PT-2026-107219

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.13.0 Description BCEL caches attacker-controlled classes under their self-declared names without validating the requested name. This allows subsequent lookups and name-keyed verification results to refer...

CVE-2026-94114: Symbolic Name not Mapping to Correct Object

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

CVE-2026-105244: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whos...

CVE-2026-105239: Improper Neutralization of Null Byte or NUL Character

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently...

Linux Distros Unpatched Vulnerability : CVE-2026-104712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal...

Apache Commons JCS 3.2.1 Unauthenticated Java Deserialization

Summary JCS is a distributed caching system written in Java. It is intended to speed up applications by providing a means to manage cached data of various dynamic natures. Like any caching system, JCS is most useful for high read, low put applications. Latency times drop sharply and bottlenecks...

Apache Curator 5.9.0 Java Deserialization

Summary Apache Curator is a Java/JVM client library for Apache ZooKeeper, a distributed coordination service. It includes a high level API framework and utilities to make using Apache ZooKeeper much easier and more reliable. It also includes recipes for common use cases and extensions such as...

Apache Configuration Injection via Unsanitized IdP Issuer Setting in Brocade Fabric OS Web Service Interface

: An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

SUSE CVE-2026-66055

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

SUSE CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

SUSE CVE-2026-66859

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

SUSE CVE-2026-83632

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

a4t-sale-discount (5.0.2), acumos (0.9.2) +412 more potentially affected by CVE-2026-102598 via werkzeug (0.16.1)

werkzeug PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - a4t-sale-discount 5.0.2 - acumos 0.9.2 - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =4.0.0, =1.3.0,...

alo7-airflow (>=1.10.0, <=1.10.0.7), amundsen-metadata (1.0.17) +65 more potentially affected by CVE-2026-102598 via werkzeug (0.14.1)

werkzeug PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - alo7-airflow =1.10.0, =1.10.3b1, =0.6.7.post3, =0.1.1, =0.6.4, =0.1.0, =0.1.0, =1.0.5, =1.0.4, =0.1.3a0, =0.5.4rc0, =0.5.4rc0, =0.2.0rc0, =0.2....

CVE-2026-104712

Apache Struts can produce a response many orders of magnitude larger than the request when an attacker-controlled request parameter is bound to a java.math.BigDecimal property and that property is rendered through the Struts tag library. An unauthenticated remote attacker can use sustained,...

CVE-2026-104711

Apache Struts has an OGNL expression-injection vulnerability in the legacy RESTful action mapper. A crafted request to an application configured to use this mapper may lead to remote code execution. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are n...

org.apache.nifi:nifi-snowflake-processors (2.8.0), org.apache.nifi:nifi-snowflake-processors-nar (2.8.0) +5 more potentially affected by CVE-2026-86597 via net.snowflake:snowflake-jdbc-thin (3.28.0)

net.snowflake:snowflake-jdbc-thin MAVEN version 3.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc-thin and may be impacted: - org.apache.nifi:nifi-snowflake-processors 2.8.0 -...

apache-airflow-providers-snowflake (>=2.4.0rc1, <=2.5.1), rcd-dev-kit (>=0.0.11, <=1.1.0) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.1)

snowflake-connector-python PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - apache-airflow-providers-snowflake =2.4.0rc1, =0.0.11, =1.1.0 Source cves: CVE-2026-86597 Source advisory:...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104712

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...