Apache Pinot before 1.6.0 can read unauthorized tables (CVE-2026-73322)
With broker access control on, lookup() can name a dimension table that the FROM-clause check never authorizes.
48
Vendor
Apache
- Mentions · 7d22
- Mentions · 30d147
- All mentions247
- First seenAug 17, 2026
- Last mentioned8h ago
Timeline
247 articles · newest firstApache Fineract through 1.15.0 has SQL injection in ORDER BY (CVE-2026-65874)
Caller-supplied orderBy, sortOrder and related parameters are concatenated on Center and datatable read APIs.
52
Apache Fineract Search API SQL injection fixed scope unclear (CVE-2026-64618)
The flaw is in outStandingAmountPercentageCondition on the advanced search HTTP endpoint through version 1.15.0.
52
JSON array proof of concept shows parser resource exhaustion
The authors say Apache Struts2 JSON Plugin changes through S2-072 still do not stop maximised comma-array consumption.
42
Apache Struts2 JSON plugin insecure deserialization report continues
Daniel Owens cites earlier Struts2 JSON denial-of-service write-ups and a naïve proof-of-concept script; this excerpt ends before new details.
48
Qpid Proton C through 0.40.0 can overflow on bad TLS wildcards
Apache rates the stack read overflow low and says only non-RFC9525 wildcard certificates trigger it; 0.41.1 fixes it.
32
Qpid Proton C through 0.40.0 can treat AMQP frames as SASL
Apache calls the flaw important: peers can send regular AMQP frames that Proton dispatches as SASL, with no username set.
58
Apache Qpid Proton C through 0.40.0 can crash on nested AMQP bodies
Deeply nested message bodies decoded by pn_message_body() can overflow the stack; 0.41.1 fixes PROTON-2976.
44
Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)
pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.
48
Kafka Streams can hang on punctuation integer overflow (CVE-2026-111496)
A record timestamp near Long.MAX_VALUE can overflow the next punctuation time and stall a StreamThread.
32
Kafka deserializers can exhaust memory from a size field (CVE-2026-111551)
Apache calls the flaw important: a small input can declare a huge size and force a large allocation.
52
Kafka brokers can OOM on tagged-field counts (CVE-2026-111115)
Flexible-protocol readers keep a RawTaggedField per unknown field, with the count limited only by the request frame.
54
Kafka PushTelemetry decompression can OOM a broker (CVE-2026-111073)
Only the compressed size is checked against telemetry.max.bytes, default 1 MB, before an unbounded decompress.
46
Apache Kafka brokers can run out of memory from protocol arrays (CVE-2026-111108)
Code-generated readers size arrays from a sender-declared count checked only against remaining buffer bytes.
58
Kafka skips JWT signature checks when JWKS URL is unset (CVE-2026-110985)
DefaultJwtValidator verifies signatures only if sasl.oauthbearer.jwks.endpoint.url is set; that setting is unset by default.
64
Kafka OAuth JWT issuer and audience checks off by default (CVE-2026-110952)
The bundled JWKS validator always checks the signature, but iss and audience checks need explicit settings.
48
Kafka FetchSnapshot bug lets privileged clients crash KRaft (CVE-2026-83525)
Authenticated clients with CLUSTER_ACTION can terminate the controller using an empty-topics FetchSnapshotRequest.
36
Apache Camel patches XXE, deserialization, and credential flaws
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
62
Airflow SSH provider before 7.0.1 runs environment values as shell
SSHRemoteJobOperator quotes templated environment values only once inside an already-quoted wrapper, so $(...) runs remotely.
42
Apache Camel flaws allow remote code execution and data theft
Eight critical and high issues span Camel K and Camel components, with fixes that differ by branch.
64
Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
68
Apache Traffic Server fixes multiple flaws in 9.2.16, 10.1.5 and 10.2.1
An oss-security forward of Apache's October 20 note names CVE-2026-111813, but this excerpt omits each flaw's impact.
52
Apache Vysper authorization bypass lets users compromise accounts
Every Vysper version lacks an XEP-0077 authentication check; Apache rates it important at CVSS 8.8 and unsupported when assigned.
