1494099 matches found
CVE-2026-18659
An unauthenticated authorization bypass exists in Eclipse Jetty across multiple versions of jetty-security, jetty-eeN-security, and jetty-eeN-servlet. The vulnerability is caused by the ConstraintSecurityHandler incorrectly matching http-method-omission constraints using substrings instead of exa...
CVE-2026-18662
Across various versions of Eclipse Jetty , specifically the jetty-security and jetty-eeN-security components, a vulnerability exists where multiple security constraints with the same http-method-omission set and no url-patterns are not combined correctly according to the Jakarta Servlet Spec . Th...
EUVD-2026-101995
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...
CVE-2026-18662
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...
CVE-2026-18662
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...
CVE-2026-18662
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...
CLSA-2026-1792057279 TuxCare security update for io.projectreactor (2 CVEs)
TuxCare rebuilt 3 io.projectreactor packages to address 2 CVEs. Fixed in 3.5.14-tuxcare.1...
ai.covia:covia-claude-code (>=0.9.3, <=0.9.11), ai.covia:covia-discord (>=0.9.4, <=0.9.11) +2077 more potentially affected by CVE-2026-19863 via org.eclipse.jetty:jetty-security (>=12.1.0, <=12.1.12)
org.eclipse.jetty:jetty-security MAVEN version =12.1.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.6.0, =0.9.3, =0.9.9, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =4.9.3 and more Source cves: CVE-2026-19863 Source advisory: MEND:CVE-2026-19863...
EUVD-2026-101985
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...
EUVD-2026-101984
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...
CVE-2026-53882 Path Traversal in Virtualization Station VM Import
An improper link resolution before file access 'link following' vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in...
EUVD-2026-101975
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...
CVE-2026-34014 ds-move-files.sh is writable and executed as root
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...
CVE-2026-34014
A vulnerability exists in Download Station due to an incorrect permission assignment for the critical resource ds-move-files.sh, which is both writable and executed as root . A local attacker who has gained an administrator account can exploit this to compromise the security of the system. The vu...
CVE-2026-18661
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
DEBIAN-CVE-2026-18661
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
CVE-2026-18661
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
EUVD-2026-101954
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
CVE-2026-18661
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
CVE-2026-18661
In Eclipse Jetty, across various versions of "jetty-annotations", and "jetty-eeN-annotations", the Jakarta Spec authoritative url-pattern rules for mixed "@ServletSecurity" annotation, and "web.xml" defined "security-constraint" on the same "url-pattern" were not being applied if the "web.xml" ha...