CVE-2026-111915 Yank Note before 3.93.1 Path Traversal via /api/help Endpoint

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

CVE-2026-111915

Versions of Yank Note prior to 3.93.1 are vulnerable to a path traversal vulnerability (CWE-22) via the /api/help endpoint. Unauthenticated remote attackers can bypass single-replacement sanitization by supplying repeated ../ segments in the path or doc parameters. This flaw allows attackers to r...

CVE-2026-111915 Yank Note before 3.93.1 Path Traversal via /api/help Endpoint

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

EUVD-2026-104318

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

org.apache.camel.quarkus:camel-quarkus-integration-test-knative (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-knative (>=3.35.0, <=3.39.0) +8 more potentially affected by CVE-2026-84180 via org.apache.camel:camel-knative-api (>=4.19.0, <=4.22.0)

org.apache.camel:camel-knative-api MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-84180 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430452...

org.apache.camel.k:camel-k-itests-knative (>=3.2.0, <=3.15.3), org.apache.camel.k:camel-k-itests-knative-consumer (>=3.2.0, <=3.15.3) +23 more potentially affected by CVE-2026-84180 via org.apache.camel:camel-knative-api (>=4.0.0, <=4.18.4)

org.apache.camel:camel-knative-api MAVEN version =4.0.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.7.0, =3.4.0, =3.8.1, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.14.0 and more Sou...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.35.0, <=3.39.0) +3 more potentially affected by CVE-2026-80344 via org.apache.camel:camel-as2-api (>=4.19.0, <=4.22.0)

org.apache.camel:camel-as2-api MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-80344 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21246603...

org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.18.4), org.apache.camel.karaf:camel-as2-test (>=4.7.0, <=4.18.4) +5 more potentially affected by CVE-2026-80344 via org.apache.camel:camel-as2-api (>=4.0.0, <=4.18.4)

org.apache.camel:camel-as2-api MAVEN version =4.0.0, =4.7.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.0.0, =4.18.4 Source cves: CVE-2026-80344 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21246603...

org.apache.camel.quarkus:camel-quarkus-as2 (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-as2-deployment (>=3.35.0, <=3.39.0) +3 more potentially affected by CVE-2026-85296 via org.apache.camel:camel-as2-api (>=4.19.0, <=4.22.0)

org.apache.camel:camel-as2-api MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.22.0 Source cves: CVE-2026-85296 Source advisory: MEND:CVE-2026-85296...

org.apache.camel.karaf:camel-as2 (>=4.18.1, <=4.18.4), org.apache.camel.karaf:camel-as2-test (>=4.18.1, <=4.18.4) +5 more potentially affected by CVE-2026-85296 via org.apache.camel:camel-as2-api (>=4.16.0, <=4.18.4)

org.apache.camel:camel-as2-api MAVEN version =4.16.0, =4.18.1, =4.18.1, =3.30.0, =3.30.0, =3.30.0, =4.16.0, =4.16.0, =4.18.4 Source cves: CVE-2026-85296 Source advisory: MEND:CVE-2026-85296...

CVE-2026-90910

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-64943

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Use...

CVE-2026-112188

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...

CVE-2026-108837

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade...

CVE-2026-90910

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910

The Apache Answer software, versions through 2.0.2 , is vulnerable to a missing authentication for critical function vulnerability in its reaction API . The API fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted content or perfo...

EUVD-2026-104165

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-90910 Apache Answer: Reaction API authorization bypass for restricted content

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own...

CVE-2026-64943

Apache Answer versions through 2.0.2 are vulnerable to an Insertion of Sensitive Information into Log File (CWE-532) flaw. The application writes full API keys to application logs during every authenticated request. An attacker with log-read access can recover these logs to obtain and replay acti...