Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

#apache — news, CVEs and analysis · ZeroHour

today 43 visits · 56 views · 7 reads·all time 17K views

06:59 UTC· 6m ago

Tag

#apache

49 stories this week · 108 this month · 110 in 6 months · mostly security

stories per day · 30 days

Related#denial-of-service 19 #syncope 17 #apache-roller 15 #tomcat 14 #authorization-bypass 11 #cve 10 #java 10 #xss 10 #vulnerability 8 #activemq 7 #artemis 7 #iam 7 #information-disclosure 7 #broker-j 6 #qpid 6 #websocket 6 #access-control 5 #amqp 5

54 stories, newest first · one card per story

1–24 of 54← Prev1 / 3Next →

oss-security·1d ago high

CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

#apache #apache-roller #deserialization

CVE-2026-82384

oss-security·2d ago

CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

#apache #qpid #broker-j

CVE-2026-92564

oss-security·2d ago

CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

#apache #dolphinscheduler #cve-2026-57590

CVE-2026-57590

GBHackers·3d ago high

Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks

#apache #tomcat #websocket

3 min

Cyber Security News·3d ago high

Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security

#apache #tomcat #websocket

3 min

oss-security·3d ago high

CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints

#apache #tomcat #websocket

CVE-2026-76183

oss-security·3d ago

CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

#apache #sling #xss

CVE-2026-91928

oss-security·3d ago high

CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

#apache-doris #cve-2026-31377 #authentication

CVE-2026-31377

oss-security·3d ago

CVE-2026-82331: Apache BuildStream: tar source extraction escape

#cve-2026-82331 #apache #buildstream

CVE-2026-82331

SANS Internet Storm Center·4d ago

The Truth about GET and HTTP Standards, (Tue, Sep 22nd)

#apache #http #nginx

Research

oss-security·8d ago

CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

#apache #denial-of-service #java

CVE-2026-91863

oss-security·10d ago high

CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing

#apache #cve-2026-76646 #denial-of-service

CVE-2026-76646

oss-security·10d ago high

CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

#apache #extension-bundles #java

CVE-2026-87976

oss-security·11d ago

CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

#apache #certificate-validation #cve

CVE-2026-59969

oss-security·11d ago high

CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

#acl #apache #cve

CVE-2026-59739

oss-security·12d ago

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

#apache #cve-2026-87802 #jwt

CVE-2026-87802

1

oss-security·12d ago

CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

#apache #cve-2026-86460 #cypher-injection

CVE-2026-86460

1

oss-security·12d ago

CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

#apache #cve-2026-82232 #jpa

CVE-2026-82232

oss-security·12d ago

CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

#apache #cve-2026-78336 #oidc

CVE-2026-78336

1

oss-security·12d ago

CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication

#apache #cve-2026-78330 #jwks

CVE-2026-78330

oss-security·12d ago

CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

#apache #console #cve-2026-78318

CVE-2026-78318

1

oss-security·12d ago

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

#apache #cve-2026-77883 #information-disclosure

CVE-2026-77883

2

oss-security·12d ago

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

#access-control #apache #authorization

CVE-2026-77181

oss-security·12d ago

CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable

#apache #audit-records #credential-leak

CVE-2026-75015

1