CVE-2026-92414 is a critical session fixation and session reuse vulnerability in Apache Jackrabbit's WebDAV server. The flaw allows the server to attach a cached authenticated session based solely on matching certain header tokens (Lock-Token, TransactionId, SubscriptionId, If-header) without verifying credentials. This can lead to session reuse across different users. Versions 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5 are affected. Fixed versions are 2.20.18, 2.22.5, and 2.23.6.
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.
The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".
This only affects install that have the non default LDAP group provider configured.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types.
The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
CVE-2026-93684 is a stored cross-site scripting (XSS) vulnerability in Apache Impala up to version 4.5.2. An SQL user with only SELECT permission can inject JavaScript code into a table alias, which executes in another user's browser when viewing the query plan in Impala's Web UI. This vulnerability allows limited impact on confidentiality and integrity but does not affect availability. Users are advised to upgrade to version 4.5.3 to remediate the issue.
CVE-2026-90466 is a relative path traversal vulnerability in Apache Impala versions 4.5.2 up to but not including 4.5.3. It allows an attacker to load a malicious JAR file via a relative path if the 'trusted_jar_paths' startup flag is configured with a non-empty value. The vulnerability is fixed in version 4.5.3.
CVE-2026-97720 is a critical vulnerability in Apache Impala versions 4.1.0 through 4.5.2 involving incorrect implementation of JWT/OAuth authentication. The flaw allows attackers to bypass signature validation of bearer tokens, enabling unauthorized access to resources served by the executor's webserver when JWT/OAuth authentication is enabled. The issue is fixed in version 4.5.3. Users are advised to disable JWT/OAuth authentication on Impala executors or upgrade to the patched version.
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
CVE-2026-94114 is a vulnerability in Apache Commons BCEL where symbolic names do not map to the correct objects. This occurs because BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing lookups and verification results to reference incorrect classes. The issue affects versions before 6.13.0. Users are advised to upgrade to version 6.13.0 to address this vulnerability.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.
CVE-2026-105244 is a medium severity vulnerability in Apache log4net's RemoteSyslogAppender where improper encoding or escaping of output causes non-ASCII and control characters to be removed rather than escaped. This can cause distinct input values to appear identical in logs, potentially misleading log analysis. The issue affects versions from 1.2.12 up to but not including 3.5.0. Upgrading to version 3.5.0 resolves the vulnerability.
CVE-2026-105242 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.11 up to but not including 3.5.0. It involves improper handling of exceptional conditions in the aspnet-request pattern converter. When request parameters trigger ASP.NET request validation and contain markup, the layout throws an exception causing the appender to discard the entire log event. This allows a sender to suppress logging of their own request. The issue only affects applications running on ASP.NET for .NET Framework that use the %aspnet-request layout pattern. Upgrading to version 3.5.0 resolves the vulnerability.
CVE-2026-105241 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.9 up to but not including 3.5.0. It involves improper handling of Unicode encoding in the SmtpPickupDirAppender component. Specifically, when the mail file writer encounters content it cannot encode, such as an unpaired UTF-16 surrogate, it throws an error causing all buffered events in the batch to be discarded and potentially leaving a truncated mail file in the pickup directory. This can allow an attacker who controls log message content to suppress logging of other events. The issue is fixed in version 3.5.0.
CVE-2026-105240 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.9 up to but not including 3.5.0. It involves improper neutralization of null byte characters in the OutputDebugStringAppender on Windows platforms. When a null byte appears in logged content, it prematurely terminates the debug output record, causing loss of subsequent log data including exception details. This allows an attacker who can influence log messages to hide parts of the log record. The issue is fixed in version 3.5.0.
CVE-2026-105239 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.9 up to but not including 3.5.0. It involves improper neutralization of null byte characters in the EventLogAppender on Windows. A null byte in logged content prematurely ends the Windows Event Log record, causing subsequent data such as exception text and trailing fields to be omitted silently. This allows data that reaches the log message to hide the rest of that log record. The issue is fixed in version 3.5.0.
CVE-2026-104714 is a race condition vulnerability in Apache Struts affecting versions from 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The flaw occurs when localized messages format date or time arguments using a shared formatter without proper synchronization, leading to potential data leakage between users or server errors. Versions 6.12.0 and 7.4.0 include fixes for this issue.
CVE-2026-104713 is a resource allocation vulnerability in the Apache Struts REST plugin. The plugin reads request bodies into memory without limiting their size, allowing a single request to consume excessive Java heap memory. This can lead to denial of service by exhausting server resources. The vulnerability affects multiple Apache Struts versions, and fixed versions are available.
An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts that allows an unauthenticated remote attacker to exhaust server CPU and outbound network capacity by sending low-volume requests. This occurs when a request parameter is bound to a BigDecimal property and rendered through the Struts tag library, producing a disproportionately large response. The vulnerability affects specific versions of Apache Struts and is fixed in versions 6.12.0 and 7.4.0.