94027 matches found
PT-2026-102721
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...
CVE-2026-71898: Incorrect Authorization
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...
CVE-2026-91085: Missing Authorization
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl. .cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...
PT-2026-108541
Security vulnerability affects the apache-superset package. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable...
PT-2026-108446
Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...
PT-2026-108514
Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...
PT-2026-108556
Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...
PT-2026-108553
Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...
CVE-2026-78214: Incorrect Authorization
An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...
CVE-2026-71899: Incorrect Authorization
A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...
PT-2026-108506
Security vulnerability affects the spark-sc212-jdk17-py311 package. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings...
PT-2026-102500
The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...
PT-2026-108547
Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...
PT-2026-108432
Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...
PT-2026-108382
Security vulnerability affects the apache-superset package. A memory leak in Node...
CVE-2026-81569: Improper Authorization
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...
PT-2026-108535
Security vulnerability affects the apache-superset package. A flaw in Node...
CVE-2026-97395: Missing Authorization
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...