CVE-2026-105425 is an OS command injection vulnerability in Ivanti Sentry and Ivanti EPMM products. It affects versions prior to 10.7.4, 10.8.3, and 11.0.0 of Ivanti Sentry, and versions prior to 12.10.0.1, 12.9.0.3, and 12.8.0.5 of Ivanti EPMM. A remote attacker with administrative privileges can exploit this flaw to execute arbitrary commands on the affected system.
CVE-2026-124036 is an authorization bypass vulnerability in FlockOS, a hosted public safety platform by Flock. The flaw existed in the visual alert feature prior to the fix date of 2026-09-28. Authenticated users with permission to manage saved searches within their own organization could exploit this vulnerability to access, modify, or delete saved-search alerts belonging to other organizations if they knew the alert identifier. They could also change alert recipients and create alerts attributed to other organizations. Flock remediated this issue in the hosted service on 2026-09-28, and no customer action is required.
Eclipse Kura versions 5.4.0 through 5.6.2 contain an improper privilege management vulnerability in the Identity REST APIs. Authenticated users with the rest.identity permission, but without administrative rights, can escalate their privileges to full administrator by assigning permissions to themselves or others, changing passwords, deleting identities, and modifying permissions. This flaw allows attackers to lock out legitimate administrators. The issue is resolved in version 5.6.3.
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including credentials and invocation data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Apache TomEE's embedded Derby network service ignores its configured bind address and listens on all network interfaces. This allows remote attackers with network access to connect to the database server and read or modify data. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE versions from 4.0.0-beta-1 through 4.7.5, 7.0.0-M1 through 10.0.0-M1, 10.0.0-M1 through 10.3.0, and 11.0.0-M1 through 11.0.0-M2 contain a vulnerability where the EJBd remote protocol exposes datasource connection details, including database credentials, to remote clients. This allows remote clients with access to the EJBd endpoint to retrieve database credentials and connect directly to the database. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
CVE-2026-108187 is an origin validation error vulnerability in Zoom Workplace for Windows that allows an unauthenticated attacker to escalate privileges via network access. The flaw affects versions prior to 7.1.5 and has a high severity rating with a CVSS score of 8.1. A fix is available in version 7.1.5.
Apache TomEE versions using the embedded HTTP server to serve Hessian remoting endpoints silently ignore configured authentication and transport security. This allows remote unauthenticated attackers to invoke exposed EJB methods without credentials or encryption. The issue affects deployments relying on the embedded HTTP server rather than Tomcat. Users should block network access to Hessian endpoints from untrusted clients or migrate to a different remoting protocol.
Apache TomEE versions using the Hessian protocol to expose EJBs may silently bypass configured authentication and transport security settings, allowing remote unauthenticated attackers to invoke exposed EJB methods. This affects deployments that use the Hessian module with such configurations. Users are advised to restrict network access to Hessian endpoints or migrate to other remoting protocols. A fix is available starting from version 10.0.0-M1.
CVE-2026-97874 is an improper authentication vulnerability in Apache TomEE when using Hessian remoting with BASIC authentication. The authentication check is bypassed for Hessian endpoints of applications deployed under a non-root context path, allowing remote unauthenticated attackers to invoke exposed EJB methods without credentials. Users are advised to restrict network access to these endpoints or migrate to a different remoting protocol.
CVE-2026-121683 is a critical vulnerability in Ivanti Cloud Services Application version 5.0.8 where missing authentication allows a remote unauthenticated attacker to add and delete trusted EPM Core certificate entries.
CVE-2026-97880 is an improper authentication vulnerability in Apache TomEE's embedded OpenEJB HTTP server. The server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials, allowing remote unauthenticated attackers to bypass authentication and invoke protected resources. This affects only deployments using the embedded HTTP server with Basic authentication. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
CVE-2026-97881 is a path traversal vulnerability in the embedded OpenEJB HTTP server component of Apache TomEE. This flaw allows a remote unauthenticated attacker to read arbitrary files accessible to the server process by exploiting insufficient restrictions on static resource paths. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions. The vulnerability affects multiple versions of Apache TomEE prior to 10.0.0-M1, with fixes available starting from 10.0.0-M1.
CVE-2026-108186 is a critical vulnerability in Zoom Communications' Zoom Workplace for Windows. It involves improper input validation that may allow an unauthenticated attacker to escalate privileges via network access. The flaw affects versions 7.1 up to but not including 7.1.8. A fix is available in version 7.1.8.
Apache TomEE's embedded HTTP server does not clear the security identity between requests, allowing a remote unauthenticated attacker to have their request processed with the privileges of a previously authenticated user. This affects applications using programmatic or basic authentication with the embedded server. Users are advised to block untrusted network access or migrate to Tomcat-based TomEE distributions.
Apache TomEE's embedded HTTP server does not invalidate the previous session identifier when the session ID changes, such as after user login. This session fixation vulnerability allows an attacker who can set a session ID in a victim's browser to hijack the victim's authenticated session. Users are advised to restrict network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
CVE-2026-111239 is a missing authorization vulnerability in Apache TomEE's optional SSH administration service. The service grants full administrative shell access to any user authenticated in its configured login domain without verifying administrative privileges. This allows attackers with any user credentials in that domain, including low-privileged users, to execute arbitrary code as the server process. Users are advised to disable the SSH administration service or restrict its access to trusted administrative users only.
A vulnerability in Apache TomEE's JDBC based JAAS login module allows authentication without a password for accounts with NULL stored passwords. An attacker who knows such a username can authenticate as that user and obtain their roles. This affects deployments using this login module with NULL passwords in the user table. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.