XWiki < 4.10.15 - Sensitive Information Disclosure

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

Apache Solr <=8.8.1 - Server-Side Request Forgery

Apache Solr versions 8.8.1 and prior contain a server-side request forgery vulnerability. The ReplicationHandler normally registered at "/replication" under a Solr core in Apache Solr has a "masterUrl" also "leaderUrl" alias parameter that is used to designate another ReplicationHandler on anothe...

camel-solr: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

A flaw was found in the Apache Camel Solr component. A remote unauthenticated attacker can inject Solr query parameters and document fields into requests by utilizing specific header prefixes SolrParam. and SolrField. that bypass the HTTP header filter. This improper input validation allows for...

Apache Solr <=8.3.1 - Remote Code Execution

Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable,...

CLEANSTART-2026-LF42316 Security fix for CVE-2026-24308 applied in: apache-activemq-artemis 2.51.0-r0, apache-activemq-artemis 2.52.0-r0, apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, confluent-common-docker 7.6.9-r2, kafka-fips 3.8.1-r7, kserve-modelmesh 0.10.0-r0, kserve-modelmesh 0.12.0-r0, schema-registry 7.7.8-r0, solr 9.10.1-r1, spark-sc213-jdk17-py311 4.1.1-r2, thingsboard 4.3.0.1-r2, thingsboard 4.3.1-r0

CVE-2026-24308 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QB24702 Security fix for CVE-2025-5115 applied in: schema-registry 7.7.8-r0, schema-registry 7.9.6-r0, solr 9.8.1-r1

CVE-2025-5115 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BZ08231 Security fix for CVE-2026-6790 applied in: apache-hive 4.0.1-r8, apache-nifi 2.10.0-r3, apache-zookeeper 3.9.5-r8, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r1, solr 10.0.0-r6, strimzi-kafka-operator 1.1.0-r2, trino 480-r10, trino 483-r1

CVE-2026-6790 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MT16431 Security fix for CVE-2026-44825 applied in: solr 9.9.0-r1

Security vulnerability affects the solr package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-HY48105 Security fix for CVE-2026-75595 applied in: apache-zookeeper 3.8.6-r6, apache-zookeeper 3.9.5-r6, cassandra-reaper-fips 4.2.5-r1, elasticsearch 9.3.8-r5, elasticsearch 9.5.2-r2, keycloak 26.5.7-r8, solr 10.0.0-r8, solr 9.10.1-r8, solr 9.8.1-r3, trino 480-r11, trino 483-r4

CVE-2026-75595 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EX11941 Security fix for CVE-2026-62243 applied in: apache-zookeeper 3.8.6-r6, apache-zookeeper 3.9.5-r6, elasticsearch 9.5.2-r2, keycloak 26.5.7-r8, solr 10.0.0-r8, solr 9.10.1-r8, solr 9.8.1-r3, trino 480-r11

CVE-2026-62243 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MF87519 Security fix for CVE-2024-7708 applied in: solr 9.8.1-r1

Security vulnerability affects the solr package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EO12643 Security fix for CVE-2026-75596 applied in: elasticsearch 9.3.8-r5, solr 9.10.1-r8, solr 9.8.1-r3

CVE-2026-75596 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-50022

Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An...

CVE-2026-50022

Metacat , a data repository software, is affected by an unintended proxy vulnerability in its MetacatSolrIndex.query component prior to version 3.4.2 . The component forwards a client-controlled qt parameter through Apache SolrJ to a privileged Solr backend. An unauthenticated client can select t...

GHSA-W6W4-RJH9-9R58 vulnerabilities

Vulnerabilities for packages: solr-fips, solr...

CVE-2026-55223 vulnerabilities

Vulnerabilities for packages: solr-fips, solr...

CVE-2026-83557 vulnerabilities

Vulnerabilities for packages: kates, apache-hop, s3proxy-fips, datahub-gms, wazuh-indexer, geoserver, pinot, elasticsearch, cassandra-fips, hadoop-client-modules, apache-tika-fips, spark-fips, mongodb-search-fips, spark, seata, drain-cleaner-fips, floci-az, airbyte-platform-fips,...

CLEANSTART-2026-SU61748 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the solr package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

GHSA-6QM2-MCQ7-53QP vulnerabilities

Vulnerabilities for packages: apache-hop, s3proxy-fips, management-api-for-apache-cassandra-4.1, geoserver, pinot, elasticsearch, cassandra-fips, hadoop-client-modules, apache-tika-fips, spark-fips, spark, seata, dependency-track-apiserver, neo4j, apache-activemq-fips, apache-hop-fips,...

CVE-2026-56094

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor ca...