CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.4:CLSA-2026:1791552138)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791552138 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791538487)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791538487 advisory. - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2026:1791536084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791536084 advisory. - Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

Apache Tomcat Authentication Bypass

The vulnerability of the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

PT-2026-108817

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The OIDC relying-party component allows the redirection of users to an attacker-controlled URL following successful...

PT-2026-108894

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

PT-2026-109198

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Apache HugeGraph 1.7.0 SecurityManager Sandbox Bypass Remote Code Execution

Apache HugeGraph version 1.7.0 contains a SecurityManager sandbox bypass that allows unauthenticated remote command execution through the Gremlin endpoint. !/usr/bin/env bash Apache HugeGraph 1.7.0 Sandbox Bypass Remote Code Execution Vendor: The Apache Software Foundation Product web page:...

CVE-2026-97791: Concurrent Execution using Shared Resource with Improper Synchronization

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

CVE-2026-73179: Time-of-check Time-of-use (TOCTOU) Race Condition

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

Apache Struts 2.1.8 <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-077)

The version of Apache Struts installed on the remote host is 2.1.8 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced in the S2-077 advisory: - Allocation of resources without limit...

PT-2026-109217

Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1791552137)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791552137 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

fastjson

fastjson Fastjson es una librería de Java que se puede usar para convertir objetos Java a su representación JSON. También se puede usar para convertir una cadena JSON en un objeto Java equivalente. Fastjson puede trabajar con objetos Java arbitrarios, incluyendo objetos preexistentes de los cuale...

poc-cve-2025-69219

CVE-2025-69219 apache airflow deserializzazione non sicura verso RCE 1. copia poc.py nella directory dags di Airflow. 2. avvia il workflow poc dall'UI. 3. controlla i log delle attività per l'output dell'esecuzione...

CLSA-2026-1791482084 Fix of 7 CVEs

SECURITY UPDATE: modcharsetlite: heap overflow in finishpartialchar - debian/patches/CVE-2026-56153.patch: modcharsetlite: heap overflow in finishpartialchar - CVE-2026-56153 SECURITY UPDATE: modheartmonitor: NULL pointer dereference on malformed heartbeat - debian/patches/CVE-2026-46729.patch:...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq

ActiveMQ Fileserver Arbitrary File Write CVE-2016-3088 Vul...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2026-106449 vulnerabilities

Vulnerabilities for packages: kafbat-ui, cruise-control-fips, cassandra-reaper, kafka, logstash-fips, apache-polaris-fips, dd-trace-java, traccar, flink-kubernetes-operator-fips, trino, hadoop-fips, nuxeo, cassandra, cassandra-fips, pinot-fips, sonarqube, solr-fips, thingsboard,...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: kafbat-ui, cruise-control-fips, cassandra-reaper, kafka, logstash-fips, apache-polaris-fips, dd-trace-java, traccar, flink-kubernetes-operator-fips, trino, hadoop-fips, nuxeo, cassandra, cassandra-fips, pinot-fips, sonarqube, solr-fips, thingsboard,...