CVE-2026-111251 Apache TomEE: Unauthenticated server shutdown via the admin port

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.2) +2 more potentially affected by CVE-2026-81569 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-81569 Source advisory: MEND:CVE-2026-81569...

CVE-2026-74891: Use of Hard-coded Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-32967 Source advisory: MEND:CVE-2026-32967...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-42357 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-42357 Source advisory: MEND:CVE-2026-42357...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.1) +2 more potentially affected by CVE-2026-41280 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-41280 Source advisory: MEND:CVE-2026-41280...

[SECURITY] Fedora 43 Update: python-wsgidav-4.3.4-1.fc43

A generic and extendable WebDAV server written in Python and based on WSGI. Main features: =E2=80=A2 WsgiDAV is a stand-alone WebDAV server with SSL support, that can be installed and run as Python command line script. =E2=80=A2 The python-pam library is needed as extra requirement if pam-login...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to the exposure of sensitive data to unauthorized actors. An attacker can access sensitive data such as database credentials by exploiting this vulnerability. Workaround This vulnerability can be mitigated by...

org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0, <=3.0.1) potentially affected by CVE-2025-62188 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0, <=3.0.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0, =3.0.0, =3.0.1 Source cves: CVE-2025-62188 Source advisory: MEND:CVE-2025-62188...

CVE-2026-23897

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`

Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone...

CVE-2026-23897

CVE-2026-23897 affects Apollo Server when using the default configuration of startStandaloneServer from @apollo/server/standalone. Versions 2.0.0–3.13.0, 4.2.0–before 4.13.0, and 5.0.0–before 5.4.0 are vulnerable to Denial of Service via specially crafted request bodies with exotic character set ...

Regular Expression Denial of Service (ReDoS)

Overview @apollo/server is a spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. Successor to apollo-server-core, et al. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer...

Regular Expression Denial of Service (ReDoS)

Overview apollo-server is a Production ready GraphQL Server Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer function. An attacker can cause the server to become unresponsive by sending specially crafted request bodies wi...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.17 Update

New Red Hat build of Keycloak 26.0.17 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.17 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

[SECURITY] Fedora 43 Update: civetweb-1.16-10.fc43

Civetweb is an easy to use, powerful, C C/C++ embeddable web server with optional CGI, SSL and Lua support. CivetWeb can be used by developers as a library, to add web server functionality to an existing application. It can also be used by end users as a stand-alone web server running on a Window...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.15 Update

New Red Hat build of Keycloak 26.0.15 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.15 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

org.apache.dolphinscheduler:dolphinscheduler-alert-all (>=3.2.0, <=3.2.1), org.apache.dolphinscheduler:dolphinscheduler-alert-server (>=2.0.1, <=3.2.1) +2 more potentially affected by CVE-2024-43115 via org.apache.dolphinscheduler:dolphinscheduler-alert-script (>=2.0.1, <=3.2.1)

org.apache.dolphinscheduler:dolphinscheduler-alert-script MAVEN version =2.0.1, =3.2.0, =2.0.1, =2.0.1, =2.0.1, =3.0.6 Source cves: CVE-2024-43115 Source advisory: MEND:CVE-2024-43115...