CVE-2026-41841 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

CVE-2026-41842 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

CVE-2026-41844 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

GHSA-MQ64-J8F9-9GCJ vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry, apache-activemq-fips, apache-activemq, apache-camel-karavan-devmode, kafbat-ui-fips, camunda-zeebe, camunda, jenkins, kafbat-ui...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry, apache-activemq-fips, apache-activemq, apache-camel-karavan-devmode, kafbat-ui-fips, camunda-zeebe, camunda, jenkins, kafbat-ui...

GHSA-72PG-X5F8-J25J vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

GHSA-X23C-287F-QQV5 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

CVE-2026-41843 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-activemq-fips, apache-activemq, kafbat-ui-fips, camunda-zeebe, camunda, kafbat-ui...

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the en...

EUVD-2026-51626

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

UBUNTU-CVE-2026-64607

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for July 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF001 Vulnerability Details CVEID:CVE-2026-41602 DESCRIPTION: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. User...

EUVD-2026-51519

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

EUVD-2026-51518

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-55971

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

Apache Airflow - Unauthenticated Variable Import

Apache Airflow Airflow =2.0.0 and =2.0.0 and 2.1.3 does not protect the variable import endpoint which allows unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution...

Apache Flink - Local File Inclusion

Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process aka local file inclusion. id: CVE-2020-17519 info: name: Apache Flink - Local File Inclusion author: pdtea...

Apache Pinot < 1.3.0 - Authentication Bypass

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special...