Atlassian October bulletin covers 75 third-party product CVEs
Six unique flaws are rated critical, but Atlassian assesses non-critical customer risk and cites no exploitation.
2
Stories per day · 30 days
1 RSS
Relatedapache2path-traversal2rce2atlassian1authenticated1backup1collaborator1command-execution1confluence1continuous-testing1deserialization1execution-after-redirect1fips1globalprotect1groovy1jira1jstl1litellm1
11 stories, newest first · one card per story
Stories tagged #tomcat
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
Parasoft CTP 10.7.5-SNAPSHOT anonymous deserialization leads to command execution
Researchers say an anonymous database-restore deserialization in the em web app can run commands as uid=1000.
Tomcat Jasper JSTL omits page abort after redirect (CVE-2026-74049)
Mark Thomas rated the execution-after-redirect flaw low across listed Tomcat 7 through 11 builds; the excerpt names no fix.
[0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)
Authenticated Syncrify 6.2 path traversal can write cron jobs and execute commands as root.
[0day-rubbish] SmartBear Collaborator Server 15.1.15101 authenticated DOORS/Simulink review-file upload zip-slip to anonymous webroot Groovy Server Page execution as uid 1001 (7.5)
SmartBear Collaborator 15.1 zip-slip lets a low-privilege user enable anonymous code execution.
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
A Tomcat regression of the CVE-2026-41293 fix can mix HTTP/2 request headers.
CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Tomcat CVE-2026-76183 lets attackers bypass security constraints on any WebSocket endpoint.
CVE-2022-22965: Spring Core Remote Code Execution Vulnerability Exploited In the Wild (SpringShell) (Updated)
Attackers actively exploit Spring Framework RCE CVE-2022-22965 (SpringShell, CVSS 9.8) to deploy webshells; patches 5.3.18/5.2.20 shipped March 31, 2022.
9