CVE-2025-66335

Technical details for CVE-2025-66335 are not publicly available in the provided documents; monitor for updates.

CVE-2026-33558 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. If the DEBUG level is enabled, the sensitive information wi...

PT-2026-33845

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config//show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and it...

Apache Kafka 安全漏洞

Apache Kafka is an open-source distributed streaming platform developed by the Apache Foundation in the United States. This platform enables the acquisition of real-time data, allowing for the creation of applications that can respond in real time to changes in data streams. There are security...

Apache Doris MCP Server 安全漏洞

Apache Doris MCP Server is a context-based protocol backend service provided by the Apache Foundation. Versions of Apache Doris MCP Server prior to 0.6.1 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of query contexts, which could lead to the execution o...

PT-2026-33846

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without...

Apache Kafka 安全漏洞

Apache Kafka is an open-source distributed streaming platform developed by the Apache Foundation in the United States. This platform enables the acquisition of real-time data, allowing for the creation of applications that can respond in real time to changes in data streams. Versions 4.1.0 and...

Exploit for Improper Resource Shutdown or Release in Apache Http_Server

No d...

Exploit for Special Element Injection in Apache Apisix

CVE-2026-31908 - Apache APISIX Header Injection Exploit !Se...

CVE-2026-0636 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, ruby3.4-bouncy-castle-java, ruby4.0-bouncy-castle-java, wildfly, jruby, thingsboard, ruby3.2-bouncy-castle-java, apache-nifi, druid, logstash, apache-nifi-registry, gradle, sonarqube, ruby3.3-bouncy-castle-java, jenkins, keycloak, spark, zipkin,...

PT-2026-33635

Apache Struts CVE-2026-6056 has been rejected, indicating no current security threat. This highlights the importance of verifying CVE statuses before panic. NerdieNews CyberSecurity InfoSec Ransomware Malware https://t.co/uHuPsnGEPa...

PT-2026-33643

Name of the Vulnerable Software and Affected Versions Apache Doris MCP Server versions prior to 0.6.1 Description An improper neutralization flaw in query context handling within the MCP query execution interface may allow the execution of unintended SQL statements. This can lead to the bypass of...

PT-2026-33644

Name of the Vulnerable Software and Affected Versions Apache Kafka versions prior to 3.9.2 Apache Kafka versions prior to 4.0.1 Description The NetworkClient component outputs complete request and response information when the log level is set to DEBUG. While the default log level is INFO, enabli...

CVE-2026-3505 vulnerabilities

Vulnerabilities for packages: gradle, apache-nifi, wildfly, apache-nifi-registry, jenkins...

GHSA-CJ8J-37RH-8475 vulnerabilities

Vulnerabilities for packages: gradle, apache-nifi, wildfly, apache-nifi-registry, jenkins...

GHSA-CJ8J-37RH-8475 vulnerabilities

Vulnerabilities for packages: wildfly, apache-nifi-registry, jenkins, apache-nifi, gradle...

CVE-2026-3505 vulnerabilities

Vulnerabilities for packages: wildfly, apache-nifi-registry, jenkins, apache-nifi, gradle...

CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to improper XCom value handling. An attacker that is a Dag Author who normally should not be able to execute code in the webserver context can execute arbitrary code by crafting malicious XCom...

GHSA-H97W-PM3W-MWMC Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue...