65306 matches found
CVE-2026-43826
The OpenSearch logging provider, when configured with a host URL that embeds credentials for example https://user:[email protected]:9200, wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend...
Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j and Bouncy Castle.
Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j and Bouncy Castle. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostnam...
CVE-2026-5081
A flaw was found in Apache::Session::Generate::ModUniqueId, a Perl module designed to generate session identifiers. This module uses the Apache moduniqueid plugin's UNIQUEID environment variable directly as a session ID. The UNIQUEID is constructed from easily guessable information, such as the...
Unity Linux 20.1060e / 20.1070e Security Update: pdfbox (UTSA-2026-017627)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017627 advisory. In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree...
Apache Airflow 日志信息泄露漏洞
Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. The Apache Airflow OpenSearch Provider has a vulnerabilit...
Unity Linux 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-017605)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017605 advisory. Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' Tenable has extracted the preceding description block directly from...
Unity Linux 20.1060e / 20.1070e Security Update: tomcat (UTSA-2026-017430)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017430 advisory. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The obje...
Unity Linux 20.1060e / 20.1070e Security Update: tomcat (UTSA-2026-017511)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017511 advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances...
Unity Linux 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-017572)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017572 advisory. FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: maven (UTSA-2026-017745)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017745 advisory. Apache Maven will follow repositories that are defined in a dependencys Project Object Model pom which may be surprising to some users, resulting in potential risk i...
Exploit for Code Injection in Apache Nifi
CVE-2023-34468 Exploit !GitHub starshttps://img.shields.io...
Exploit for Code Injection in Apache Nifi
CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execu...
CVE-2026-6860 vulnerabilities
Vulnerabilities for packages: spark, apache-pulsar, wildfly, keycloak, apicurio-registry, strimzi-kafka-operator, druid...
GHSA-3G76-F9XQ-8VP6 vulnerabilities
Vulnerabilities for packages: spark, apache-pulsar, wildfly, keycloak, apicurio-registry, strimzi-kafka-operator, druid...
CVE-2026-6722 Use-After-Free in SOAP using Apache map
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys,...
CVE-2026-6722
CVE-2026-6722 describes a use-after-free in PHP’s SOAP extension object deduplication. In affected PHP versions (8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6), the global map stores object pointers without proper reference counting. If an apache:Map node c...
Fixed in Apache Tomcat 9.0.118
Moderate: Security constraints not correctly applied CVE-2026-43515 When multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. This was fixed with commit db919ff9. This issue was reported to the Tomcat securit...
CVE-2026-40682 vulnerabilities
Vulnerabilities for packages: apache-hop-fips, apache-hop, thingsboard...