Apache DolphinScheduler versions prior to 3.4.1 contain an incorrect authorization vulnerability that allows authenticated users with system login permissions to use tenants not defined on the platform during workflow execution. This issue is fixed in version 3.4.1.
Apache ActiveMQ versions before 5.19.6 and from 6.0.0 before 6.2.5 contain a code injection vulnerability via the admin web console. An authenticated attacker can craft a malicious broker name that bypasses validation, leading to loading a remote Spring XML application and arbitrary code execution on the broker's JVM. Upgrading to versions 5.19.6 or 6.2.5 mitigates this issue.
Apache ActiveMQ versions before 5.19.6 and from 6.0.0 before 6.2.5 contain a cross-site scripting (XSS) vulnerability in the web console. An authenticated attacker can inject malicious HTML content by overriding the content type and injecting HTML into a JMS selector field, potentially leading to script execution in the user's browser. The issue is fixed in versions 5.19.6 and 6.2.5.
Apache ActiveMQ contains an improper input validation and code injection vulnerability that allows an authenticated attacker to bypass previous fixes by adding a connector using an HTTP Discovery transport via Jolokia if the activemq-http module is present. This can lead to arbitrary code execution on the broker's JVM through Spring XML application context loading before configuration validation. The issue affects versions before 5.19.6 and from 6.0.0 before 6.2.5. Upgrading to versions 5.19.6 or 6.2.5 mitigates the vulnerability.
Apache DolphinScheduler versions 3.2.0 up to but not including 3.3.1 contain a Deserialization of Untrusted Data vulnerability in the RPC module. This flaw allows attackers with access to Master or Worker nodes to send malicious RPC requests that exploit unsafe deserialization, potentially compromising the system. The issue is fixed in version 3.3.1.
H2O-3 versions prior to 3.46.0.10 have a critical remote code execution vulnerability in the unauthenticated REST API endpoint /99/ImportSQLTable. The flaw is due to insufficient parameter blacklist controls that only target MySQL JDBC driver parameters, allowing attackers to bypass protections by using PostgreSQL JDBC driver parameters. This enables unauthenticated attackers to execute arbitrary code with the privileges of the H2O-3 process. The vulnerability is fixed in version 3.46.0.10.
Silverpeas Core contains a reflected cross-site scripting (XSS) vulnerability in its AdvancedSearch functionality. This flaw allows attackers to inject and execute arbitrary JavaScript code in the context of a user's browser when crafted input is processed. The vulnerability affects versions up to and including 6.4-feature13197. The CVSS score is 6.1, indicating a medium severity level.
An LDAP injection vulnerability (CVE-2026-0636) exists in the Legion of the Bouncy Castle Inc. BC-JAVA bcprov library, specifically in the LDAPStoreHelper program files. This flaw affects versions 1.74 through 1.80.1, 1.81, and 1.82 through 1.83. The vulnerability allows improper neutralization of special elements in LDAP queries. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 base score is 6.5, indicating a medium severity impact with potential confidentiality and integrity loss but no availability impact. Red Hat has issued security advisories with patches available for affected products.
A covert timing channel vulnerability exists in the Bouncy Castle BC-JAVA core library affecting the FrodoKEM algorithm during decryption. This flaw arises from non-constant time comparisons that may leak private keys. Versions from 1.71 up to but not including 1.80.2, 1.81 up to but not including 1.81.1, and 1.82 up to but not including 1.84 are affected. The vulnerability allows an unauthenticated remote attacker to send malformed ciphertexts and perform statistical timing analysis to potentially recover private keys. Fixed versions include 1.80.2, 1.81.1, and 1.84. The CVSS v3.1 score is 7.5 (high severity).
A command injection vulnerability exists in the Emissary framework (CVE-2026-35582) due to unvalidated IN_FILE_ENDING and OUT_FILE_ENDING configuration keys. These values are concatenated into temporary file paths without sanitization and then substituted directly into shell commands executed via /bin/sh -c, allowing arbitrary OS command execution by a place author. No additional runtime privileges or network access are required. The vulnerability affects Emissary versions prior to 8.43.0 and is fixed in version 8.43.0.
