PT-2026-108470

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

PT-2026-108452

Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

PT-2026-108499

Security vulnerability affects the sonarqube package. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA...

CVE-2026-71897: Incorrect Authorization

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

PT-2026-108529

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

PT-2026-108381

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

VulnCheck KEV: CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

PT-2026-108351

Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

PT-2026-108491

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108414

Security vulnerability affects the apache-superset package. We have identified a bug in Node...

PT-2026-108557

Security vulnerability affects the apache-superset package. A memory leak occurs in Node...

PT-2026-108583

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

PT-2026-102508

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

PT-2026-108436

Security vulnerability affects the apache-hive package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

PT-2026-108597

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

PT-2026-108368

Security vulnerability affects the apache-hive package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

PT-2026-108461

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

PT-2026-108370

Security vulnerability affects the elasticsearch package. Uncontrolled Recursion vulnerability in Apache Commons Lang...

PT-2026-108355

Security vulnerability affects the spark-sc212-jdk17-py311 package. Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4...

PT-2026-108379

Security vulnerability affects the spark-sc212-jdk17-py311 package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...