PT-2026-115313

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description The Keycloak auth manager fails to terminate the session during logout. While the logout route revokes the provided token, the KeycloakJWTMiddleware issues a new, unrevoked...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130385)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130385 advisory. Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130403)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130403 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from...

PT-2026-115310

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description Multi-team provisioning in the Apache Airflow Keycloak provider allows every team role to have global read access to audit logs. This occurs within the attach team...

PT-2026-115312

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets no host key check to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130361 advisory. Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST...

USN-8931-1: Apache HTTP Server vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

USN-8931-1 apache2 vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads

Summary SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp task...

K000163720: Apache Tomcat vulnerabilities CVE-2026-86243, CVE-2026-86246, and CVE-2026-86247

Security Advisory Description CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupporte...

CVE-2026-82617

A flaw was found in Apache OpenNLP. The built-in regular expression patterns used for identifying email and URL strings contain inefficient nested repetitions. A remote attacker can exploit this flaw by submitting crafted text to an affected application, triggering excessive CPU consumption or...

Exploit for Insecure Default Initialization of Resource in Apache Solr

CVE-2026-44825 — Apache Solr 기본 자격 증명 + Velocity Template RCE...

Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries

Summary IBM ApplinX is vulnerable to multiple vulnerabilities due to use of third-party libraries: Apache Log4j is vulnerable to an improper encoding or escaping of output vulnerability CVE-2026-49844; FasterXML jackson-databind is vulnerable to multiple uncontrolled resource consumption,...

Resource Exhaustion

Apache Thrift is vulnerable to resource exhaustion. The vulnerability is due to missing limits or throttling on resource allocation, where the TSaslNonblockingServer can allocate resources without bounds and attackers can trigger unlimited consumption to cause denial of service...

Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in the third party libraries shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-59313 DESCRIPTION: Spring MVC applications using the functional web framework are vulnerable to stream corruption...

Resource Exhaustion

Apache Thrift is vulnerable to resource exhaustion. The vulnerability is due to unbounded allocation of resources without proper throttling, where the Java bindings perform resource allocation without limits and attackers can trigger excessive resource consumption to cause denial of service...

Updated apache package fixes security vulnerabilities

Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...

MGASA-2026-0502 Updated apache package fixes security vulnerabilities

Limited RCE for some internal redirects to non-CGI files in CGI directories. CVE-2026-42356 moddav shared lock overflow. CVE-2026-42528 modheartmonitor denial of service. CVE-2026-46729 modsession: Session cookie not removed during internal redirect. CVE-2026-47360 modauthdigest reauthentication...

Apache OFBiz <17.12.06 - Arbitrary Code Execution

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. id: CVE-2021-26295 info: name: Apache OFBiz 17.12.06 - Arbitrary Code Execution author: madrobot severity: critical description: | Apache OFBiz...

Apache Struts2 S2-008 RCE

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. id: CVE-2012-0392 info: name: Apache...