93889 matches found
CVE-2026-104713: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...
...[ More ]
Apache Submarine retired to the Apache Attic suffers from an authentication bypass leading to unauthenticated remote code execution. The security filter CommonFilter.isProtectedApi treats any request whose User-Agent header matches the Python SDK pattern as not requiring authentication, and the...
CVE-2026-104714: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...
PT-2026-106135
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.8 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description The REST plugin allows request bodies to be read into...
PT-2026-106134
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An asymmetric resource consumption amplification issue exists when a request parameter is bound to ...
Apache ActiveMQ DoS
The vulnerability of the Apache ActiveMQ software platform is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...
Linux Distros Unpatched Vulnerability : CVE-2026-104269
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules...
apache-sshd-2.20.0-1.1 on GA media (moderate)
apache-sshd-2.20.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11940-1 Rating: moderate Cross-References: CVE-2026-77185 CVE-2026-93994 CVE-2026-93995 CVE-2026-93996 CVE-2026-94002 CVE-2026-94029 CVE-2026-94052 CVE-2026-94053 CVSS scores: CVE-2026-77185 SUSE : 7.4...
RHEL 10 : mod_auth_openidc (RHSA-2026:75581)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:75581 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID...
Linux Distros Unpatched Vulnerability : CVE-2026-104259
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - modsecurity - None modsecurity-apache - None Ubuntu Linux - GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment...
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path,...
CVE-2026-57819
A flaw was found in Apache CXF. This vulnerability allows a remote attacker to initiate a Denial of Service DoS attack. The issue arises because the component does not enforce a default limit on the number of form parameters processed in a JAX-RS message, enabling an attacker to send requests wit...
CVE-2026-65432
A flaw was found in Apache CXF. The framework's initial processing of a Web Services Description Language WSDL document disables XML DTDs Document Type Definitions and external entities. However, any WSDL or XML Schema Definition XSD documents imported by the top-level WSDL are processed by a...
CVE-2026-68494 vulnerabilities
Vulnerabilities for packages: opensearch, spark, strimzi-kafka-operator, dependency-track, trino, apache-nifi-registry, akhq, tez, flyway, keycloak-config-cli, scala, sonarqube, apache-nifi, logstash, cass-config-builder, keycloak, wildfly, apicurio-registry, gradle, infinispan, spdx-tools-java,...
GHSA-642R-3GJ9-2PJ5 vulnerabilities
Vulnerabilities for packages: opensearch, spark, strimzi-kafka-operator, dependency-track, trino, apache-nifi-registry, akhq, tez, flyway, keycloak-config-cli, scala, sonarqube, apache-nifi, logstash, cass-config-builder, keycloak, wildfly, apicurio-registry, gradle, infinispan, spdx-tools-java,...
Security Bulletin: Due to the use of Apache Ant, IBM Sterling Control Center is vulnerable to Relative Path Traversal (CVE-2026-78254)
Summary Apache Ant is used by IBM Sterling Control Center as part of dependency in ant-1.10.11.jar Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to...
Security Bulletin: Due to the use of Apache ActiveMQ, IBM Sterling Control Center is vulnerable to Improper Input Validation (CVE-2026-74761)
Summary Apache ActiveMQ is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-74761 DESCRIPTION: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. A...
[SECURITY] Fedora 45 Update: lemonldap-ng-2.23.4-1.fc45
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
