ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “webapp”

7 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 40Vulnerability 14Ransomware 3Phishing & fraud 2Threat actor 1Malware 1Industry 1Data breach 1
SeverityAllcritical 7high 12medium 21low 23info 0

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Three CORS misconfigurations in Apache Storm 3.0.0 let malicious web pages from arbitrary origins read authenticated API responses.

CVE-2026-82438 (severity: important) affects Apache Storm Webapp (storm-webapp) versions 3.0.0 before 3.1.0. Three separate mechanisms allowed a web page on an unrelated origin to read responses served to authenticated users, including the Logviewer reflecting the request's Origin header in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials. This enables a malicious site to silently exfiltrate authenticated Storm API and log data from a victim's browser session.

oss-security · 3d agoVulnerabilityCVE-2026-824381

CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

Apache Storm Nimbus/UI 3.0.0 leaks unredacted merged daemon configuration through the topology page, exposing secrets to UI users.

CVE-2026-84179 (severity: important) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getTopologyPageInfo function merged the Nimbus daemon configuration with topology configuration and returned it unredacted in the topology_conf field of TopologyPageInfo, which the Storm UI copied verbatim. This can expose sensitive daemon configuration values to topology users.

oss-security · 3d agoVulnerabilityCVE-2026-84179

CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

Apache Storm Nimbus and UI return unredacted daemon configuration, including ZooKeeper and keystore secrets, to authorized users.

CVE-2026-82433 (rated moderate) affects Apache Storm Nimbus (storm-server) and Storm UI (storm-webapp) versions 3.0.0 before 3.1.0. The getNimbusConf operation returned the complete daemon configuration without redaction after only a user-level authorization check. Where configured, the response includes storm.zookeeper.auth.payload plus keystore and related secrets.

oss-security · 3d agoVulnerabilityCVE-2026-82433