CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006

A flaw in Apache Karaf 's instance-management service (InstanceServiceImpl ) allows for arbitrary OS command execution as the Karaf process user. The vulnerability exists because the service builds the launch command for a child Karaf JVM using string concatenation, splicing the caller-supplied j...

CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

Security Bulletin: Multiple Security Vulnerabilities in Apache HttpComponents Client affect IBM Content Navigator

Summary Apache HttpComponents Client is affected by two vulnerabilities CVSS up to 9.1, Critical. CVE-2026-71290 CVSS 9.1 is an improper TLS hostname verification flaw in the async HttpClient versions 5.4 and later where HostnameVerificationPolicyBUILTIN has no effect, allowing a network attacker...

Cross-site Scripting

Apache Wicket is vulnerable to Cross-site Scripting. The vulnerability is due to improper escaping of attribute values in MetaDataHeaderItem, where double quotes in attribute values are replaced with " which has no effect in HTML, and an attacker can supply a value containing a double quote via...

CVE-2026-90979 Apache Karaf: LDAP filter injection in JAAS LDAP login modules

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn drawn from the login name, the resolved user DN, and its fully qualified namespace form into administrator-configured filter templates...

CVE-2026-90979 Apache Karaf: LDAP filter injection in JAAS LDAP login modules

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn drawn from the login name, the resolved user DN, and its fully qualified namespace form into administrator-configured filter templates...

CVE-2026-90979

Apache Karaf is vulnerable to LDAP filter injection due to improper neutralization of special elements in the JAAS LDAP login modules . The LDAPCache and LDAPBackingEngine components build LDAP search filters by substituting placeholders (%u, %dn, %fqdn) into templates using Matcher.quoteReplacem...

CVE-2026-90979 Apache Karaf: LDAP filter injection in JAAS LDAP login modules

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn drawn from the login name, the resolved user DN, and its fully qualified namespace form into administrator-configured filter templates...

CVE-2026-86507

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

CVE-2026-86507 Apache Roller: Stored XSS in comment moderation via comment author URL

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

CVE-2026-86507 Apache Roller: Stored XSS in comment moderation via comment author URL

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

CVE-2026-86507

Apache Roller version 6.1.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input. An anonymous remote attacker can store a malicious comment-author URL that executes script in the session of a weblog moderator or global administrator when they view the...

EUVD-2026-88170

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

CVE-2026-86507 Apache Roller: Stored XSS in comment moderation via comment author URL

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

CVE-2026-86507

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global administrator when the comment management page is viewed. This affects sites that permit comment...

Exploit for CVE-2026-82384

CVE-2026-82384 — Apache Roller 6.1.5 XML-RPC deserialization...

CVE-2026-91206

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...