NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#osgi

0 stories this week · 0 this month · 2 in 6 months · mostly security

Stories per day · 30 days

2 stories, newest first · one card per story

oss-securitySep 28, 2026

CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf before 4.4.12 has a moderate command-injection flaw when unsanitized javaOpts launch child instances.

2 sources apache-karaf cve-2026-91006

1

oss-securitySep 17, 2026

CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

Apache Karaf versions before 4.4.11 pin bundle ClassLoaders in memory via static ThreadLocal caching, causing leaks (CVE-2026-92230, moderate).

apache-karaf cve-2026-92230

1