Live threat intelligence radar

CVE-2026-121653 is a critical SQL injection vulnerability in the Core component of Ivanti Endpoint Manager versions before 2024 SU8. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected system. The vulnerability has a CVSS score of 9.8, indicating a high severity with full confidentiality, integrity, and availability impact.

CVE-2026-11316 is a high-severity out-of-bounds write vulnerability in the dr_wav component of dr_libs version 0.14.5. It occurs in the drwav__read_cue_to_metadata_obj function when processing specially crafted .wav files. An attacker can exploit this by providing a malicious .wav file, potentially causing memory corruption with high impact on confidentiality, integrity, and availability.

CVE-2026-11315 is an out-of-bounds read vulnerability in the dr_mp3 drmp3_init_internal function of dr_libs version 0.7.3. This flaw can be triggered by processing a specially crafted .mp3 file, potentially causing memory to be read beyond its intended bounds. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-111244 is an authorization vulnerability in Apache TomEE affecting MicroProfile JWT role-based access control. It causes access constraints on JAX-RS resources to be improperly enforced, allowing unauthorized access to resources that should be restricted. This includes cases where resources with empty allowed role sets are accessible to all callers, shared constraints across inherited methods, and ignored superclass-level constraints. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

Apache TomEE versions 10.0.0-M1 through before 10.3.0 and 11.0.0-M1 through before 11.0.0-M2 contain a vulnerability where a negative MicroProfile JWT clock skew setting disables validation of token expiration and other time-based claims. This allows an attacker possessing an expired token to authenticate successfully. The issue is fixed in versions 10.3.0 and 11.0.0-M2.

Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 have a vulnerability in MicroProfile JWT authentication where the security state for a request is not always cleared from the processing thread if the request does not complete normally. This can allow a remote attacker with a valid token to cause unrelated requests on the same thread to execute with elevated run-as identity privileges. Upgrading to versions 10.3.0 or 11.0.0-M2 mitigates this issue.

CVE-2026-111241 is a vulnerability in Apache TomEE where passivated stateful session beans are stored in predictably named temporary files in a shared system directory. A local attacker with write access to this directory can read or manipulate these files, potentially causing the server to deserialize malicious data and execute arbitrary code. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

A vulnerability in Apache TomEE's JDBC based JAAS login module allows authentication without a password for accounts with NULL stored passwords. An attacker who knows such a username can authenticate as that user and obtain their roles. This affects deployments using this login module with NULL passwords in the user table. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.

CVE-2026-111239 is a missing authorization vulnerability in Apache TomEE's optional SSH administration service. The service grants full administrative shell access to any user authenticated in its configured login domain without verifying administrative privileges. This allows attackers with any user credentials in that domain, including low-privileged users, to execute arbitrary code as the server process. Users are advised to disable the SSH administration service or restrict its access to trusted administrative users only.

Apache TomEE's embedded HTTP server does not invalidate the previous session identifier when the session ID changes, such as after user login. This session fixation vulnerability allows an attacker who can set a session ID in a victim's browser to hijack the victim's authenticated session. Users are advised to restrict network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.