CVE-2026-107460 - Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (In

CVE-2026-92120 - OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: th

CVE-2026-92119 - REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: throug

CVE-2026-92116 - OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: thro

CVE-2026-85499 - Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplet

CVE-2026-103636 - Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketche

CVE-2026-103635 - Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: dat

CVE-2026-103513 - Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: dat

CVE-2026-103501 - Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketche

CVE-2026-104021 - The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to,

CVE-2026-103413 - Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, K

CVE-2026-103412 - Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apac

CVE-2026-97791 - In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate

CVE-2026-97468 - Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens und

CVE-2026-86463 - Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query express

CVE-2026-79650 - Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after s

CVE-2026-78384 - CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A

CVE-2026-73179 - Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code

CVE-2026-108039 - By default, StaxUtils placed no limit on the total number of elements or the total number of charact

CVE-2026-107938 - In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not v

CVE-2026-107937 - In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the confi

CVE-2026-100227 - Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security m

CVE-2026-71896 - An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve oth

CVE-2026-71895 - An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to re

CVE-2026-71183 - An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain infor

CVE-2026-66087 - An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to opera

CVE-2026-66084 - An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modif

CVE-2026-66082 - An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perfo

CVE-2026-87661 - Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configu

CVE-2026-103371 - Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affec

CVE-2026-92415 - — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's

CVE-2026-92414 - : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit We

CVE-2026-97146 - Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a se

CVE-2026-92393 - Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload U

CVE-2026-78243 - Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out o

CVE-2026-97720 - Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions u

CVE-2026-94114 - Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their s

CVE-2026-105244 - Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.

CVE-2026-105243 - Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were tr

CVE-2026-105242 - Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of

CVE-2026-105241 - Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.

CVE-2026-105240 - Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender

CVE-2026-105239 - Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apach

CVE-2026-105111 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-104714 - Concurrent execution using shared resource with improper synchronization ('race condition') vulnerab

CVE-2026-104713 - Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin.

CVE-2026-104712 - Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request param

CVE-2026-104711 - Improper neutralization of special elements used in an expression language statement ('Expression La

CVE-2026-59265 - A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a cra

CVE-2026-102795 - Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic

CVE-2026-96289 - Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thr

CVE-2026-96287 - Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affec

CVE-2026-96286 - Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift

CVE-2026-96277 - Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby

CVE-2026-94658 - Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affect

CVE-2026-94657 - Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings.

CVE-2026-94656 - Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings.

CVE-2026-94655 - Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerabili

CVE-2026-94654 - Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python binding

CVE-2026-85476 - Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib binding

CVE-2026-83745 - Memory allocation with excessive size value, Improper handling of length parameter inconsistency vul

CVE-2026-83663 - Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a r

CVE-2026-83632 - Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buf

CVE-2026-66859 - NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindin

CVE-2026-66858 - The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion li

CVE-2026-66837 - Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindi

CVE-2026-66331 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings

CVE-2026-66081 - Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affect

CVE-2026-66055 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, n

CVE-2026-66054 - Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (D

CVE-2026-63772 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.

CVE-2026-61374 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.

CVE-2026-96294 - Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJ

CVE-2026-96292 - Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apach

CVE-2026-96288 - Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache

CVE-2026-94653 - Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affect

CVE-2026-94652 - Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. T

CVE-2026-94648 - Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings.

CVE-2026-94646 - Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modifi

CVE-2026-94638 - Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.

CVE-2026-94637 - Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go b

CVE-2026-94636 - Improper handling of highly compressed data (data amplification), Function call with incorrectly spe

CVE-2026-92834 - Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSoc

CVE-2026-90440 - Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerab

CVE-2026-87117 - NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache T

CVE-2026-86537 - Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap

CVE-2026-86536 - Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerabil

CVE-2026-86535 - Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object

CVE-2026-85088 - Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift.

CVE-2026-85087 - Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python b

CVE-2026-85086 - Improper certificate validation, Initialization of a resource with an insecure default vulnerability

CVE-2026-82459 - Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bi

CVE-2026-82458 - Memory allocation with excessive size value, Allocation of resources without limits or throttling vu

CVE-2026-61373 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblo

CVE-2026-96990 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.

CVE-2026-94651 - improper handling of exceptional conditions, Missing release of resource after effective lifetime vu

CVE-2026-94650 - Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache

CVE-2026-94645 - Improper validation of specified quantity in input, Allocation of resources without limits or thrott

CVE-2026-94644 - Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.

CVE-2026-94642 - Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift:

CVE-2026-94633 - Memory allocation with excessive size value, Improper handling of length parameter inconsistency vul

CVE-2026-93926 - Missing release of memory after effective lifetime, Missing release of resource after effective life

CVE-2026-93925 - Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ T

CVE-2026-91137 - Improper validation of specified quantity in input, Allocation of resources without limits or thrott

CVE-2026-91135 - Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an applicati

CVE-2026-85494 - Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Com

CVE-2026-85493 - Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affec

CVE-2026-85483 - Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bin

CVE-2026-94639 - improper handling of exceptional conditions, Allocation of resources without limits or throttling, U

CVE-2026-94635 - Allocation of resources without limits or throttling, Improper handling of length parameter inconsis

CVE-2026-94634 - Allocation of resources without limits or throttling, Initialization of a resource with an insecure

CVE-2026-103885 - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using t

CVE-2026-103880 - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password us

CVE-2026-103878 - Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A Sta

CVE-2026-103877 - Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised

CVE-2026-103552 - Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a de

CVE-2026-102731 - Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicio

CVE-2026-93546 - Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV c

CVE-2026-79768 - Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir mod

CVE-2026-73637 - Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on

CVE-2026-73636 - Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP

CVE-2026-63718 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling

CVE-2026-63686 - A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.

