CVE-2026-79677

A flaw was found in Apache Tomcat. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exploiting lost timeouts for asynchronous WebSocket writes. This can lead to the affected system becoming unresponsive or unavailable...

CVE-2026-78383

A flaw was found in Apache Tomcat. An unauthenticated remote attacker can send a specially crafted AJP Apache JServ Protocol request, causing an AJP processing thread to become unresponsive. This resource exhaustion can lead to a denial of service DoS, making the server unavailable to legitimate...

CVE-2026-77791

A flaw was found in Apache Tomcat. An uncontrolled resource consumption vulnerability occurs when sending a WebSocket close message, which can lead to a busy wait condition. A remote attacker could exploit this to cause a Denial of Service DoS by making the server unresponsive. Mitigation Red Hat...

CVE-2026-76183

A flaw was found in Apache Tomcat. This vulnerability, known as an 'Authentication Bypass by Alternate Name', allows an attacker to bypass the security restrictions set for WebSocket endpoints. This means that unauthorized users could gain access to protected resources or functionality, potential...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Apache Thrift

Summary Multiple vulnerabilities were addressed in IBM DataPower Gateway versions 11.0.0.3 and 10.6.0.11 Vulnerability Details CVEID:CVE-2026-55968 DESCRIPTION: Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings...

CVE-2020-13945-EXPLOIT

CVE-2020-13945 - Apache APISIX リモートコード実行（RCE） このリポジトリには、Apache APISIX の脆弱性に対する概念実証（PoC）エクスプロイトが含まれています。この脆弱性は、Admin API が有効でアクセス IP 制限ルールが削除されている場合に発生し、デフォルトトークンを使用して APISIX の管理データにアクセスできるようになります。これはバージョン 1.2、1.3、1.4、および 1.5 に影響します。 目次 概要 影響を受けるバージョン セットアップ 使用方法 対策 免責事項 概要 Apache APISIX...

Uncontrolled Resource Consumption

Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper resource management in the WebSocket chat example application, which allows an attacker to consume excessive server resources and potentially cause a denial-of-service condition...

Uncontrolled Resource Consumption

Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to an allocation leak in HTTP/2 backlog tracking when streams are reset, which allows a remote attacker to repeatedly reset streams and consume server resources, potentially causing denial of service...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-82331

A flaw was found in the tar source plugin of Apache BuildStream. This improper link resolution vulnerability, also known as 'link following', allows a remote attacker to write arbitrary files on the host system. By crafting malicious source tarballs containing symlinks, an attacker can exploit th...

org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-core-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-core-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292

Apache ActiveMQ Artemis versions before 2.34.0 are vulnerable to an unsafe reflection vulnerability within the FederationStreamConnectMessage.getFederationPolicy() method. The root cause is the direct reading of a class name from the CORE protocol wire buffer without proper type validation, which...

EUVD-2026-88242

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-91006

A flaw was found in Apache Karaf. An attacker with access to instance-management commands or Java Management Extensions JMX interfaces can achieve arbitrary command execution on the underlying host system. This issue occurs because user-supplied Java options are spliced directly into child-instan...

CVE-2026-91006

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

EUVD-2026-88210

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

org.apache.karaf.features:standard (>=4.0.0.m1, <=4.4.11), org.apache.karaf.webconsole:org.apache.karaf.webconsole.instance (>=4.0.0.m1, <=4.4.10) potentially affected by CVE-2026-91006 via org.apache.karaf.instance:org.apache.karaf.instance.core (>=4.0.0.m1, <=4.4.11)

org.apache.karaf.instance:org.apache.karaf.instance.core MAVEN version =4.0.0.m1, =4.0.0.m1, =4.0.0.m1, =4.4.10 Source cves: CVE-2026-91006 Source advisory: MEND:CVE-2026-91006...