CVE-2026-82907 - apache ofbiz
Apache OFBiz versions before 24.09.08 let a special login key be captured and reused to create a new session without needing the user's cookies. An attacker who…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
Apache OFBiz versions before 24.09.08 let a special login key be captured and reused to create a new session without needing the user's cookies. An attacker who…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
CVE-2026-82907: Apache OFBiz external login key allows session hijacking
Apache OFBiz versions before 24.09.08 let a special login key be captured and reused to create a new session without needing the user's cookies.
stackflag.com
November 5, 2026 at 4:40 PM
CVE-2026-82907 - apache ofbiz
Apache OFBiz versions before 24.09.08 let a special login key be captured and reused to create a new session without needing the user's cookies. An attacker who…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
Apache OFBiz versions before 24.09.08 let a special login key be captured and reused to create a new session without needing the user's cookies. An attacker who…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
CVE-2026-73117 - apache juneau
Apache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs. If an application uses request data for…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs. If an application uses request data for…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73117: Apache Juneau allows header injection and open redirects
Apache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs.
stackflag.com
November 5, 2026 at 12:50 PM
CVE-2026-73117 - apache juneau
Apache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs. If an application uses request data for…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 can pass data from a web request straight into response headers or redirect URLs. If an application uses request data for…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73116 - apache juneau
The RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session cookies,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
The RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session cookies,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73116: Apache Juneau RestClient may send credentials to other sites
The RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session.
stackflag.com
November 5, 2026 at 12:50 PM
CVE-2026-73116 - apache juneau
The RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session cookies,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
The RestClient component in Apache Juneau versions up to 9.2.0 can follow a web redirect and keep authentication information such as passwords or session cookies,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73099 - apache juneau
Apache Juneau versions up to 9.2.0 let a specially crafted URL replace the request body, even on GET requests. This means an attacker could cause a user’s browser…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 let a specially crafted URL replace the request body, even on GET requests. This means an attacker could cause a user’s browser…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73099: Apache Juneau allows forged requests via content parameter
Apache Juneau versions up to 9.2.0 let a specially crafted URL replace the request body, even on GET requests.
stackflag.com
November 5, 2026 at 12:30 PM
CVE-2026-73099 - apache juneau
Apache Juneau versions up to 9.2.0 let a specially crafted URL replace the request body, even on GET requests. This means an attacker could cause a user’s browser…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 let a specially crafted URL replace the request body, even on GET requests. This means an attacker could cause a user’s browser…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-83542 - apache ofbiz
The Apache OFBiz system (versions before 24.09.08) lets anyone send a specially crafted request that causes the server to execute their code. This can happen during…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
The Apache OFBiz system (versions before 24.09.08) lets anyone send a specially crafted request that causes the server to execute their code. This can happen during…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
CVE-2026-83542: Apache OFBiz can run attacker code without login
The Apache OFBiz system (versions before 24.09.08) lets anyone send a specially crafted request that causes the server to execute their code.
stackflag.com
November 5, 2026 at 4:40 PM
CVE-2026-83542 - apache ofbiz
The Apache OFBiz system (versions before 24.09.08) lets anyone send a specially crafted request that causes the server to execute their code. This can happen during…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
The Apache OFBiz system (versions before 24.09.08) lets anyone send a specially crafted request that causes the server to execute their code. This can happen during…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheofbiz #apachefoundation #CVE #infosec
CVE-2026-73098 - apache juneau
Apache Juneau versions up to 9.2.0 can load and initialize any class named in incoming data, which could trigger unwanted code execution depending on what classes…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 can load and initialize any class named in incoming data, which could trigger unwanted code execution depending on what classes…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73098: Apache Juneau may run attacker-chosen code during data parsing
Apache Juneau versions up to 9.2.0 can load and initialize any class named in incoming data, which could trigger unwanted code execution depending on what.
stackflag.com
November 5, 2026 at 12:30 PM
CVE-2026-73098 - apache juneau
Apache Juneau versions up to 9.2.0 can load and initialize any class named in incoming data, which could trigger unwanted code execution depending on what classes…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 can load and initialize any class named in incoming data, which could trigger unwanted code execution depending on what classes…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-121489 - apache juneau
Apache Juneau versions up to 9.2.0 let a specially crafted request reach files beyond the folder it is supposed to protect. This could let an attacker view, add,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 let a specially crafted request reach files beyond the folder it is supposed to protect. This could let an attacker view, add,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-121489: Apache Juneau allows reading files outside its root directory
Apache Juneau versions up to 9.2.0 let a specially crafted request reach files beyond the folder it is supposed to protect.