CVE-2026-63292 - Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server thro

CVE-2026-63045 - Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache

CVE-2026-59797 - Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-

CVE-2026-59685 - Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 n

CVE-2026-58415 - Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apac

CVE-2026-57941 - Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy

CVE-2026-56449 - Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response

CVE-2026-56154 - Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:.

CVE-2026-56153 - Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Ap

CVE-2026-48005 - Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server be

CVE-2026-47360 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod

CVE-2026-46729 - NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener

CVE-2026-42528 - A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permi

CVE-2026-42356 - Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal r

CVE-2026-94276 - Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with

CVE-2026-94269 - Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In som

CVE-2026-94250 - Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apach

CVE-2026-94220 - Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache A

CVE-2026-94212 - Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthentica

CVE-2026-88789 - Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-s

CVE-2026-82806 - Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apac

CVE-2026-78242 - Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerabili

CVE-2026-92899 - Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reu

CVE-2026-88920 - An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote

CVE-2026-85532 - Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. T

CVE-2026-94053 - Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 t

CVE-2026-94052 - A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2

CVE-2026-94029 - Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, componen

CVE-2026-94002 - Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA

CVE-2026-93996 - Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or

CVE-2026-93995 - Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0

CVE-2026-93994 - Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configure

CVE-2026-77185 - Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.

CVE-2026-102511 - Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementa

CVE-2026-102510 - Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation w

CVE-2026-102509 - Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolle

CVE-2026-102508 - Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA d

CVE-2026-97395 - Apache Polaris allows an authenticated principal with permission to create or update Iceberg table p

CVE-2026-81569 - An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticat

CVE-2026-78214 - An authentication bypass vulnerability exists in the protection of Actuator endpoints. The applicati

CVE-2026-71899 - A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache Dolp

CVE-2026-71898 - An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only r

CVE-2026-71897 - An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the b

CVE-2026-82804 - The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization

CVE-2026-66083 - The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An

CVE-2026-102497 - The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitutio

CVE-2026-102496 - Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema

CVE-2026-102495 - Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious

CVE-2026-86843 - The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Par

CVE-2026-81930 - Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields

CVE-2026-92142 - Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based a

CVE-2026-91085 - Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.

CVE-2026-91048 - The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard

CVE-2026-91012 - org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "con

CVE-2026-96740 - A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties

CVE-2026-101292 - Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStrea

CVE-2026-91006 - Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to lau

CVE-2026-86507 - Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store

CVE-2026-91206 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-91204 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82546 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82387 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82386 - Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog adminis

CVE-2026-82385 - Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog ad

CVE-2026-82384 - Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker t

CVE-2026-82383 - Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote

CVE-2026-82382 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82381 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82380 - Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-

CVE-2026-82379 - Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a val

CVE-2026-82378 - Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an un

CVE-2026-82377 - Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete

CVE-2026-82376 - Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entr

CVE-2026-82375 - Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-ed

CVE-2026-82348 - Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user

CVE-2026-93302 - MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affe

CVE-2026-100717 - froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl reje

CVE-2026-100669 - Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matche

CVE-2026-92573 - Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and

CVE-2026-92564 - A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially

CVE-2026-92560 - A pre-authentication attacker could leverage type size/count handling to cause excessive allocation

CVE-2026-92550 - A pre-authentication attacker could leverage type size/count handling to cause excessive allocation

CVE-2026-92609 - Session fixation in HTTP management authentication allows remote attackers to gain unauthorized acce

CVE-2026-92608 - Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows

CVE-2026-57590 - A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The

CVE-2026-93352 - Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .ph

CVE-2026-86247 - Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate veri

CVE-2026-86246 - Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled

CVE-2026-86243 - Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious

CVE-2026-87022 - Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket

CVE-2026-86350 - Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in

CVE-2026-86248 - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled v

CVE-2026-79677 - Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability i

CVE-2026-78437 - Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends

CVE-2026-78383 - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauth

CVE-2026-77791 - Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close m

CVE-2026-77762 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerab

CVE-2026-77756 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Ap

CVE-2026-76183 - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constrai

CVE-2026-75973 - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured w

CVE-2026-73581 - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenS

CVE-2026-96443 - Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve r

CVE-2026-94251 - A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/

CVE-2026-94243 - A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin eviden

CVE-2026-92001 - Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability i

CVE-2026-91999 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-91928 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-91852 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-73192 - An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vul

CVE-2026-31377 - An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an un

CVE-2026-82331 - Improper link resolution before file access ('link following') vulnerability in the `tar` source plu

CVE-2026-89282 - The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation

CVE-2026-89281 - The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuratio

CVE-2026-70410 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in

CVE-2026-73511 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-86473 - Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token co

CVE-2026-82355 - When a request to the Airflow core API carries both a session cookie and an explicit `Authorization:

CVE-2026-75158 - Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no

CVE-2026-47321 - The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate

CVE-2026-84750 - The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or ext

CVE-2026-75157 - Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with

CVE-2026-50022 - Metacat is data repository software that helps researchers preserve, share, and discover data. Prior

CVE-2026-92230 - Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long

CVE-2026-87935 - The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to

CVE-2026-92580 - In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin

CVE-2026-87976 - Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bu

CVE-2026-86089 - Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Conn