Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann backs splitting oss-security so Apache CVE floods do not bury the main list.
20
Organization
Apache Software Foundation
- Mentions · 7d0
- Mentions · 30d118
- All mentions224
- First seenAug 12, 2026
- Last mentioned13d ago
Timeline
224 articles · newest firstCVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.
42
CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Apache Answer User Center sessions can ignore central account suspension or deletion until they expire.
40
CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
Apache Answer through 2.0.2 let authenticated users modify non-public content they should not access.
42
CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Revoked Apache Answer sessions kept access to private uploads via stale visit tokens through 2.0.2.
41
CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Apache Answer through 2.0.2 lets authenticated users view metadata of non-public questions.
32
CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
Moderate Apache Answer flaw can expose comments on non-public content via public profiles.
28
CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Unauthenticated users can pull hidden-question metadata from Apache Answer public profiles.
36
CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Apache Answer through 2.0.2 lets global API keys read answers on non-public questions.
38
CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup
Apache Answer through 2.0.2 leaks invited-user lists for non-public questions.
28
CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Apache Answer email-code confusion through 2.0.2 may allow account takeover.
46
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Apache Answer through 2.0.2 lets unpin-only users hide or show questions.
24
CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion
Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.
22
CVE-2026-108833: Apache Kylin: default startup profile miss security settings
Apache Kylin’s default startup profile omits security settings in versions 4.0.0 through 5.0.4.
18
CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement
Apache Kylin 4.0.0–5.0.4 may allow unauthenticated replacement of job metadata if services are exposed.
36
CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue
Apache Kylin 4.0.0–5.0.4 has a minor JDBC validation flaw fixed in 5.0.5.
24
CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection
Apache Kylin 4.0.0–5.0.4 allows SparkSQL injection via table names, fixed in 5.0.5.
36
CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Apache Kylin’s broadcast API lacks authentication and allows polymorphic deserialization through 5.0.4.
40
CVE-2026-108766: Apache Kylin: missing JDBC-config authorization
Apache Kylin 4.0.0 through 5.0.4 lacks JDBC-config authorization; users should upgrade to 5.0.5.
41
CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF
Apache Kylin 4.0.0 through 5.0.4 has a moderate job-driver SSRF flaw, fixed in 5.0.5.
34
CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass
Apache Kylin 4.0.0 through 5.0.4 has a moderate metadata-backup path bypass, fixed in 5.0.5.
32
CVE-2026-108743: Apache Kylin: spark job OS command injection
Apache Kylin 4.0.4 through 5.0.4 has a moderate OS command injection in Spark jobs.
42
CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Apache Kylin 4.0.4 through 5.0.4 can broadcast metadata without authentication on internal networks.
36
CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Apache Kylin through 5.0.4 lets unauthorized users read the SQL blacklist.
44
CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation
Apache Kylin 4 through 5.0.4 lets unauthorized users manipulate jobs across projects; upgrade to 5.0.5.
36
CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard
Apache Kylin 4 through 5.0.4 allows unauthorized actors to discard jobs across projects; fixed in 5.0.5.
34
CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup
Unauthenticated users can trigger Apache Kylin metastore cleanup on versions 4 through 5.0.4; patch is 5.0.5.
38
CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env
Apache Kylin CVE-2026-68572 allows unauthorized SQL execution in the Spark SQL environment.
46
CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass
Apache Kylin CVE-2026-68571 lets crafted JDBC URLs bypass whitelist checks and inject code.
40
CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints
Apache Kylin 5.0.0–5.0.4 cache APIs lack authentication and allow SQL injection.
62
CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization
Apache Kylin through 5.0.4 can unsafely deserialize Java data from a broken Redis cache.
44
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
42
CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure
Low-privilege users can read Apache Kylin system configuration through version 5.0.4.
46
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
Apache Airflow Keycloak logout fails to end sessions because middleware reissues an unrevoked JWT.
44
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Apache Airflow's async SFTP hook disables SSH host-key checks by default, enabling machine-in-the-middle attacks.
40
CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Apache Airflow SSH and SFTP hooks accept any server key by default, allowing machine-in-the-middle attacks.
42
CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
Apache Airflow's Keycloak provider before 0.11.1 lets any team member read every team's audit logs.
52
CVE-2026-92120: Apache Allura: Oauth1 Replay Attack
Apache Allura is affected by a low-severity OAuth1 replay attack tracked as CVE-2026-92120.
16
CVE-2026-92119: Apache Allura: REST API Mass Assignment
Apache Allura has a moderate-severity REST API mass-assignment flaw, CVE-2026-92119.
26
CVE-2026-92116: Apache Allura: OAuth1 missing callback validation
Apache Allura OAuth1 callback validation flaw CVE-2026-92116 is rated important.
40
Related CVEs
by mentions- CVE-2026-1047111%9.8OGNL injection in Apache Struts legacy REST mapper
- Client-Certificate Authentication Bypass via OCSP Soft-Fail in Apache Tomcat
- CVE-2026-412932%9.8Improper Input Validation vulnerability in Apache Tomcat
- HTTP/2 Request Smuggling Regression in Apache Tomcat 9, 10.1 and 11
- Race condition in Apache Struts leaks dates across users
- WebSocket Async Write Timeout DoS in Apache Tomcat
- Denial of Service in Apache Tomcat WebSocket Close Message Handling
- Cross-Application Authentication Bypass in Apache Tomcat
- Unbounded request-body DoS in Apache Struts REST plugin
- Certificate Revocation Check Bypass in Apache Tomcat TLS
Appears with
- Apachevendor · 136
- Apache Software Foundationvendor · 82
- Apache HTTP Serverproduct · 21
- Apache Kylinproduct · 21
- Apache Rollerproduct · 18
- Apache Tomcatproduct · 12
- Apache Answerproduct · 11
- Apache CXFproduct · 11
- Apache DolphinSchedulerproduct · 10
- Apache Airflowproduct · 7
- Apache log4netproduct · 6
- Apache Directory LDAP APIproduct · 6
- Apache Qpid Broker-Jproduct · 6
- Apache Strutsproduct · 6
- Apache APISIXproduct · 6
- Apache MINA SSHDproduct · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.