stackflag.com
November 5, 2026 at 1:00 PM
CVE-2026-121489 - apache juneau
Apache Juneau versions up to 9.2.0 let a specially crafted request reach files beyond the folder it is supposed to protect. This could let an attacker view, add,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 let a specially crafted request reach files beyond the folder it is supposed to protect. This could let an attacker view, add,…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-96677 - apache juneau
Apache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages. This can…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages. This can…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-96677: Apache Juneau may execute malicious scripts from user input
Apache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages.
stackflag.com
November 5, 2026 at 1:00 PM
CVE-2026-96677 - apache juneau
Apache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages. This can…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 can insert unchecked request data into page headers and footers, letting attackers inject harmful code into web pages. This can…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73101 - apache juneau
Apache Juneau versions up to 9.2.0 include the internal exception class and message in the response header and sometimes in the error body whenever an error…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 include the internal exception class and message in the response header and sometimes in the error body whenever an error…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73101: Apache Juneau reveals internal error details to callers
Apache Juneau versions up to 9.2.0 include the internal exception class and message in the response header and sometimes in the error body whenever an.
stackflag.com
November 5, 2026 at 12:40 PM
CVE-2026-73101 - apache juneau
Apache Juneau versions up to 9.2.0 include the internal exception class and message in the response header and sometimes in the error body whenever an error…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
Apache Juneau versions up to 9.2.0 include the internal exception class and message in the response header and sometimes in the error body whenever an error…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73100 - apache juneau
When Apache Juneau encounters a server error, it writes the full request headers—including passwords, cookies and API keys—to its log files without hiding them.…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
When Apache Juneau encounters a server error, it writes the full request headers—including passwords, cookies and API keys—to its log files without hiding them.…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-73100: Apache Juneau logs authentication headers in clear text on errors
When Apache Juneau encounters a server error, it writes the full request headers—including passwords, cookies and API keys—to its log files without hiding.
stackflag.com
November 5, 2026 at 12:40 PM
CVE-2026-73100 - apache juneau
When Apache Juneau encounters a server error, it writes the full request headers—including passwords, cookies and API keys—to its log files without hiding them.…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
When Apache Juneau encounters a server error, it writes the full request headers—including passwords, cookies and API keys—to its log files without hiding them.…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejuneau #apachefoundation #CVE #infosec
CVE-2026-118636 - apache mina
The JavaNativeMessageDecoder component in Apache MINA reads incoming data without checking what classes are being deserialized. If an attacker sends specially…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachemina #apachefoundation #CVE #infosec
The JavaNativeMessageDecoder component in Apache MINA reads incoming data without checking what classes are being deserialized. If an attacker sends specially…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachemina #apachefoundation #CVE #infosec
CVE-2026-118636: Apache MINA can execute malicious code from crafted messages
The JavaNativeMessageDecoder component in Apache MINA reads incoming data without checking what classes are being deserialized.
stackflag.com
November 1, 2026 at 6:00 PM
CVE-2026-118636 - apache mina
The JavaNativeMessageDecoder component in Apache MINA reads incoming data without checking what classes are being deserialized. If an attacker sends specially…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachemina #apachefoundation #CVE #infosec
The JavaNativeMessageDecoder component in Apache MINA reads incoming data without checking what classes are being deserialized. If an attacker sends specially…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachemina #apachefoundation #CVE #infosec
CVE-2026-90800 - couchdb
Versions of Apache CouchDB up to 3.5.2 let anyone retrieve the full contents of special _users or _replicator databases without proper permission. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
#couchdb #apachefoundation #Ubuntu1604LTS #CVE #infosec
Versions of Apache CouchDB up to 3.5.2 let anyone retrieve the full contents of special _users or _replicator databases without proper permission. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
#couchdb #apachefoundation #Ubuntu1604LTS #CVE #infosec
CVE-2026-90800: Apache CouchDB lets anyone read system databases
Versions of Apache CouchDB up to 3.5.2 let anyone retrieve the full contents of special _users or _replicator databases without proper permission.
