CVE-2026-97881 is a path traversal vulnerability in the embedded OpenEJB HTTP server component of Apache TomEE. This flaw allows a remote unauthenticated attacker to read arbitrary files accessible to the server process by exploiting insufficient restrictions on static resource paths. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions. The vulnerability affects multiple versions of Apache TomEE prior to 10.0.0-M1, with fixes available starting from 10.0.0-M1.
CVE-2026-108186 is a critical vulnerability in Zoom Communications' Zoom Workplace for Windows. It involves improper input validation that may allow an unauthenticated attacker to escalate privileges via network access. The flaw affects versions 7.1 up to but not including 7.1.8. A fix is available in version 7.1.8.
Apache TomEE's embedded HTTP server does not clear the security identity between requests, allowing a remote unauthenticated attacker to have their request processed with the privileges of a previously authenticated user. This affects applications using programmatic or basic authentication with the embedded server. Users are advised to block untrusted network access or migrate to Tomcat-based TomEE distributions.
Apache TomEE's embedded HTTP server does not invalidate the previous session identifier when the session ID changes, such as after user login. This session fixation vulnerability allows an attacker who can set a session ID in a victim's browser to hijack the victim's authenticated session. Users are advised to restrict network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
CVE-2026-111239 is a missing authorization vulnerability in Apache TomEE's optional SSH administration service. The service grants full administrative shell access to any user authenticated in its configured login domain without verifying administrative privileges. This allows attackers with any user credentials in that domain, including low-privileged users, to execute arbitrary code as the server process. Users are advised to disable the SSH administration service or restrict its access to trusted administrative users only.
A vulnerability in Apache TomEE's JDBC based JAAS login module allows authentication without a password for accounts with NULL stored passwords. An attacker who knows such a username can authenticate as that user and obtain their roles. This affects deployments using this login module with NULL passwords in the user table. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
CVE-2026-18128 is a vulnerability in the Agent component of Ivanti Endpoint Manager prior to version 2024 SU8. It involves the cleartext transmission of sensitive information over HTTP, allowing a remote unauthenticated attacker in a man-in-the-middle (MITM) position to read and modify this traffic.
CVE-2026-111241 is a vulnerability in Apache TomEE where passivated stateful session beans are stored in predictably named temporary files in a shared system directory. A local attacker with write access to this directory can read or manipulate these files, potentially causing the server to deserialize malicious data and execute arbitrary code. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
CVE-2026-11315 is an out-of-bounds read vulnerability in the dr_mp3 drmp3_init_internal function of dr_libs version 0.7.3. This flaw can be triggered by processing a specially crafted .mp3 file, potentially causing memory to be read beyond its intended bounds. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-11316 is a high-severity out-of-bounds write vulnerability in the dr_wav component of dr_libs version 0.14.5. It occurs in the drwav__read_cue_to_metadata_obj function when processing specially crafted .wav files. An attacker can exploit this by providing a malicious .wav file, potentially causing memory corruption with high impact on confidentiality, integrity, and availability.
Apache TomEE versions prior to 10.3.0 and 11.0.0-M2 have a vulnerability in MicroProfile JWT authentication where the security state for a request is not always cleared from the processing thread if the request does not complete normally. This can allow a remote attacker with a valid token to cause unrelated requests on the same thread to execute with elevated run-as identity privileges. Upgrading to versions 10.3.0 or 11.0.0-M2 mitigates this issue.
Apache TomEE versions 10.0.0-M1 through before 10.3.0 and 11.0.0-M1 through before 11.0.0-M2 contain a vulnerability where a negative MicroProfile JWT clock skew setting disables validation of token expiration and other time-based claims. This allows an attacker possessing an expired token to authenticate successfully. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
CVE-2026-121653 is a critical SQL injection vulnerability in the Core component of Ivanti Endpoint Manager versions before 2024 SU8. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected system. The vulnerability has a CVSS score of 9.8, indicating a high severity with full confidentiality, integrity, and availability impact.
CVE-2026-111244 is an authorization vulnerability in Apache TomEE affecting MicroProfile JWT role-based access control. It causes access constraints on JAX-RS resources to be improperly enforced, allowing unauthorized access to resources that should be restricted. This includes cases where resources with empty allowed role sets are accessible to all callers, shared constraints across inherited methods, and ignored superclass-level constraints. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
CVE-2026-105813 is a vulnerability in Ivanti User Workspace Manager (UWM) versions before 2026.4 where sensitive information is stored in cleartext. This flaw allows a local authenticated attacker to retrieve another local user's session token, potentially leading to unauthorized access. The vulnerability has a medium severity rating with a CVSS score of 6.3.
CVE-2026-111245 is a vulnerability in Apache TomEE where after successful WS-Security UsernameToken authentication, the authenticated identity remains associated with the worker thread after request completion. This allows a remote unauthenticated attacker to reuse the thread and invoke protected EJB methods with the identity of a previously authenticated user. The issue affects multiple versions of Apache TomEE prior to fixed releases. Upgrading to versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.
Apache TomEE's embedded OpenEJB HTTP server does not properly isolate HTTP sessions between multiple web applications hosted on it. This allows a remote attacker to reuse a session established in one web application in another, potentially causing one application to trust session state set by another. This issue affects deployments running several web applications on the embedded HTTP server. Users are advised to block untrusted network access to the embedded HTTP server or migrate to TomEE distributions based on Tomcat.
CVE-2026-111247 is an incorrect authorization vulnerability in Apache TomEE where a user's name is incorrectly treated as a role name during authorization checks. An attacker who can register an account with a username matching a role name can gain unauthorized access to that role's permissions. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
NangoHQ's nango product versions before 0.71.3 contain an SQL injection vulnerability. This flaw allows unauthenticated attackers to execute arbitrary SQL commands by sending a crafted task group key to the orchestrator API endpoint POST /v1/immediate. The vulnerability arises because the TaskEventsHandler.notify() method interpolates the supplied group.key directly into a Postgres NOTIFY statement, enabling stacked queries against the scheduler database. The issue is fixed in version 0.71.3.
Aptabase version 0 contains an authentication bypass vulnerability due to the use of a publicly known default AUTH_SECRET. This flaw allows unauthenticated attackers to forge sign-in links, enumerate registered emails, impersonate users, export analytics data, and transfer app ownership. The vulnerability is fixed in commit 61d4c01298a706d575265461ac07bb956ca7b8d2.