Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a path traversal vulnerability due to Apache Ant

Summary Apache Ant is used by IBM Integrated Analytics System as a Java-based build and task execution tool. CVE-2026-78254 affects Apache Ant versions prior to 1.10.18, where the ftp and scp tasks allow a malicious server or a machine-in-the-middle attacker to provide relative paths during file...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

Security Bulletin:Vulnerabilities exists in Ant package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative...

Security update for apache-sshd

This update for apache-sshd fixes the following issues: CVE-2026-77185: Asynchronous authentication can bypass signature verification bsc1283357. CVE-2026-93994: Repeated-publickey policy bypass on server bsc1283352. CVE-2026-93995: Remote execution of JGit "archive -o=file.zip" can write file on...

SUSE-SU-2026:4622-1 Security update for apache-sshd

This update for apache-sshd fixes the following issues: - CVE-2026-77185: Asynchronous authentication can bypass signature verification bsc1283357. - CVE-2026-93994: Repeated-publickey policy bypass on server bsc1283352. - CVE-2026-93995: Remote execution of JGit 'archive -o=file.zip' can write...

web-server-audit_CVE-2026-42945

webserveraudit Don't ask if you're vulnerable. Ask if you're exploitable. A single-file Python tool that audits nginx and Apache against known CVEs by checking both the installed version and whether the vulnerable code path is actually reachable through your configuration. Why? Most CVE scanners...

Apache Tomcat - Open Redirect

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...

K000163653: Apache HTTP Server vulnerabilities CVE-2026-56449 and CVE-2026-57941

Security Advisory Description CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's modhttp2 via...

Apache YuniKorn 1.9.0 LDAP Group Provider Denial of Service

Apache YuniKorn versions 1.8.0 and 1.9.0 contain an LDAP group provider denial of service vulnerability that causes a resolver panic when a memberOf attribute lacks "CN=". !/usr/bin/env bash Apache YuniKorn 1.9.0 LDAP Group Provider Panic Denial of Service Vendor: The Apache Software Foundation...

Important: tomcat11

Issue Overview: Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through...

Important: tomcat10

Issue Overview: Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from...

CVE-2026-92119: Improperly Controlled Modification of Dynamically-Determined Object Attributes

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

CVE-2026-92116: URL Redirection to Untrusted Site

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...

CVE-2026-92120: Authentication Bypass by Capture-replay

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...

CVE-2026-85499: Incorrect Authorization

Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-proxy functionality. Under a non-default configuration with a readonly Canopy user and a reachable monitoring target, that user can send non-read requests throug...

Fixed in Apache Tomcat 9.0.123

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 4b1eb9a1. This issue was...

Fixed in Apache Tomcat 10.1.61

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 6c7da608. This issue was...

Fixed in Apache Tomcat 11.0.27

Important: AJP response mix-up CVE-2026-103119 A buffer under-read meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly...

PT-2026-110913

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.22.0 Description An OAuth1 Request Replay Attack issue exists in Apache Allura. This allows an attacker to reuse a previously captured request to perform unauthorized actions. Recommendations Upgrade to versio...

PT-2026-110912

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.22.0 Description Apache Allura contains a mass assignment issue within its REST API. Mass assignment occurs when an application takes user-provided input and binds it directly to an internal object or database...