stackflag.com
October 29, 2026 at 12:10 PM
CVE-2026-90800 - couchdb
Versions of Apache CouchDB up to 3.5.2 let anyone retrieve the full contents of special _users or _replicator databases without proper permission. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
#couchdb #apachefoundation #Ubuntu1604LTS #CVE #infosec
Versions of Apache CouchDB up to 3.5.2 let anyone retrieve the full contents of special _users or _replicator databases without proper permission. This could…
Too many irrelevant or confusing CVEs? Use stackflag.com
#couchdb #apachefoundation #Ubuntu1604LTS #CVE #infosec
CVE-2026-103119 - apache tomcat
Versions of Apache Tomcat 11.0.0-M25 through 11.0.26 can incorrectly combine parts of one web page with the next request, causing the second request to…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachetomcat #apachefoundation #Debian13 #CVE #infosec
Versions of Apache Tomcat 11.0.0-M25 through 11.0.26 can incorrectly combine parts of one web page with the next request, causing the second request to…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachetomcat #apachefoundation #Debian13 #CVE #infosec
CVE-2026-103119: Apache Tomcat may mix response data between requests
Versions of Apache Tomcat 11.0.0-M25 through 11.0.26 can incorrectly combine parts of one web page with the next request, causing the second request to.
stackflag.com
October 22, 2026 at 3:00 PM
CVE-2026-103119 - apache tomcat
Versions of Apache Tomcat 11.0.0-M25 through 11.0.26 can incorrectly combine parts of one web page with the next request, causing the second request to…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachetomcat #apachefoundation #Debian13 #CVE #infosec
Versions of Apache Tomcat 11.0.0-M25 through 11.0.26 can incorrectly combine parts of one web page with the next request, causing the second request to…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachetomcat #apachefoundation #Debian13 #CVE #infosec
CVE-2026-105869 - apache pulsar
If you use Apache Pulsar with the MultiRolesTokenAuthorizationProvider and have enabled an anonymous user role, the system can accept HTTP requests that fail…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachepulsar #apachefoundation #CVE #infosec
If you use Apache Pulsar with the MultiRolesTokenAuthorizationProvider and have enabled an anonymous user role, the system can accept HTTP requests that fail…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachepulsar #apachefoundation #CVE #infosec
CVE-2026-105869: Apache Pulsar may grant rights to unauthenticated users
If you use Apache Pulsar with the MultiRolesTokenAuthorizationProvider and have enabled an anonymous user role, the system can accept HTTP requests that.
stackflag.com
October 23, 2026 at 6:10 AM
CVE-2026-105869 - apache pulsar
If you use Apache Pulsar with the MultiRolesTokenAuthorizationProvider and have enabled an anonymous user role, the system can accept HTTP requests that fail…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachepulsar #apachefoundation #CVE #infosec
If you use Apache Pulsar with the MultiRolesTokenAuthorizationProvider and have enabled an anonymous user role, the system can accept HTTP requests that fail…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachepulsar #apachefoundation #CVE #infosec
CVE-2026-111811 - apache traffic server
The experimental tsmemcache plugin in Apache Traffic Server lets anyone on the network read, change, or delete items stored in the shared proxy cache without…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #Debian12 #CVE #infosec
The experimental tsmemcache plugin in Apache Traffic Server lets anyone on the network read, change, or delete items stored in the shared proxy cache without…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #Debian12 #CVE #infosec
CVE-2026-111811: Apache Traffic Server tsmemcache plugin lets anyone edit cache
The experimental tsmemcache plugin in Apache Traffic Server lets anyone on the network read, change, or delete items stored in the shared proxy cache.
stackflag.com
October 23, 2026 at 6:40 AM
CVE-2026-111811 - apache traffic server
The experimental tsmemcache plugin in Apache Traffic Server lets anyone on the network read, change, or delete items stored in the shared proxy cache without…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #Debian12 #CVE #infosec
The experimental tsmemcache plugin in Apache Traffic Server lets anyone on the network read, change, or delete items stored in the shared proxy cache without…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #Debian12 #CVE #infosec
CVE-2026-105944 - apache pulsar manager
Apache Pulsar Manager, the web interface used to manage Pulsar clusters, allows anyone who can reach the console to create new administrator accounts and to send…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
Apache Pulsar Manager, the web interface used to manage Pulsar clusters, allows anyone who can reach the console to create new administrator accounts and to send…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
CVE-2026-105944: Apache Pulsar Manager lets anyone create admin accounts
Apache Pulsar Manager, the web interface used to manage Pulsar clusters, allows anyone who can reach the console to create new administrator accounts and.
