Security Bulletin: Multiple Vulnerabilities in IBM Datacap

Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.9 Interim Fix 008. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...

CVE-2026-50560 vulnerabilities

Vulnerabilities for packages: apache-pulsar, reposilite, hono, kafbat-ui, spark-kubernetes-operator, strimzi-kafka-operator, apache-pulsar-fips, kserve-modelmesh, spark, spark-kubernetes-operator-fips, thingsboard, keycloak-fips, neo4j, infinispan, kafbat-ui-fips, celeborn, elasticsearch-fips,...

CVE-2026-50009 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

CVE-2026-50020 vulnerabilities

Vulnerabilities for packages: apache-pulsar, reposilite, hono, kafbat-ui, spark-kubernetes-operator, strimzi-kafka-operator, apache-pulsar-fips, kserve-modelmesh, spark, spark-kubernetes-operator-fips, thingsboard, keycloak-fips, opensearch, neo4j, infinispan, kafbat-ui-fips, pinot, wildfly,...

GHSA-HVCG-QMG6-JM4C vulnerabilities

Vulnerabilities for packages: apache-pulsar, reposilite, hono, kafbat-ui, spark-kubernetes-operator, strimzi-kafka-operator, apache-pulsar-fips, kserve-modelmesh, spark, spark-kubernetes-operator-fips, thingsboard, keycloak-fips, opensearch, neo4j, infinispan, kafbat-ui-fips, pinot, wildfly,...

GHSA-563Q-J3CM-6JXM vulnerabilities

Vulnerabilities for packages: apache-pulsar, reposilite, hono, kafbat-ui, spark-kubernetes-operator, strimzi-kafka-operator, apache-pulsar-fips, kserve-modelmesh, spark, spark-kubernetes-operator-fips, thingsboard, keycloak-fips, neo4j, infinispan, kafbat-ui-fips, celeborn, elasticsearch-fips,...

CVE-2026-48748 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

GHSA-CQ4Q-CV5G-R8Q5 vulnerabilities

Vulnerabilities for packages: spark, apache-hop...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by IBM WebSphere Application Server CVE-2026-29167, CVE-2026-29170, CVE-2026-44186, CVE-2026-34356, CVE-2026-42535, CVE-2026-43951, CVE-2026-44119, CVE-2026-44631. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

Apache 2.4.49 - Path Traversal and Remote Code Execution

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed...

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

Apache 2.4.48 and below contain an issue where uri-path can cause modproxy to forward the request to an origin server chosen by the remote user. id: CVE-2021-40438 info: name: Apache = 2.4.48 ModProxy - Server-Side Request Forgery author: pdteam severity: critical description: Apache 2.4.48 and...

ShellShock - Remote Code Execution

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcg...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 For more details about the security issues, including the impact, a CVSS...

Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities

The version of Apache CXF installed on the remote host is prior to 4.1.7 or 4.2.x prior to 4.2.2. It is, therefore, affected by multiple vulnerabilities, including: - A JNDI Injection vulnerability in the JCA integration module allows code execution if an attacker can manipulate the JCA deploymen...

CVE-2026-50633

A flaw was found in Apache CXF's JCA integration module. This Java Naming and Directory Interface JNDI Injection vulnerability allows for arbitrary code execution. A remote attacker could exploit this by manipulating the Java EE Connector Architecture JCA deployment descriptor ra.xml or runtime...

CVE-2026-50627

A flaw was found in Apache CXF. The JwtAccessTokenValidator class fails to properly validate the 'aud' Audience claims within incoming JSON Web Token JWT access tokens. This vulnerability allows an attacker to reuse a JWT, originally intended for one resource server, against a different resource...

Code Injection

Apache Flink is vulnerable to Code Injection. The vulnerability is due to improper escaping of user-controlled strings during SQL code generation, which allows an authenticated attacker to inject arbitrary Java code and execute it on TaskManagers through specially crafted SQL queries...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by CVE-2025-48924

Summary IBM Engineering Systems Design Rhapsody TestConductor was vulnerable to an uncontrolled recursion on very long inputs. This could cause components using Apache Commons Lang to stop. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache...