Threat database

A high-severity security vulnerability (CVE-2026-71889) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts Keycloak versions prior to 26.8.1-r1. A fix is available in version 26.8.1-r1.

A high-severity security vulnerability (CVE-2026-71888) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. The flaw is fixed in Keycloak version 26.8.1-r1. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a significant impact if exploited. No known exploits are currently reported in the wild.

A high-severity security vulnerability (CVE-2026-71887) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts Keycloak versions prior to 26.8.1-r1. A fix is available in version 26.8.1-r1. No known exploits are reported in the wild.

A high-severity security vulnerability (CVE-2026-71886) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.8.1-r1. The vulnerability has a CVSS 4.0 score of 8.2, indicating a significant risk. A fix is available in version 26.8.1-r1.

A high-severity security vulnerability (CVE-2026-85515) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 1. The vulnerability is fixed in Keycloak version 26.8.1-r1. It has a CVSS 4.0 base score of 8.2, indicating a significant impact. No known exploits are reported in the wild. The vulnerability requires privileged access to exploit and does not involve user interaction.

A critical security vulnerability (CVE-2026-71885) affects the Keycloak package due to an issue in Bouncy Castle for Java versions before 26.8.1-r1. The flaw has a high CVSS 4.0 score of 9.2, indicating severe impact. A fix is available in version 26.8.1-r1.

CVE-2026-82458 is a high-severity vulnerability in the tempo package involving memory allocation with excessive size values and allocation of resources without limits or throttling. It affects multiple language bindings of Apache Thrift, including Go, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D. The flaw allows uncontrolled resource consumption, potentially leading to denial of service. Fixed versions are available.

A security vulnerability in Apache Superset affects versions prior to 6.1.0-r8. The issue involves the fast-xml-parser component, which allows users to process XML from JavaScript objects without relying on C/C++ based libraries or callbacks. This vulnerability has a CVSS score of 6.1, indicating a medium severity level. A fix is available in version 6.1.0-r8.

CVE-2026-45822 is a high-severity security vulnerability affecting the apache-superset package versions prior to 6.1.0-r8. The vulnerability is related to the decode-uri-component functionality. A fix is available in version 6.1.0-r8.

A high-severity security vulnerability exists in the apache-superset package prior to version 6.1.0-r8. The issue relates to the use of the decodeURIComponent function, which is less robust than the recommended decode-uri-component alternative. This vulnerability has been addressed in version 6.1.0-r8.

A security vulnerability was identified in the apache-superset package and has been resolved in version 6.1.0-r8. Versions prior to 6.1.0-r8 are affected. No specific details about the nature or impact of the vulnerability are provided.

A medium severity security vulnerability identified as CVE-2026-112910 affects the apache-superset package. The issue is resolved in version 6.1.0-r8 and later. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a local attack vector with low complexity, requiring low privileges and no user interaction, impacting confidentiality, integrity, and availability to a limited extent.

A security vulnerability has been identified in the apache-superset package related to the filelock component, which is a platform-independent file lock for Python. Versions prior to 6.1.0-r8 are affected. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity issue. It involves a local attack vector with low complexity and requires low privileges but no user interaction. The impact includes low confidentiality, high integrity impact, and no availability impact. A patch is available in version 6.1.0-r8.

A high-severity security vulnerability (CVE-2026-119197) affects the apache-superset package versions prior to 6.1.0-r8. The issue involves the pyasn1 component, which is a generic ASN. The vulnerability has an impact on availability but does not affect confidentiality or integrity. A fix is available in version 6.1.0-r8.

A high-severity security vulnerability (CVE-2026-119196) affects the apache-superset package versions prior to 6.1.0-r8. The issue involves the pyasn1 component, which is a generic ASN. The vulnerability has an impact on availability but does not affect confidentiality or integrity. A patch is available in version 6.1.0-r8.

A high-severity security vulnerability (CVE-2026-119195) affects the apache-superset package versions prior to 6.1.0-r8. The issue involves the pyasn1 component, which is a generic ASN. The vulnerability has no impact on confidentiality or integrity but results in a high impact on availability. A fix is available in version 6.1.0-r8.

A high-severity security vulnerability (CVE-2026-119194) affects the apache-superset package versions prior to 6.1.0-r8. The issue involves the pyasn1 component, which is a generic ASN. The vulnerability has an impact on availability but does not affect confidentiality or integrity. A patch is available in version 6.1.0-r8.

A security vulnerability was identified in the tempo package affecting versions prior to 3.1.1-r2. The issue has been resolved in version 3.1.1-r2. No specific details about the nature or impact of the vulnerability are provided.

A critical security vulnerability (CVE-2026-112393) affects the apache-superset package due to an issue in the Pillow Python imaging library. The flaw has a CVSS score of 9.8, indicating high severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability. Fixed versions 2021.38.2-r0 and 2021.36.5-r0 are available.

A high-severity security vulnerability was identified in the apache-superset package affecting versions prior to 2021.36.5-r0 and 2021.38.2-r0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a network exploitable issue with no required privileges or user interaction, and results in high impact on availability. The issue has been resolved in apache-superset versions 2021.36.5-r0 and 2021.38.2-r0.