stackflag.com
October 23, 2026 at 6:30 AM
CVE-2026-105944 - apache pulsar manager
Apache Pulsar Manager, the web interface used to manage Pulsar clusters, allows anyone who can reach the console to create new administrator accounts and to send…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
Apache Pulsar Manager, the web interface used to manage Pulsar clusters, allows anyone who can reach the console to create new administrator accounts and to send…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
CVE-2026-86471 - apache couchdb
A configuration setting in Apache CouchDB version 3.5.2 and earlier lets an administrator execute any command on the machine where the database runs, using the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachecouchdb #apachefoundation #CVE #infosec
A configuration setting in Apache CouchDB version 3.5.2 and earlier lets an administrator execute any command on the machine where the database runs, using the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachecouchdb #apachefoundation #CVE #infosec
CVE-2026-86471: Apache CouchDB admin can run commands on server
A configuration setting in Apache CouchDB version 3.5.2 and earlier lets an administrator execute any command on the machine where the database runs,.
stackflag.com
October 22, 2026 at 1:50 PM
CVE-2026-86471 - apache couchdb
A configuration setting in Apache CouchDB version 3.5.2 and earlier lets an administrator execute any command on the machine where the database runs, using the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachecouchdb #apachefoundation #CVE #infosec
A configuration setting in Apache CouchDB version 3.5.2 and earlier lets an administrator execute any command on the machine where the database runs, using the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachecouchdb #apachefoundation #CVE #infosec
CVE-2026-71253 - apache johnzon
Apache Johnzon can load and start a class named by an attacker when it processes JSON data from an untrusted source. This could let a malicious user execute…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejohnzon #apachefoundation #CVE #infosec
Apache Johnzon can load and start a class named by an attacker when it processes JSON data from an untrusted source. This could let a malicious user execute…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejohnzon #apachefoundation #CVE #infosec
CVE-2026-71253: Apache Johnzon may run attacker‑controlled code from JSON
Apache Johnzon can load and start a class named by an attacker when it processes JSON data from an untrusted source.
stackflag.com
October 20, 2026 at 8:10 PM
CVE-2026-71253 - apache johnzon
Apache Johnzon can load and start a class named by an attacker when it processes JSON data from an untrusted source. This could let a malicious user execute…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejohnzon #apachefoundation #CVE #infosec
Apache Johnzon can load and start a class named by an attacker when it processes JSON data from an untrusted source. This could let a malicious user execute…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejohnzon #apachefoundation #CVE #infosec
CVE-2026-90910 - apache answer
The reaction feature in Apache Answer does not check who can view or modify reactions, so people without permission can read reaction details on hidden items or…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheanswer #apachefoundation #CVE #infosec
The reaction feature in Apache Answer does not check who can view or modify reactions, so people without permission can read reaction details on hidden items or…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheanswer #apachefoundation #CVE #infosec
CVE-2026-90910: Apache Answer lets unauthorized users see and change reactions
The reaction feature in Apache Answer does not check who can view or modify reactions, so people without permission can read reaction details on hidden.
stackflag.com
October 19, 2026 at 8:00 PM
CVE-2026-90910 - apache answer
The reaction feature in Apache Answer does not check who can view or modify reactions, so people without permission can read reaction details on hidden items or…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheanswer #apachefoundation #CVE #infosec
The reaction feature in Apache Answer does not check who can view or modify reactions, so people without permission can read reaction details on hidden items or…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheanswer #apachefoundation #CVE #infosec
CVE-2026-94134 - apache airflow ssh provider
The SSH and SFTP connection tools that come with Apache Airflow do not check the server’s identity unless you specifically configure a host key or turn off the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
The SSH and SFTP connection tools that come with Apache Airflow do not check the server’s identity unless you specifically configure a host key or turn off the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
CVE-2026-94134: Apache Airflow SSH and SFTP providers accept any host key
The SSH and SFTP connection tools that come with Apache Airflow do not check the server’s identity unless you specifically configure a host key or turn.
stackflag.com
October 16, 2026 at 3:30 PM
CVE-2026-94134 - apache airflow ssh provider
The SSH and SFTP connection tools that come with Apache Airflow do not check the server’s identity unless you specifically configure a host key or turn off the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
The SSH and SFTP connection tools that come with Apache Airflow do not check the server’s identity unless you specifically configure a host key or turn off the…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachefoundation #CVE #infosec
CVE-2026-97720 - apache impala
The web server used by Impala’s executors can be tricked into accepting any login token, letting an attacker view or interact with the service when token…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheimpala #apachefoundation #CVE #infosec
The web server used by Impala’s executors can be tricked into accepting any login token, letting an attacker view or interact with the service when token…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheimpala #apachefoundation #CVE #infosec
CVE-2026-97720: Apache Impala lets anyone use its executor web interface
The web server used by Impala’s executors can be tricked into accepting any login token, letting an attacker view or interact with the service when token.
