PT-2026-108529

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

PT-2026-108439

Security vulnerability affects the sonarqube package. Improper certificate validation in Apache MINA SSHD server-side...

PT-2026-108561

Security vulnerability affects the apache-superset package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CVE-2026-102495: Uncontrolled Recursion

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

PT-2026-102503

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

PT-2026-102500

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PT-2026-108597

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

PT-2026-102463

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

PT-2026-108446

Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...

PT-2026-108491

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108556

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

PT-2026-108432

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

PT-2026-108440

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

PT-2026-108574

Security vulnerability affects the apache-hive package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...

PT-2026-108522

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

PT-2026-102504

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496: Uncontrolled Recursion

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

Hitachi Energy SOI

SUMMARY Hitachi Energy is aware of RCE Remote Code Execution vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product...

GHSA-9F6G-J8CH-79G4 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Impact Morgan writes attacker-controlled request data to the access log. Its escaping added in 1.11.0 and 1.12.0 neutralizes control characters, the Unicode line separators, and backslash, but not the double quote 0x22, which is the field delimiter of the Apache combined log format morgan emits. ...

RHLW-2026-E78D277BDE69C3F5 Lightwell Security Advisory: apache-mime4j-core 0.8.9.rhlw-00004

Red Hat Lightwell has released org.apache.james:apache-mime4j-core 0.8.9.rhlw-00004 with a backported security fix. CVE-2024-21742: Improper input validation allows for header injection in MIME4J library when using MIME4J DOM for composing message. This can be exploited by an attacker to add...