46
Apache Vysper XML parsing can exhaust memory on all versions
CVE-2026-115721 is an unauthenticated network denial of service scored CVSS 7.5; the retired project will not be fixed.
38
Apache Camel CoAP can leak data in error messages (CVE-2026-101259)
Unmuted consumer exceptions in camel-coap can expose sensitive information to unauthenticated remote users; CVSS is 5.3.
48
Camel AWS2-S3 treats untrusted keys as expressions (CVE-2026-95664)
A low-privileged attacker can inject expressions through the CamelAwsS3Key header; the CVSS score is 5.4.
50
Camel Keycloak accepts expired tokens from unbounded cache (CVE-2026-95663)
Cached introspection results are not limited by token expiry, so expired access tokens can still be accepted.
42
Camel Docling output path header allows arbitrary writes (CVE-2026-95629)
A low-privileged caller can steer conversion output to an arbitrary directory through an unvalidated header.
44
Camel Docling still accepts absolute CLI paths (CVE-2026-95628)
Path checks added after CVE-2026-40047 do not reject absolute paths supplied as custom CLI arguments.
44
Apache Camel OAuth cache reuses tokens across scopes (CVE-2026-94386)
camel-oauth from 4.19.0 before 4.22.2 can reuse client-credentials bearer tokens; CVSS 3.1 is 4.8.
48
Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)
camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.
58
Apache Abdera XXE in Atom parsing (CVE-2026-113582)
All Apache Abdera versions are affected and unsupported; CVSS 4.0 is 8.7 with high confidentiality impact.
46
Atlassian October bulletin lists 176 flaw entries in Jira and Confluence
Critical scores are third-party library ratings; Atlassian says its product risk is lower and not immediately critical.
58
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
Apache Pulsar Manager missing auth leaks admin credentials (CVE-2026-105944)
The Apache Pulsar PMC says the end-of-life manager lacks authentication and authorization and can expose Pulsar admin credentials.
52
Apache Pulsar fixes 14 CVEs in 4.0.14, 4.2.5, and 5.0.0
The Pulsar PMC posted a combined advisory, but the excerpt omits the individual CVE ids and affected ranges.
46
Apache IoTDB legacy sendFile RPC allows unauthenticated RCE (CVE-2026-59562)
Apache rates the legacy pipe sendFile flaw important; the notice gives no versions or fix.
58
Apache IoTDB legacy pipe lets SYSTEM users act as root (CVE-2026-59229)
Versions 2.0.0 before 2.0.11 run load and delete operations with a hardcoded root identity.
52
Apache IoTDB pipeTransfer() auth bypass disclosed (CVE-2026-58663)
The oss-security note rates the flaw important and does not list versions or a fix.
58
IoTDB JDBC driver memory exhaustion fixed in 2.0.11 (CVE-2026-41114)
Versions from 1.3.3 before 2.0.11 can exhaust memory via BigDecimal toPlainString.
36
Related CVEs
by mentions- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- Auth bypass in Apache Tomcat JNDIRealm with non-GSSAPI SASL
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2026-1047111%9.8OGNL injection in Apache Struts legacy REST mapper
- HTTP/2 request/response mix-up in Apache Tomcat async servlets
- CVE-2026-88900<1%8.8Unsafe Java deserialization RCE in Apache Camel JGroups
- Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an…
- Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently
- Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat
Appears with
- Apache Software Foundationorganization · 136
- Apache Tomcatproduct · 24
- Apache Kylinproduct · 21
- Apache Camelproduct · 11
- Apache CXFproduct · 11
- Apache Strutsproduct · 11
- Apache DolphinSchedulerproduct · 10
- Microsoftvendor · 9
- Apache Rollerproduct · 8
- Apache Kafkaproduct · 8
- Apache Artemisproduct · 7
- CISAorganization · 7
- Apache Answerproduct · 7
- Apache Qpid Broker-Jproduct · 6
- Apache Impalaproduct · 6
- Citrixvendor · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.