stackflag.com
October 7, 2026 at 11:40 PM
CVE-2026-97720 - apache impala
The web server used by Impala’s executors can be tricked into accepting any login token, letting an attacker view or interact with the service when token…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheimpala #apachefoundation #CVE #infosec
The web server used by Impala’s executors can be tricked into accepting any login token, letting an attacker view or interact with the service when token…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apacheimpala #apachefoundation #CVE #infosec
CVE-2026-92414 - apache jackrabbit
Versions of Apache Jackrabbit from 2.20.0 up to 2.20.17, 2.22.0 to 2.22.4, and 2.23.0 to 2.23.5 may let a user reuse another person's logged‑in…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejackrabbit #apachefoundation #Debian12 #CVE #infosec
Versions of Apache Jackrabbit from 2.20.0 up to 2.20.17, 2.22.0 to 2.22.4, and 2.23.0 to 2.23.5 may let a user reuse another person's logged‑in…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejackrabbit #apachefoundation #Debian12 #CVE #infosec
CVE-2026-92414: Apache Jackrabbit allows session reuse across users
Versions of Apache Jackrabbit from 2.20.0 up to 2.20.17, 2.22.0 to 2.22.4, and 2.23.0 to 2.23.5 may let a user reuse another person's logged‑in session.
stackflag.com
October 8, 2026 at 1:50 AM
CVE-2026-92414 - apache jackrabbit
Versions of Apache Jackrabbit from 2.20.0 up to 2.20.17, 2.22.0 to 2.22.4, and 2.23.0 to 2.23.5 may let a user reuse another person's logged‑in…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejackrabbit #apachefoundation #Debian12 #CVE #infosec
Versions of Apache Jackrabbit from 2.20.0 up to 2.20.17, 2.22.0 to 2.22.4, and 2.23.0 to 2.23.5 may let a user reuse another person's logged‑in…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachejackrabbit #apachefoundation #Debian12 #CVE #infosec
CVE-2026-85086 - thrift
The Perl version of Apache Thrift can fail to properly check security certificates and starts with unsafe default settings. This could let attackers pretend to be…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
The Perl version of Apache Thrift can fail to properly check security certificates and starts with unsafe default settings. This could let attackers pretend to be…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
CVE-2026-85086: DEBIAN-CVE-2026-85086
Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
stackflag.com
October 7, 2026 at 1:50 PM
CVE-2026-85086 - thrift
The Perl version of Apache Thrift can fail to properly check security certificates and starts with unsafe default settings. This could let attackers pretend to be…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
The Perl version of Apache Thrift can fail to properly check security certificates and starts with unsafe default settings. This could let attackers pretend to be…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
CVE-2026-91135 - thrift
Versions of Apache Thrift older than 0.25 that use the ZLIB compression option can write beyond the allocated memory area, potentially causing crashes or allowing an…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
Versions of Apache Thrift older than 0.25 that use the ZLIB compression option can write beyond the allocated memory area, potentially causing crashes or allowing an…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
CVE-2026-91135: DEBIAN-CVE-2026-91135
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
stackflag.com
October 7, 2026 at 1:30 PM
CVE-2026-91135 - thrift
Versions of Apache Thrift older than 0.25 that use the ZLIB compression option can write beyond the allocated memory area, potentially causing crashes or allowing an…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
Versions of Apache Thrift older than 0.25 that use the ZLIB compression option can write beyond the allocated memory area, potentially causing crashes or allowing an…
Too many irrelevant or confusing CVEs? Use stackflag.com
#thrift #apachefoundation #Debian12 #CVE #infosec
CVE-2026-104711 - apache struts
Versions of Apache Struts that use the old RESTful action mapper can be tricked by a specially crafted web request to run arbitrary code on the server. This risk…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachestruts #apachefoundation #CVE #infosec
Versions of Apache Struts that use the old RESTful action mapper can be tricked by a specially crafted web request to run arbitrary code on the server. This risk…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachestruts #apachefoundation #CVE #infosec
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts.
stackflag.com
October 7, 2026 at 5:00 PM
CVE-2026-104711 - apache struts
Versions of Apache Struts that use the old RESTful action mapper can be tricked by a specially crafted web request to run arbitrary code on the server. This risk…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachestruts #apachefoundation #CVE #infosec
Versions of Apache Struts that use the old RESTful action mapper can be tricked by a specially crafted web request to run arbitrary code on the server. This risk…
Too many irrelevant or confusing CVEs? Use stackflag.com
#apachestruts #apachefoundation #CVE #infosec