PT-2026-108370

Security vulnerability affects the elasticsearch package. Uncontrolled Recursion vulnerability in Apache Commons Lang...

PT-2026-108355

Security vulnerability affects the spark-sc212-jdk17-py311 package. Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4...

PT-2026-108379

Security vulnerability affects the spark-sc212-jdk17-py311 package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...

PT-2026-102504

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

PT-2026-108561

Security vulnerability affects the apache-superset package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CVE-2026-102495: Uncontrolled Recursion

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

PT-2026-102503

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496: Uncontrolled Recursion

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

RHEL 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 (RHSA-2026:73076)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73076 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...

PT-2026-108470

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

PT-2026-108499

Security vulnerability affects the sonarqube package. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA...

PT-2026-108351

Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

PT-2026-108583

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

GHSA-9F6G-J8CH-79G4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

RHLW-2026-E78D277BDE69C3F5 Lightwell Security Advisory: apache-mime4j-core 0.8.9.rhlw-00004

Red Hat Lightwell has released org.apache.james:apache-mime4j-core 0.8.9.rhlw-00004 with a backported security fix. CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

Time-of-check Time-of-use (TOCTOU) Race Condition

Apache Tomcat is vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. The vulnerability is due to a race condition during the creation of Unix domain sockets, which allows an unauthorized local attacker to exploit the timing window and gain access to the Unix domain socket...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740 Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

EUVD-2026-88379

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...