Arbitrary Code Execution

Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...

Server-Side Request Forgery (SSRF)

org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...

CVE-2026-50229

⚡ CVE-2026-50229 — Apache Tomcat Examples XSS Exploit 🔴 Advanced Cross-Site Scripting XSS Scanner & Exploit for Apache Tomcat Examples Web Application 📌 Overview CVE-2026-50229 is a Cross-Site Scripting XSS vulnerability discovered in the bundled examples web application shipped with Apache Tomca...

Path Traversal

Apache MINA SSHD is vulnerable to path traversal. The vulnerability is due to insufficient path validation on Windows, where the sshd-git component fails to properly restrict file system paths and an authenticated remote user can craft directory traversal sequences to access git repositories...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

Struts Patch-Gap Auditor A small Python tool that finds Apach...

CLEANSTART-2026-XZ10656 Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5

Security vulnerability affects the sonarqube package. Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core 5...

CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-LD36349 Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1

Security vulnerability affects the sonarqube package. The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1...

CLEANSTART-2026-SX30440 Apache Log4j's JsonTemplateLayout https://logging

Security vulnerability affects the sonarqube package. Apache Log4j's JsonTemplateLayout https://logging...

CLEANSTART-2026-DZ37385 Apache Log4j Core's Rfc5424Layout https://logging

Security vulnerability affects the sonarqube package. Apache Log4j Core's Rfc5424Layout https://logging...

CLEANSTART-2026-BH90179 Apache Log4j Core's XmlLayout https://logging

Security vulnerability affects the sonarqube package. Apache Log4j Core's XmlLayout https://logging...

CLEANSTART-2026-FS24569 Socket Appender in Apache Log4j Core versions 2

Security vulnerability affects the sonarqube package. The Socket Appender in Apache Log4j Core versions 2...

CLEANSTART-2026-HK92541 Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795

Security vulnerability affects the sonarqube package. Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795...

CLEANSTART-2026-EF36950 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA

Security vulnerability affects the sonarqube package. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA...

CLEANSTART-2026-BM76577 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

CVE-2026-43871 affects multiple packages. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings. See references for individual vulnerability details...

CLEANSTART-2026-UP81071 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

Apache Configuration Injection via Unsanitized IdP Issuer Setting in Brocade Fabric OS Web Service Interface

: An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

PT-2026-107235

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.9 through 3.4.x Description Insufficient logging occurs in the EventLogAppender on Windows. Long messages are truncated to a fixed size that, when combined with log and source names, exceeds the Windows Event Log...

PT-2026-107179

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.9 through 3.4.x Description Improper neutralization of null bytes or NUL characters in the EventLogAppender allows a NUL character in logged content to truncate the Windows Event Log record. This results in all...

Azure HDInsight Apache Ambari Privilege Escalation

The vulnerability in the Apache Ambari web interface of the Azure HDInsight data analytics service relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...