CVE-2026-92120

Apache Allura versions through 1.21.0 are vulnerable to an OAuth1 Request Replay Attack (CWE-294). This vulnerability allows an attacker to capture and replay authentication requests to gain unauthorized access. Users are recommended to upgrade to version 1.22.0 , which contains the fix for this ...

CVE-2026-92120 Apache Allura: Oauth1 Replay Attack

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...

EUVD-2026-97832

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...

CVE-2026-92119 Apache Allura: REST API Mass Assignment

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

EUVD-2026-97831

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

CVE-2026-92119

Apache Allura versions prior to 1.22.0 are vulnerable to a REST API Mass Assignment issue (CWE-915). The vulnerability occurs when the application binds user-provided input directly to internal objects or database models without proper filtering, potentially allowing an attacker to modify restric...

CVE-2026-92116

Apache Allura versions through 1.21.0 are vulnerable to an OAuth1 callback validation issue, categorized under CWE-601 (URL Redirection to Untrusted Site). This flaw allows for potential open redirect consequences due to missing validation during the OAuth1 callback process. Impacted users are re...

CVE-2026-92116 Apache Allura: OAuth1 missing callback validation

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

EUVD-2026-97829

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

tomcat: Apache Tomcat: Possible TLS 1.3 connection failures

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security TLS 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting in an intermittent Denial of Service DoS...

tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes

A flaw was found in Apache Tomcat. During large non-blocking write operations, a buffer under-read can cause an HTTP response body to be split between the current request and the subsequent request handled on the same connection. A remote user sending a follow-up request could receive sensitive...

tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure

A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS Federal Information Processing Standards mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This...

tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vulnerability to trigger unintended data cross-over,...

tomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup

A flaw was found in Apache Tomcat. Due to an incomplete cleanup vulnerability, HTTP Hypertext Transfer Protocol trailer headers from a previous request can persist and leak into a subsequent request processed on the same connection. This issue may allow a remote user to access sensitive request...

tomcat: tomcat: Unauthorized socket access via TOCTOU race condition

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use TOCTOU race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive...

tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect EAR condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the...

tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm

A flaw was found in Apache Tomcat. When the Java Naming and Directory Interface JNDI realm is configured with a non-Generic Security Service Application Program Interface GSSAPI Simple Authentication and Security Layer SASL mechanism, a missing verification step allows an attacker to bypass...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

Summary IBM i is vulnerable to multiple vulnerabilities CVE-2026-65432, CVE-2026-66142, CVE-2026-66143, CVE-2026-66144, CVE-2026-49875, CVE-2026-10841, CVE-2026-11548, CVE-2026-11549, CVE-2026-11722, CVE-2026-15396, CVE-2026-15412, CVE-2026-15634 in WebSphere Application Server WAS Liberty as...

CVE-2026-85499

Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests throug...

CVE-2026-85499

An Improper Authorization vulnerability exists in Apache SkyWalking BanyanDB (versions 0.11.0 before 0.11.1 ). The issue is located in the Canopy component, where the system fails to enforce readonly-role restrictions on the /monitoring/* proxy. Under a non-default configuration, a user with a re...