Search: “apache”

29 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 556 Exploit / PoC 203 Malware 164 Ransomware 147 Data breach 67 Research 54 Industry 50 Threat actor 49 Policy & legal 33 AI tools & infra 30 Model release 17 Phishing & fraud 15 Advisory 12 Tools 11

SeverityAll critical 707 high 313 medium 210 low 135 info 67

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 7d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462

U.S. CISA adds Microsoft .NET Framework, Apache OFBiz, and Paessler PRTG Network Monitor flaws to its Known Exploited Vulnerabilities catalog

Security AffairsFeb 5, 15:03 UTC · Feb 5, 2025Exploit / PoC in the wildCVE-2024-45195 CVE-2024-29059 CVE-2018-9276+1 CVEs

CISA adds Apache Superset bug to its Known Exploited Vulnerabilities catalog

Security AffairsJan 9, 18:33 UTC · Jan 9, 2024Exploit / PoC in the wildCVE-2023-27524 CVE-2023-38203 CVE-2023-29300+3 CVEs1

Quebec shuts down thousands of sites as disclosure of the Log4Shell flaw

Security AffairsDec 12, 20:27 UTC · Dec 12, 2021Exploit / PoC CVE-2021-44228

U.S. CISA adds Microsoft Windows, Apache HugeGraph-Server, Oracle JDeveloper, Oracle WebLogic Server, and Microsoft SQL Server bugs to its Known Exploited Vulnerabilities catalog

Security AffairsSep 19, 15:48 UTC · Sep 19, 2024Exploit / PoC in the wildCVE-2024-27348 CVE-2020-0618 CVE-2019-1069+2 CVEs

CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog

Security AffairsMay 24, 10:25 UTC · May 24, 2024Exploit / PoC in the wildCVE-2020-17519

PoC exploit for Carpe Diem Apache bug released

Help Net SecurityApr 9, 00:00 UTC · Apr 9, 2019Exploit / PoC CVE-2019-0211

CISA adds TP-Link, Apache, and Oracle bugs to its Known Exploited Vulnerabilities catalog

Security AffairsMay 2, 07:11 UTC · May 2, 2023Exploit / PoC in the wildCVE-2023-1389 CVE-2021-45046 CVE-2021-44228+1 CVEs

Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol

Kaspersky SecurelistDec 14, 13:00 UTC · Dec 14, 2023Exploit / PoC CVE-2017-5638

Experts warn of attacks exploiting CVE-2021

Security AffairsNov 29, 15:18 UTC · Nov 29, 2021Exploit / PoC in the wildCVE-2021-40438

CISA adds 10 flaws to its Known Exploited Vulnerabilities Catalog

Security AffairsAug 29, 09:03 UTC · Aug 29, 2022Exploit / PoC in the wildCVE-2021-38406 CVE-2021-31010 CVE-2022-26352+7 CVEs

HackDHS program accepts reports of Log4j

Security AffairsDec 23, 10:04 UTC · Dec 23, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046

AI Runs the Hack: Chinese Actor Automates Cyberattacks With DeepSeek

Security AffairsAug 3, 15:53 UTC · Aug 3, 2026Exploit / PoC in the wildCVE-2026-33017 CVE-2026-3055 CVE-2026-399871

U.S. CISA adds Adobe ColdFusion and Oracle Agile PLM flaws to its Known Exploited Vulnerabilities catalog

Security AffairsJul 6, 19:48 UTC · Jul 6, 2026Exploit / PoC in the wildCVE-2017-3066 CVE-2024-20953 CVE-2025-24989

⚡ Weekly Recap: Instagram Account Hacks, Android Zero

The Hacker NewsJun 9, 05:53 UTC · Jun 9, 2026Exploit / PoC in the wildCVE-2025-48595 CVE-2026-28318 CVE-2026-39210+43 CVEs

Attackers exploit recently disclosed Palo Alto Networks PAN

Security AffairsFeb 15, 15:27 UTC · Feb 15, 2025Exploit / PoC in the wildCVE-2025-0108

PAN-OS authentication bypass hole plugged, PoC is public (CVE-2025-0108)

Help Net SecurityFeb 13, 00:00 UTC · Feb 13, 2025Exploit / PoC CVE-2025-0108 CVE-2024-0012 CVE-2024-9474+2 CVEs

CISA adds Ruckus bug and another six flaws to its Known Exploited Vulnerabilities catalog

Security AffairsMay 16, 19:39 UTC · May 16, 2023Exploit / PoC in the wildCVE-2023-25717 CVE-2021-3560 CVE-2014-0196+4 CVEs1

Most attackers lose interest in Log4Shell

The RecordJan 17, 00:00 UTC · Jan 17, 2023Exploit / PoC in the wildCVE-2021-44228

Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”

Cisco TalosSep 17, 15:09 UTC · Sep 17, 2019Exploit / PoC CVE-2017-10271 CVE-2017-5638

Hackers exploit Jenkins flaw CVE-2018

Security AffairsMay 9, 05:02 UTC · May 9, 2019Exploit / PoC CVE-2018-1000861