PT-2026-108506

Security vulnerability affects the spark-sc212-jdk17-py311 package. Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings...

PT-2026-108541

Security vulnerability affects the apache-superset package. A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable...

PT-2026-108461

Security vulnerability affects the apache-hive package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

PT-2026-108480

Security vulnerability affects the apache-hive package. When audit logging is enabled zookeeper...

PT-2026-108414

Security vulnerability affects the apache-superset package. We have identified a bug in Node...

PT-2026-108379

Security vulnerability affects the spark-sc212-jdk17-py311 package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...

PT-2026-108468

Security vulnerability affects the apache-hive package. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check...

PT-2026-108535

Security vulnerability affects the apache-superset package. A flaw in Node...

CVE-2026-91012: Improper Limitation of a Pathname to a Restricted Directory

org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...

PT-2026-108415

Security vulnerability affects the spark-sc212-jdk17-py311 package. Apache Log4j Core's Rfc5424Layout https://logging...

PT-2026-108441

Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

PT-2026-108540

Security vulnerability affects the apache-hive package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

PT-2026-108351

Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

PT-2026-108355

Security vulnerability affects the spark-sc212-jdk17-py311 package. Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4...

PT-2026-108370

Security vulnerability affects the elasticsearch package. Uncontrolled Recursion vulnerability in Apache Commons Lang...

VulnCheck KEV: CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

PT-2026-108547

Security vulnerability affects the apache-superset package. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node...

PT-2026-108557

Security vulnerability affects the apache-superset package. A memory leak occurs in Node...

PT-2026-108443

Security vulnerability affects the apache-superset package. Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file...

CVE-2026-81862: Insertion of Sensitive Information into Log File

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...