Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130142 advisory. Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130100 advisory. Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly JASPICServerAuthContext component...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130145 advisory. Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue...

SUSE CVE-2026-56449

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Apache ZooKeeper

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Apache ZooKeeper. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59739 DESCRIPTION: Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An...

CVE-2026-107460

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

CVE-2026-107460

The UrlImageConverter component in Apache Fesod (Incubating) (specifically version fesod-sheet 2.0.2-incubating ) is vulnerable to a Server-Side Request Forgery (SSRF) bypass via DNS rebinding . The vulnerability occurs when the application accepts an attacker-controlled image URL for spreadsheet...

CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

EUVD-2026-98748

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

K000163690: Apache Tomcat vulnerabilities CVE-2026-78437, CVE-2026-86248, and CVE-2026-87022

Security Advisory Description CVE-2026-78437 Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, fro...

Apache Struts 2 - Remote Command Execution

Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a...

CVE-2021-42013

CVE-2021-42013 — PoC: Path Traversal + RCE via modcgi patch bypass For use only in controlled and own environments. Do not use against systems without authorization. Description PoC developed to demonstrate CVE-2021-42013 , present in Apache HTTP Server 2.4.50. This CVE is the bypass of the patch...

Exploit for Expression Language Injection in Apache Struts

CVE-2026-1047...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts

CVE-2024-53677 — Apache Struts 2 파일 업로드 경로 조작 → RCE 아파치 Strut...

CVE-2021-41773

Apache Path Traversal & RCE Exploit CVE-2021-41773 & CVE-2021-42013 These are critical path traversal vulnerabilities affecting Apache HTTP Server 2.4.49 and 2.4.50. They allow attackers to: Access files outside the web root LFI Achieve Remote Code Execution RCE if CGI is enabled Both...

Exploit for Expression Language Injection in Apache Struts

CVE-2026-10471...

Exploit for Expression Language Injection in Apache Struts

CVE-202...

Exploit for Insecure Default Initialization of Resource in Apache Solr

CVE-2026-44825 — Apache Solr 기본 자격 증명 + Velocity Template RCE...

apache-vulnerable

Scan FOR APACHE versions "ZERO-DAY" Apache Version 2.4.49 and 2.4.50 CVE-2021-41773 and CVE-2021-42013 How to use : You Will need nuclei ! https://github.com/projectdiscovery/nuclei Check local nuclei install and verify template nuclei -t apache-vulnerable-versions.yaml -vv and nuclei -t...