CLEANSTART-2026-YK12318 PyJWT is a Python implementation of JSON Web Token standards

Security vulnerability affects the apache-superset package. PyJWT is a Python implementation of JSON Web Token standards...

CLEANSTART-2026-TV45483 urllib3 is an HTTP client library for Python

Security vulnerability affects the apache-superset package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-DZ64581 urllib3 is an HTTP client library for Python

Security vulnerability affects the apache-superset package. urllib3 is an HTTP client library for Python...

CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-BO15897 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it

Security vulnerability affects the apache-superset package. PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it...

CLEANSTART-2026-DK31702 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-GF20241 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

Security vulnerability affects the apache-superset package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

CLEANSTART-2026-QQ47371 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-UQ05512 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the apache-superset package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

PT-2026-109192

Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-109191

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

CVE-2026-73179: Time-of-check Time-of-use (TOCTOU) Race Condition

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

PT-2026-108812

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...

PT-2026-108818

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The FIQL query parser contains a flaw in its operator search mechanism. When processing a long string that lacks an operator,...

PT-2026-108813

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description StaxUtils does not impose limits on the total number of elements or characters in an XML document by default. This allows a...

PT-2026-108811

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The parser for multipart/MTOM attachment part headers fails to strictly enforce the attachment-max-header-size and...

PT-2026-108894

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

PT-2026-108817

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The OIDC relying-party component allows the redirection of users to an attacker-controlled URL following successful...

PT-2026-108867

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description An issue exists in the STSTokenValidator where the result of the SAML assertion signature check is stored in an object shared...

Apache ActiveMQ 5.11.1 Arbitrary File Write

Apache ActiveMQ version 5.11.1 contains an arbitrary file write vulnerability in the fileserver application. The included proof of concept environment documents anonymous PUT uploads followed by MOVE requests to place files at arbitrary paths. https://packetstorm.news/download/235032...