Exploit for Insecure Default Initialization of Resource in Apache Solr

CVE-2026-44825 — Apache Solr 기본 자격 증명 + Velocity Template RCE...

CLEANSTART-2026-AL15636 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

CVE-2026-82458 affects multiple packages. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. See references for individual vulnerabilit...

CLEANSTART-2026-HN97324 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

CVE-2026-71290 affects multiple packages. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

CLEANSTART-2026-WE03470 Uncontrolled Recursion vulnerability in Apache Commons Lang

Security vulnerability affects the strimzi-kafka-operator package. Uncontrolled Recursion vulnerability in Apache Commons Lang...

CLEANSTART-2026-UQ49290 Uncontrolled Resource Consumption vulnerability in Apache Commons IO

Security vulnerability affects the strimzi-kafka-operator package. Uncontrolled Resource Consumption vulnerability in Apache Commons IO...

CLEANSTART-2026-YH51539 Information exposure vulnerability has been identified in Apache Kafka

Security vulnerability affects the strimzi-kafka-operator package. Information exposure vulnerability has been identified in Apache Kafka...

CLEANSTART-2026-BR61448 race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

Security vulnerability affects the strimzi-kafka-operator package. A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics...

CLEANSTART-2026-GN57450 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130386)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130386 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcatvia an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apach...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130388)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130388 advisory. Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, fr...

PT-2026-115313

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description The Keycloak auth manager fails to terminate the session during logout. While the logout route revokes the provided token, the KeycloakJWTMiddleware issues a new, unrevoked...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130361 advisory. Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST...

PT-2026-115310

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description Multi-team provisioning in the Apache Airflow Keycloak provider allows every team role to have global read access to audit logs. This occurs within the attach team...

PT-2026-115312

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets no host key check to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130385)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130385 advisory. Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130403)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130403 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from...

CVE-2025-24813

CVE-2025-24813 — Apache Tomcat Partial PUT Deserialization RCE Severity: Critical CVSS 9.8 Auth required: None Affected: Apache Tomcat 9.0.0.M1 – 9.0.98 / 10.1.0-M1 – 10.1.34 / 11.0.0-M1 – 11.0.2 Patched in: Tomcat 9.0.99 / 10.1.35 / 11.0.3 How It Works Apache Tomcat supports partial PUT chunked...

USN-8931-1: Apache HTTP Server vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

USN-8931-1 apache2 vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads

Summary SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp task...