org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-32967 Source advisory: OSV:GHSA-85G9-8J9G-P486...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.4), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.4) +1 more potentially affected by CVE-2026-32966 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.4)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.4 -...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.0-alpha), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (2.0.0-alpha) potentially affected by CVE-2026-32966 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.0-alpha)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.0-alpha is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.0), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (2.0.0) potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.0)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.0 -...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.6), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.6) +1 more potentially affected by CVE-2026-32966 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.6)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.6 -...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-32966 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-32966 Source advisory: GHSA-R989-CJHX-3V49...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-32967 Source advisory: GHSA-85G9-8J9G-P486...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-32967 Source advisory: SNYK:JAVA-ORGAPACHEDOLPHINSCHEDULER-17398205...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-42357 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-42357 Source advisory: SNYK:JAVA-ORGAPACHEDOLPHINSCHEDULER-17398199...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-32966 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-32966 Source advisory: SNYK:JAVA-ORGAPACHEDOLPHINSCHEDULER-17398200...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-32967 Source advisory: MEND:CVE-2026-32967...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-42357 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-42357 Source advisory: MEND:CVE-2026-42357...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-41280 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-41280 Source advisory: MEND:CVE-2026-41280...

Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

...

org.apache.cxf.systests:cxf-systests-jaxrs (>=4.1.0, <=4.1.6), org.apache.cxf.systests:cxf-systests-transport-jms (>=4.1.0, <=4.1.6) +18 more potentially affected by CVE-2026-50632 via org.apache.cxf:cxf-rt-transports-jms (>=4.1.0, <=4.1.6)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.beta1, =7.4.0.final - org.ow2.petals.samples.soap:cxf-server 5.2.0-1.0.0 -...

Linux Distros Unpatched Vulnerability : CVE-2026-48860

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl inettlsdist module allows unauthenticated bypass of the distribution-over-TLS LAN...

CVE-2026-48860

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl inettlsdist module allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inettlsdist:checkip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead...

CVE-2026-48860 Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl inettlsdist module allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inettlsdist:checkip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead...

Erlang/OTP security vulnerabilities

Erlang/OTP is an open-source JavaScript library for handling exceptions. This library can catch exceptions caused by the built-in APIs of node.js. Erlang/OTP has security vulnerabilities in versions prior to 11.7.2, as well as versions 11.6.0.2 and 11.2.12.9. The vulnerability stems from the...

net.sourceforge.jfacets:jfacets-acegi (>=3.1, <=3.2.1), org.acegisecurity:acegi-security (1.0.3) +35 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (1.2.8)

org.springframework:spring-core MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - net.sourceforge.jfacets:jfacets-acegi =3.1, =1.0.2, =1.0.2, =1.0.0, =1.0.0, =1.0.2 -...