The Apache Log4j 1-to-Log4j 2 bridge's Log4j1XmlLayout fails to escape XML 1.0 forbidden characters, resulting in malformed XML output. This causes conforming XML parsers to reject the logs with fatal errors, potentially leading to loss or failure to index log records in downstream systems. The issue affects users who use Log4j1XmlLayout directly or via the Log4j 1 compatibility layer with XMLLayout. The vulnerability is fixed in version 2.25.4 of the bridge, which users are advised to upgrade to. The bridge is deprecated and will be removed in Log4j 3.
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CVE-2026-35581 is a command injection vulnerability in the Executrix utility class of the Emissary project. The vulnerability arises because the PLACE_NAME configuration parameter is sanitized only by replacing spaces with underscores, allowing shell metacharacters to pass through into commands executed via /bin/sh -c. This enables an attacker with the ability to control configuration values to execute arbitrary commands on the host. The issue is fixed in Emissary release 8.39.0 by applying an allowlist regex that replaces all non-alphanumeric, non-underscore, and non-hyphen characters with underscores.
Emissary versions prior to 8.39.0 contain a stored cross-site scripting (XSS) vulnerability in the navigation template. The vulnerability arises because navigation link URLs are interpolated into href attributes without validating the URL scheme, allowing an administrator to inject javascript: URIs. Authenticated users who click such malicious links can execute arbitrary scripts in their browser context, potentially leading to session hijacking and actions performed on their behalf. Exploitation requires administrative access to modify navigation configuration and user interaction. The issue is fixed in version 8.39.0 by adding server-side URL scheme validation and template hardening.
A vulnerability in Undertow allows remote attackers to craft HTTP requests with header names parsed inconsistently between Undertow and upstream proxies. This discrepancy enables HTTP request smuggling attacks that can bypass security controls and access unauthorized resources. The flaw affects versions prior to 2.2.40.Final and versions from 2.3.0.Final up to but not including 2.3.25.Final. Fixes are available in versions 2.2.40.Final and 2.3.25.Final. Red Hat has issued security advisories with patches for affected JBoss Enterprise Application Platform versions.
Undertow, a web server component, is vulnerable to HTTP request smuggling via a flaw triggered by sending '\r\r\r' as a header block terminator. This vulnerability affects certain versions of Undertow and can be exploited when used with some proxy servers like older Apache Traffic Server and Google Cloud Classic Application Load Balancer. Exploitation may lead to unauthorized access or manipulation of web requests. A patch is available in versions 2.3.25.Final and 2.2.40.Final.
Undertow, a web server component, is vulnerable to HTTP request smuggling due to improper handling of HTTP headers that start with leading spaces. This flaw allows remote attackers to bypass security controls, access restricted information, or manipulate web caches. The vulnerability affects versions prior to 2.2.40.Final and versions from 2.3.0.Final up to but not including 2.3.25.Final. A high-severity fix is available and has been released by Red Hat in their JBoss Enterprise Application Platform 8.1 updates.
A vulnerability in Keycloak's SAML broker endpoint allows unauthorized access due to improper validation of encrypted SAML assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can craft a malicious SAML response to inject an encrypted assertion for an arbitrary principal, potentially leading to unauthorized access and information disclosure. This issue affects multiple versions of the Keycloak SAML adapter core and has a high severity rating.
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
Red Hat has released security updates for the Red Hat build of Keycloak 26.2.14 to address multiple vulnerabilities related to SAML authentication. These include authentication bypasses caused by disabled SAML clients and Identity Providers, as well as unauthorized access due to improper validation of encrypted SAML assertions. The updates align with the standalone Keycloak product release and are intended for use within OpenShift Container Platform deployments.