PT-2026-117859

Security vulnerability affects the apache-nifi package. The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics...

PT-2026-117847

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

PT-2026-117815

Security vulnerability affects the apache-nifi package. In Jakarta Mail versions prior to 2...

PT-2026-117854

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

PT-2026-117850

Security vulnerability affects the apache-nifi package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

PT-2026-117830

Security vulnerability affects the apache-nifi package. In an untrusted JMS environment, org...

PT-2026-117856

Security vulnerability affects the apache-nifi package. Applications which accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack if the evaluation of a SpEL expression triggers unbounded cache growth...

PT-2026-117840

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

PT-2026-117849

Security vulnerability affects the activemq package. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data...

PT-2026-117879

Security vulnerability affects the apache-nifi package. Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection', Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component...

PT-2026-117909

Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...

PT-2026-117863

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

PT-2026-117873

Security vulnerability affects the airflow-3 package. Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections...

PT-2026-117911

Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

PT-2026-117904

Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...

PT-2026-117866

Security vulnerability affects the airflow-3 package. The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based should hide value for key check which triggers on secret-suffixed key names like password / token / secret could not fire for...

PT-2026-117889

Security vulnerability affects the apache-nifi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

PT-2026-117907

Security vulnerability affects the airflow-3 package. The Config API in Apache Airflow surfaced per-key secrets-backend overrides environment variables like AIRFLOW SECRETS BACKEND KWARG SECRET ID and AIRFLOW WORKERS SECRETS BACKEND KWARG SECRET ID as synthetic config options whose option names...

PT-2026-117890

Security vulnerability affects the apache-nifi package. Vulnerability in Spring Spring Security...

PT-2026-117923

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...