.0, keycloak-fips, elasticsearch-fips, camunda-zeebe, apache-pulsar, infinispan, apache-hop, docker-selenium...

CVE-2026-50009 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

CVE-2026-50020 vulnerabilities

Vulnerabilities for packages: request-9047-keycloak-fips, knative-kafka-broker-fips, wazuh-indexer, kafbat-ui, strimzi-kafka-operator, pinot, neo4j, celeborn, elasticsearch, logstash, management-api-for-apache-cassandra-5.0, thingsboard, keycloak-fips, elasticsearch-fips, keycloak, wildfly,...

CVE-2026-48748 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

GHSA-HVCG-QMG6-JM4C vulnerabilities

Vulnerabilities for packages: request-9047-keycloak-fips, knative-kafka-broker-fips, wazuh-indexer, kafbat-ui, strimzi-kafka-operator, pinot, neo4j, celeborn, elasticsearch, logstash, management-api-for-apache-cassandra-5.0, thingsboard, keycloak-fips, elasticsearch-fips, keycloak, wildfly,...

GHSA-563Q-J3CM-6JXM vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, wazuh-indexer, kafbat-ui, strimzi-kafka-operator, neo4j, celeborn, elasticsearch, thingsboard, management-api-for-apache-cassandra-5.0, keycloak-fips, elasticsearch-fips, camunda-zeebe, apache-pulsar, infinispan, apache-hop, docker-selenium...

GHSA-CQ4Q-CV5G-R8Q5 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by IBM WebSphere Application Server CVE-2026-29167, CVE-2026-29170, CVE-2026-44186, CVE-2026-34356, CVE-2026-42535, CVE-2026-43951, CVE-2026-44119, CVE-2026-44631. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

ShellShock - Remote Code Execution

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcg...