76269 matches found
org.apache.syncope.client.am:syncope-client-am-console (>=4.1.0-m0, <=4.1.2), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.1.0-m0, <=4.1.2) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.1.0-m0, <=4.1.2)
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.2 - org.apache.syncope.ext.s...
org.apache.syncope.client.am:syncope-client-am-console (>=4.0.4, <=4.0.7), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.0.4, <=4.0.7) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.0.4, <=4.0.7)
org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4,...
org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +27 more potentially affected by CVE-2026-82428 via org.apache.storm:storm-client (3.0.0)
org.apache.storm:storm-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-client and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...
CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
CVE-2026-82428
The Apache Storm Client is vulnerable to cross-tenant dependency jar substitution due to predictable blob keys. When using the storm jar --artifacts feature, dependency artifacts are stored under keys derived solely from Maven coordinates (e.g., dep---.jar). Because these keys are predictable and...
org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +27 more potentially affected by CVE-2026-82431 via org.apache.storm:storm-client (3.0.0)
org.apache.storm:storm-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-client and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...
CVE-2026-82431 Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Description SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty, before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving nimbus.users unset, therefore received no restriction at all: every...
CVE-2026-82431
The Apache Storm cluster is vulnerable to an authorization bypass in the SimpleACLAuthorizer component. The vulnerability occurs because the authorizer returns early when the nimbus.users list is empty, failing to evaluate the nimbus.groups list. Consequently, operators who configure access restr...
org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +27 more potentially affected by CVE-2026-82434 via org.apache.storm:storm-client (3.0.0)
org.apache.storm:storm-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-client and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...
CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...
CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...
CVE-2026-12985
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, and 11.7.x
org.apache.storm:apache-storm-source (3.0.0), org.apache.storm:final-package (3.0.0) +27 more potentially affected by CVE-2026-82435 via org.apache.storm:storm-client (3.0.0)
org.apache.storm:storm-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-client and may be impacted: - org.apache.storm:apache-storm-source 3.0.0 - org.apache.storm:final-package 3.0.0 -...
OPENSUSE-SU-2026:21846-1 Security update for keybase-client
This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add update-go-crypto.patch to update affected dependency bsc1278586. - Update to go 1.26 as required ...
Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-13293)
Summary IBM MQ has addressed a bypass of the Java deserialization allowlist in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code on a system consuming JMS ObjectMessages Vulnerability Details CVEID:CVE-2026-13293 DESCRIPTION: IBM MQ could allow a...
Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-10751)
Summary IBM MQ has addressed a Java deserialization filter bypass in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10751 DESCRIPTION: IBM MQ Java and JMS client libraries could allow an authenticated attacker ...
CVE-2026-78336
Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...
Astra Linux – Vulnerability in Tomcat9
There is an improper authentication vulnerability in Apache Tomcat, which means that under certain circumstances e.g., using CLIENT-CERT or SPNEGO, a user can be authenticated even if the user does not exist in the DataSourceRealm. This issue affects Apache Tomcat versions from 11.0.0-M1 through...
Astra Linux – Vulnerability in Linux
The fs/nfs/nfs4client.c file in the Linux kernel before version 5.13.4 has an incorrect connection-setup ordering. This allows operators of remote NFSv4 servers to cause a denial of service termination of services, by arranging for those servers to become unreachable during trunking detection...
Astra Linux – Vulnerability in Qemu
A flaw was discovered in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. This flaw occurs when dropping packets during a bulk transfer from a SPICE client, due to the packet queue being full. A malicious SPICE client could exploit this flaw to call the free function in...