PT-2026-47320

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.67 Description A heap-based buffer overflow occurs when processing untrusted content using the mod xml2enc module and the xml2StartParse function. A heap-based buffer overflow is a memory corruptio...

PT-2026-35387

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.0.0 through 2.0.27 Apache MINA versions 2.1.0 through 2.1.10 Apache MINA versions 2.2.0 through 2.2.5 Description An issue exists in the getObject function of the AbstractIoBuffer class due to an incomplete deserializati...

Apache MINA 代码问题漏洞

Apache MINA is a web application framework developed by the Apache Foundation in the United States. This product is primarily used for developing high-performance and highly scalable web applications. There were code vulnerabilities in versions 2.0.0 to 2.0.27, 2.1.0 to 2.1.10, and 2.2.0 to 2.2.5...

PT-2026-35373

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.0.0 through 2.0.27 Apache MINA versions 2.1.0 through 2.1.10 Apache MINA versions 2.2.0 through 2.2.5 Description A flaw in the resolveClass function of AbstractIoBuffer allows a bypass of the classname allowlist for...

PT-2026-47331

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.55 through 2.4.67 Description A Use After Free issue exists in the mod http2 module of Apache HTTP Server, which occurs when file handles are already exhausted. Use After Free is a memory corruption flaw where a...

GHSA-X2WQ-9X2F-FHJ7 vulnerabilities

Vulnerabilities for packages: jenkins, thingsboard, apache-nifi, apache-nifi-registry...

CVE-2026-22751 vulnerabilities

Vulnerabilities for packages: jenkins, thingsboard, apache-nifi, apache-nifi-registry...

GHSA-X2WQ-9X2F-FHJ7 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, apache-nifi-registry, kafbat-ui, nacos, thingsboard, apache-nifi, camunda-zeebe, jenkins, camunda, nacos-docker...

CVE-2026-22751 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, apache-nifi-registry, kafbat-ui, nacos, thingsboard, apache-nifi, camunda-zeebe, jenkins, camunda, nacos-docker...

CVE-2026-33557 vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, apache-nifi, debezium-connector-ibmi, debezium, debezium-connector-informix...

GHSA-28JG-CGG7-J4WC vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, apache-nifi, debezium-connector-ibmi, debezium, debezium-connector-informix...

CVE-2026-33557 vulnerabilities

Vulnerabilities for packages: debezium-connector-informix, debezium, debezium-connector-ibmi, apache-nifi, debezium-connector-spanner...

GHSA-28JG-CGG7-J4WC vulnerabilities

Vulnerabilities for packages: debezium-connector-informix, debezium, debezium-connector-ibmi, apache-nifi, debezium-connector-spanner...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.49 - Path Traversal & RCE CVE-2021-417...

CLEANSTART-2026-NN56899 In libexpat before 2

Multiple security vulnerabilities affect the apache-zookeeper package. In libexpat before 2. See references for individual vulnerability details...

CLEANSTART-2026-OV74385 In libexpat before 2

Multiple security vulnerabilities affect the apache-zookeeper package. In libexpat before 2. See references for individual vulnerability details...

CLEANSTART-2026-LY60131 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IJ61309 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.8.6-r0

Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QM52705 Security fixes for ghsa-72hv-8253-57qq, ghsa-qqpg-mvqg-649v applied in versions: 3.9.4-r0, 3.9.4-r6

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-P3V3-229H-MC63 Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record

The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop HITL and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts including their request parameters and full TaskInstance details for DA...