CVE-2026-107460 - Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (In

CVE-2026-92120 - OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: th

CVE-2026-92119 - REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: throug

CVE-2026-92116 - OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: thro

CVE-2026-85499 - Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplet

CVE-2026-103636 - Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketche

CVE-2026-103635 - Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: dat

CVE-2026-103513 - Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: dat

CVE-2026-103501 - Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketche

CVE-2026-104021 - The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to,

CVE-2026-103413 - Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, K

CVE-2026-103412 - Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apac

CVE-2026-97791 - In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate

CVE-2026-97468 - Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens und

CVE-2026-86463 - Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query express

CVE-2026-79650 - Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after s

CVE-2026-78384 - CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A

CVE-2026-73179 - Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code

CVE-2026-108039 - By default, StaxUtils placed no limit on the total number of elements or the total number of charact

CVE-2026-107938 - In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not v