CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-55252

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55251

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55249

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-55814

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55248

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55247

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65942

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55246

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945 Apache Ranger: Logs contain replayable JWT bearer tokens

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65948 Apache Ranger: UnixAuth lacks brute-force protection

UnixAuth lacks brute-force protection in Apache Ranger versions = 2.8.0. Note: UnixAuth is NOT a recommended option for production deployments. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

Security Bulletin:Vulnerability in BIND 9 affects IBM Netezza Appliance

Summary The BIND 9 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-5946 Vulnerability Details CVEID:CVE-2026-5946 DESCRIPTION: Multiple flaws have been identified in named related to the handling of DNS messages whose CLASS is not Internet...

CVE-2026-14211

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

EUVD-2026-54726

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-13505

CVE-2026-13505 concerns Bouncy Castle for Java FIPS (BC-FJA). The issue: sensitive key material held by AES/DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and PBKD/scrypt parameter classes was zeroised on garbage collection via Object.finalize. Finalization is non-deterministic and runs on...

CVE-2026-13505 Zeroisation of sensitive key material on garbage collection relies on finalization

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by...

CVE-2026-62296 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

CVE-2026-62295 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

CVE-2026-62293

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...

CVE-2026-62293 HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As...