Search: “apache”

CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

Apache ActiveMQ CVE-2026-74761: moderate clientId spoofing in RemoveSubscription handling, affecting Broker, All and apache-activemq, fixed in 6.3.2 and 5.19.11.

The Apache ActiveMQ team disclosed CVE-2026-74761, a moderate-severity spoofing issue in the handling of RemoveSubscription clientId. Affected components include ActiveMQ Broker (activemq-broker), ActiveMQ All (activemq-all) and Apache ActiveMQ in versions 6.0.0 before 6.3.2 and 5.x before 5.19.11. The flaw could allow a client to spoof another client's clientId when removing subscriptions. Users should upgrade to the 6.3.2 or 5.19.11 release lines or later.

oss-security·Sep 8, 15:48 UTC · 8d agoVulnerabilityCVE-2026-747611

CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

CVE-2026-49363 lets unauthenticated attackers subscribe to ActiveMQ Artemis CORE topology and harvest cluster node details pre-authentication.

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request before authentication, tracked as CVE-2026-49363. The flaw affects artemis-server in Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0. Apache rates the issue as moderate; impact is limited to information disclosure of topology data.

oss-security·Sep 10, 00:41 UTC · 6d agoVulnerability 7 sourcesCVE-2026-493631

Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Follow-up on oss-security asks why CVE-2026-82434, Apache Storm ZooKeeper credential disclosure to read-only users and logs, lacks a severity rating.

Gabriel Ravier replied to the oss-security disclosure thread for CVE-2026-82434, which affects Apache Storm Nimbus and Apache Storm Client. The vulnerability involves disclosure of the topology ZooKeeper credential to read-only users and to logs. The reply questions whether the CVE was filed without a severity rating or if it is simply missing from the listing. No exploitation details or affected versions are provided in the post.

oss-security·Sep 13, 19:51 UTC · 3d agoVulnerability 2 sourcesCVE-2026-82434

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security·Sep 14, 16:02 UTC · 2d agoVulnerabilityCVE-2026-87802

CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.

CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:59 UTC · 2d agoVulnerabilityCVE-2026-87785

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Apache Syncope's JEXL template engine permits one-hop navigation past the JexlContextBuilder name denylist, enabling administrator-driven information disclosure.

CVE-2026-77883 is a moderate-severity exposure of sensitive information through data queries in Apache Syncope's syncope-core-provisioning-api module. An administrator can bypass the JexlContextBuilder name denylist using one-hop JEXL navigation to reach sensitive data. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:47 UTC · 2d agoVulnerabilityCVE-2026-778831

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.

Francesco Chicchiriccò posted a low-severity advisory for CVE-2026-77181, an Incorrect Authorization vulnerability in Apache Syncope's syncope-core-am-logic module. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. An administrator holding the ClientApp update entitlement finds it is not applied as expected. No exploitation is reported and the issue is rated low severity.

oss-security·Sep 14, 15:45 UTC · 2d agoVulnerabilityCVE-2026-77181

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.

Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security·Sep 14, 15:23 UTC · 2d agoVulnerabilityCVE-2026-73195

CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.

Apache Syncope disclosed CVE-2026-73191, a moderate-rated open redirect vulnerability in the Syncope SRA. When the SRA is configured for CAS authentication, the target Apereo CAS service URL can be manipulated through Forwarded HTTP headers, redirecting users to an untrusted site. The flaw affects syncope-sra in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed releases.

oss-security·Sep 14, 15:21 UTC · 2d agoVulnerabilityCVE-2026-73191

CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Apache Nutch CVE-2026-41869 (moderate) lets unauthenticated users force shutdown or interrupt jobs via the Nutch Server REST API; fixed in 1.23.

A missing authorization and improper resource shutdown flaw in the Nutch Server REST API allows unauthenticated users to force a shutdown or interrupt running jobs. Apache Nutch versions 1.10 through 1.22 are affected. Version 1.23 fixes the issue by removing the Nutch Server; where upgrading is not possible, administrators must restrict access to instances running Nutch Server.

oss-security·Sep 8, 15:29 UTC · 8d agoVulnerability 3 sourcesCVE-2026-41869

CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).

Apache NiFi 2.11.0 supports migrating version-controlled Process Group contents into a Connector via REST API methods that list eligible migration sources and submit migration requests. Both methods were authorized only against the target Connector, without evaluating user access to the involved Process Groups. The flaw, tracked as CVE-2026-86089, is rated Low severity and affects the nifi-web-api component.

oss-security·15:19 UTC · 6h agoVulnerability 3 sourcesCVE-2026-86089

CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.

CVE-2026-82617 affects Apache OpenNLP opennlp-core 3.0.0-M1 before 3.0.0-M6 and opennlp-tools 2.0.0 before 2.5.12. The DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL patterns in RegexNameFinderFactory contain ambiguous nested quantifiers. Applications using these built-in finders on attacker-controlled input can be forced into regular expression denial of service or stack exhaustion. Fixes shipped in opennlp-tools 2.5.12 and 3.0.0-M6.

oss-security·Sep 11, 19:24 UTC · 5d agoVulnerability 2 sourcesCVE-2026-826171

CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Apache Parquet Hadoop CVE-2026-73334: a file-controlled KMS URL reaches pluggable KmsClients without host validation in parquet-java 1.12 through 1.18.0.

Apache disclosed CVE-2026-73334, a moderate issue in the org.apache.parquet.crypto.keytools package of parquet-java, versions 1.12 through 1.18.0. The package implements envelope encryption that wraps data keys via a Key Management Service. A KMS URL controlled by the Parquet file is forwarded to a pluggable KmsClient that skips host validation, which could allow crafted files to redirect KMS requests.

oss-security·Sep 8, 15:46 UTC · 8d agoVulnerabilityCVE-2026-733341

CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.

CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.

oss-security·Sep 13, 14:42 UTC · 3d agoVulnerabilityCVE-2026-824411

CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Apache Storm Logviewer ignores logs.users and logs.groups ACLs for daemon logs, letting unauthorized users read sensitive logs.

CVE-2026-82437 (severity: moderate) affects Apache Storm Logviewer (storm-webapp) versions 3.0.0 before 3.1.0. The Logviewer offers logs.users and logs.groups settings for operators to control who may read log content, but for daemon logs the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer. As a result, configured access controls were not enforced and unauthorized users could read daemon log content.

oss-security·Sep 13, 14:37 UTC · 3d agoVulnerabilityCVE-2026-82437

AgentGG: Open-source agentic SAST scanner

Help Net Security·Jun 5, 00:00 UTC · Jun 5, 2026Vulnerability

AlmaLinux 9.5 released: Security updates, new packages, and more!

Help Net Security·Nov 19, 00:00 UTC · Nov 19, 2024Vulnerability1