httpd:2.4 security update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

GHSA-4GRM-H2QV-H6W6 vulnerabilities

Vulnerabilities for packages: apache-hop, spark...

Security Bulletin: The Apache Tomcat application server that is shipped with IBM ApplinX is vulnerable to multiple vulnerabilities.

Summary The Apache Tomcat application server that is shipped with IBM ApplinX is vulnerable to multiple vulnerabiltiies CVE-2026-29146, CVE-2026-34487, CVE-2026-24880, CVE-2026-25854, CVE-2026-29129, CVE-2026-29145, CVE-2026-32990, CVE-2026-34483, CVE-2026-34500, CVE-2026-41284, CVE-2026-41293,...

Security Bulletin: Multiple Vulnerabilities in IBM Datacap

Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.9 Interim Fix 008. Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...

CVE-2026-50020 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, spark-kubernetes-operator-fips, kayenta-fips, logstash-fips, apache-pulsar-fips, druid, commercial-elasticsearch, grpc-java-fips, knative-kafka-broker-fips, kafbat-ui, camunda-zeebe, pinot, keycloak-fips, sonarqube, neo4j, logstash,...

CVE-2026-50009 vulnerabilities

Vulnerabilities for packages: apache-hop, spark...

CVE-2026-50560 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, spark-kubernetes-operator-fips, kayenta-fips, apache-pulsar-fips, druid, commercial-elasticsearch, grpc-java-fips, knative-kafka-broker-fips, kafbat-ui, camunda-zeebe, keycloak-fips, sonarqube, neo4j, management-api-for-apache-cassandra-5.0,...

GHSA-HVCG-QMG6-JM4C vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, spark-kubernetes-operator-fips, kayenta-fips, logstash-fips, apache-pulsar-fips, druid, commercial-elasticsearch, grpc-java-fips, knative-kafka-broker-fips, kafbat-ui, camunda-zeebe, pinot, keycloak-fips, sonarqube, neo4j, logstash,...

GHSA-563Q-J3CM-6JXM vulnerabilities

Vulnerabilities for packages: knative-kafka-broker, spark-kubernetes-operator-fips, kayenta-fips, apache-pulsar-fips, druid, commercial-elasticsearch, grpc-java-fips, knative-kafka-broker-fips, kafbat-ui, camunda-zeebe, keycloak-fips, sonarqube, neo4j, management-api-for-apache-cassandra-5.0,...

CVE-2026-48748 vulnerabilities

Vulnerabilities for packages: apache-hop, spark...

GHSA-CQ4Q-CV5G-R8Q5 vulnerabilities

Vulnerabilities for packages: apache-hop, spark...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server

Summary There are multiple vulnerabilities in the IBM HTTP Server used by IBM WebSphere Application Server CVE-2026-29167, CVE-2026-29170, CVE-2026-44186, CVE-2026-34356, CVE-2026-42535, CVE-2026-43951, CVE-2026-44119, CVE-2026-44631. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

Apache 2.4.48 and below contain an issue where uri-path can cause modproxy to forward the request to an origin server chosen by the remote user. id: CVE-2021-40438 info: name: Apache = 2.4.48 ModProxy - Server-Side Request Forgery author: pdteam severity: critical description: Apache 2.4.48 and...

ShellShock - Remote Code Execution

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcg...

Apache 2.4.49 - Path Traversal and Remote Code Execution

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed...

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 For more details about the security issues, including the impact, a CVSS...

Apache CXF < 4.1.7 / 4.2.x < 4.2.2 Multiple Vulnerabilities

The version of Apache CXF installed on the remote host is prior to 4.1.7 or 4.2.x prior to 4.2.2. It is, therefore, affected by multiple vulnerabilities, including: - A JNDI Injection vulnerability in the JCA integration module allows code execution if an attacker can manipulate the JCA deploymen...

CVE-2026-50633

A flaw was found in Apache CXF's JCA integration module. This Java Naming and Directory Interface JNDI Injection vulnerability allows for arbitrary code execution. A remote attacker could exploit this by manipulating the Java EE Connector Architecture JCA deployment descriptor ra.xml or runtime...