PT-2026-108470

Security vulnerability affects the apache-hive package. Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active...

PT-2026-108586

Security vulnerability affects the apache-hive package. PAC4J is vulnerable to LDAP Injection in multiple methods...

PT-2026-108464

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108599

Security vulnerability affects the apache-superset package. A vulnerability has been identified in Node...

PT-2026-108583

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

CVE-2026-86843: Improper Neutralization of Special Elements used in an SQL Command

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PT-2026-108482

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108422

Security vulnerability affects the apache-hive package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

PT-2026-102508

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata,...

PT-2026-102721

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

PT-2026-108381

Security vulnerability affects the apache-hive package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

PT-2026-108452

Security vulnerability affects the apache-hive package. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack...

PT-2026-108553

Security vulnerability affects the apache-hive package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

PT-2026-108450

Security vulnerability affects the apache-hive package. An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble",...

PT-2026-108403

Security vulnerability affects the apache-superset package. Issue summary: Processing a malformed PKCS12 file can trigger a NULL pointer dereference in the PKCS12 item decrypt d2i ex function...

PT-2026-108454

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108505

Security vulnerability affects the apache-hive package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

RHEL 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP6 (RHSA-2026:73076)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73076 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...

PT-2026-102505

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497: Uncontrolled Recursion

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...