Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. id: CVE-2024-32114 info: name: Apache ActiveMQ 6.x 6.1....

ROOT-APP-MAVEN-CVE-2026-10050 CVE-2026-10050 in org.eclipse.jetty:jetty-security - Patched by Root

Root has patched CVE-2026-10050 in the org.eclipse.jetty:jetty-security package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-18662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, an...

UBUNTU-CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

Linux Distros Unpatched Vulnerability : CVE-2026-18659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN- servlet, the Jakarta Spec constraints defined as...

UBUNTU-CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

ai.pipestream:pipestream-wiremock-server (>=0.1.1, <=0.1.6), ai.timefold.solver.enterprise:timefold-solver-enterprise-service-test (2.8.0-rc-1) +1360 more potentially affected by CVE-2026-18662 via org.eclipse.jetty:jetty-security (>=11.0.0, <=11.0.26)

org.eclipse.jetty:jetty-security MAVEN version =11.0.0, =0.1.1, =2.2.0, =0.1.6, =4.0.0-beta.1, =0.1.0-rc, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.29.5 and more Source cves: CVE-2026-18662 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243543...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7676 more potentially affected by CVE-2026-18659 via org.eclipse.jetty:jetty-security (>=9.4.0.m0, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-security MAVEN version =9.4.0.m0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2026-18659 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243559...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8), ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10) +11802 more potentially affected by CVE-2026-18662 via org.eclipse.jetty:jetty-security (>=7.6.13.v20130916, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-security MAVEN version =7.6.13.v20130916, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =chaining-0.0.46-dev, =0.0.115 and more Source cves: CVE-2026-18662...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later...

DEBIAN-CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

DEBIAN-CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-18659 Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7674 more potentially affected by CVE-2026-18659 via org.eclipse.jetty:jetty-security (>=9.4.0.v20161208, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-security MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2026-18659 Source advisory: MEND:CVE-2026-18659...