93848 matches found
CVE-2026-92393 Apache YuniKorn: Admission control bypass via workload UPDATE operation
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...
EUVD-2026-94253
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE...
Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important...
Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important...
CVE-2026-93684 Apache Impala: Stored XSS in Impala query plans
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...
CVE-2026-93684 Apache Impala: Stored XSS in Impala query plans
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...
CVE-2026-93684
Apache Impala (up to and including version 4.5.2 ) is vulnerable to stored XSS (CWE-79). An SQL user with only SELECT permissions can inject malicious JavaScript into a table alias . This script can then execute in the browser of another user who views the query plan via the Impala Web UI . To re...
CVE-2026-90466 Apache Impala: Path traversal executes JARs outside trusted paths
Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'. The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path...
CVE-2026-90466
Apache Impala version 4.5.2 is vulnerable to a path traversal vulnerability involving the trusted_jar_paths startup flag. An attacker can exploit this to load an attacker-controlled JAR file via a relative path, provided that a trusted path is already configured by an administrator. The attack is...
CVE-2026-90466 Apache Impala: Path traversal executes JARs outside trusted paths
Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'. The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path...
CVE-2026-97720
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...
CVE-2026-97720 Apache Impala: Impala Executor Webserver Auth Bypass
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...
CVE-2026-97720 Apache Impala: Impala Executor Webserver Auth Bypass
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...
CVE-2026-97720
Apache Impala versions up to and including 4.5.2 are vulnerable to an authentication bypass in the Impala executors due to an incorrect implementation of JWT/OAuth authentication . Specifically, the system fails to validate Bearer token (JWT) signatures , causing the executor's webserver to accep...
EUVD-2026-94222
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...
apache-vulnerability-testing
Herramienta de Prueba de Vulnerabilidades del Servidor Apache HTTP Este repositorio proporciona una Prueba de Concepto PoC para probar diversas vulnerabilidades en el Servidor Apache HTTP, incluyendo Ataques de Confusión de Nombres de Archivo, SSRF, Denegación de Servicio y otras relacionadas con...
CVE-2026-105111
A flaw was found in Apache Commons BCEL. The Class2HTML component does not properly sanitize strings when generating web pages from Java class files. A remote attacker can supply a specially crafted class file to trigger stored Cross-Site Scripting XSS when a user views the generated report...
CVE-2026-94114
A flaw was found in Apache Commons BCEL Byte Code Engineering Library. When loading untrusted classes, the library caches them under their internally declared names without verifying them against the requested class name. A remote attacker could exploit this vulnerability to substitute legitimate...
