CLEANSTART-2026-AQ60759 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

CLEANSTART-2026-PE66600 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...

CLEANSTART-2026-BR90501 non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints (default: 1000 characters)

Security vulnerability affects the apache-nifi package. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters...

CLEANSTART-2026-HR51503 In Eclipse Jetty, an HTTP URI of this form: /public;/

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...

CLEANSTART-2026-WX23354 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

CLEANSTART-2026-GI93885 In Eclipse Jetty, the HTTP/1

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...

CLEANSTART-2026-AM26944 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

CLEANSTART-2026-GS83780 In Eclipse Jetty, versions 12

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions 12...

CLEANSTART-2026-WE49283 Apache NiFi 1

Security vulnerability affects the apache-nifi package. Apache NiFi 1...

CLEANSTART-2026-HF44570 Critical XXE in Apache Tika tika-core (1

Security vulnerability affects the apache-nifi package. Critical XXE in Apache Tika tika-core 1...

CLEANSTART-2026-EJ17153 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

CLEANSTART-2026-KF94035 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CLEANSTART-2026-TW91822 In Eclipse Jetty, versions <=9

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions =9...

CLEANSTART-2026-VN01735 In Jakarta Mail versions prior to 2

Security vulnerability affects the apache-nifi package. In Jakarta Mail versions prior to 2...

CLEANSTART-2026-GN63905 In jose4j before 0

Security vulnerability affects the apache-nifi package. In jose4j before 0...

CVE-2026-94220: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

CVE-2026-82806: Exposure of Data Element to Wrong Session

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-94212: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

CVE-2026-94276: Improper Authentication

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...