PT-2026-102608

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-108494

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108382

Security vulnerability affects the apache-superset package. A memory leak in Node...

PT-2026-108529

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

PT-2026-108439

Security vulnerability affects the sonarqube package. Improper certificate validation in Apache MINA SSHD server-side...

PT-2026-108561

Security vulnerability affects the apache-superset package. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

PT-2026-102500

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PT-2026-102463

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

Hitachi Energy SOI

SUMMARY Hitachi Energy is aware of RCE Remote Code Execution vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and availability of the product...

PT-2026-108446

Security vulnerability affects the apache-hive package. A security issue was found in Netplex Json-smart 2...

PT-2026-108491

Security vulnerability affects the apache-superset package. A flaw in Node...

PT-2026-108556

Security vulnerability affects the apache-hive package. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent...

PT-2026-108432

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

PT-2026-108440

Security vulnerability affects the apache-hive package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

PT-2026-108574

Security vulnerability affects the apache-hive package. Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value...

PT-2026-108522

Security vulnerability affects the apache-hive package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

PT-2026-102504

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496: Uncontrolled Recursion

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102495: Uncontrolled Recursion

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

PT-2026-102503

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...