CVE-2026-93879 is a security vulnerability affecting multiple packages, including keycloak and rundeck. The issue has been resolved in keycloak version 26.6.4-r8 and rundeck version 6.1.0-r5. Users running earlier versions are affected and should upgrade to the fixed releases to mitigate the vulnerability.
CVE-2026-76182 is a medium severity vulnerability affecting multiple Kafka package versions. It involves the Eclipse Jetty components `TryPathsHandler` and `TryFilesFilter`, which can be configured to forward requests to template URIs incorporating the request path. This behavior may lead to unintended request forwarding. Fixed versions are available.
CVE-2026-19864 is a vulnerability in Eclipse Jetty's SessionAuthentication component used by Kafka, where authentication credentials are retained in a serializable object. This could potentially expose sensitive authentication data. The issue affects multiple Kafka package versions prior to their respective fixed releases. A patch is available to address this vulnerability.
CVE-2026-97030 is a vulnerability in Kubernetes where a trusted template author may have created a valid template that improperly escapes the 'yield' keyword. This flaw affects multiple Kubernetes package versions prior to the fixed releases. The vulnerability has a medium severity with a CVSS score of 6.1, indicating limited confidentiality and integrity impact but no availability impact.
CVE-2026-18662 is a vulnerability in Eclipse Jetty affecting multiple versions of the jetty-security and jetty-eeN-security packages. The issue arises when two or more security constraints have the same http-method-omission set and no url-patterns, leading to improper combination of these constraints as per the Jakarta Servlet Specification. This flaw can impact the security enforcement of HTTP methods in affected Jetty versions.
CVE-2026-94448 is a vulnerability in Kubernetes affecting multiple packages where the context tracking state was not properly reset when a JavaScript template literal contains consecutive expressions. This flaw can lead to partial context confusion during template processing. The issue has been fixed in versions 1.34.11-r0, 1.34.13-r2, and 4.1.6-r1. The vulnerability has a medium severity with a CVSS score of 6.1, indicating limited impact on confidentiality and integrity without availability impact.
CVE-2026-18659 is a vulnerability in Eclipse Jetty affecting multiple packages including jetty-security, jetty-eeN-security, and jetty-eeN-servlet. The issue allows bypassing Jakarta Spec constraints defined as http-method-omission by using substrings of the defined HTTP methods. This flaw affects various versions of these packages and has been assigned a medium severity score of 6.9. Fixed versions are available.
CVE-2026-18660 is a high-severity vulnerability affecting multiple versions of Eclipse Jetty components used in Kafka, specifically jetty-server and jetty-proxy. The issue arises because the host whitelist/blacklist feature is case-sensitive, allowing hosts that differ only by case to bypass filtering controls. This flaw could lead to unauthorized access or bypass of intended host restrictions. Fixed versions are available for all affected releases.
CVE-2026-97031 is a vulnerability in Kubernetes where multiple Encrypted Client Hello (ECH) outer extension references are not permitted under RFC 9849. A client could previously send a specially crafted packet with multiple references, causing memory exhaustion in the server process. This issue affects certain Kubernetes versions prior to fixed releases and has a high severity rating.
CVE-2026-77711 is a high-severity vulnerability affecting Kafka when Jetty's HttpClient makes requests through a forward proxy. The server may respond with a 407 Proxy Authentication Required status, indicating an issue in handling proxy authentication. This affects multiple Kafka package versions prior to fixed releases.
CVE-2026-94440 is a vulnerability in Kubernetes multipart form parsing that allows bypassing memory limits and reading an arbitrarily long line into memory when the remaining memory limit at the start of a part is less than 400 bytes. This flaw can lead to denial of service by exhausting memory resources. Fixed versions are available.
CVE-2026-76184 is a high-severity vulnerability affecting multiple packages including Kafka, related to Eclipse Jetty's HttpClient handling of redirects of the form '/secure/'. The flaw is addressed in fixed versions of Kafka and other packages. The vulnerability has a CVSS 4.0 score of 8.2, indicating significant impact if exploited. No known exploits are reported in the wild. Patches are available and should be applied to mitigate the risk.
CVE-2026-94439 is a high-severity vulnerability in Kubernetes affecting multiple versions prior to 1.34.11-r0, 1.34.13-r2, and 4.1.6-r1. It occurs when an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request but does not hijack the connection, causing the server to improperly continue reading and serving requests on that connection.
A high-severity security vulnerability (CVE-2026-18661) affects the Rundeck package due to issues in Eclipse Jetty's handling of Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotations. This impacts various versions of jetty-annotations and jetty-eeN-annotations. The vulnerability is fixed in Rundeck version 6.1.0-r5.
CVE-2026-78667 is a high-severity vulnerability in Kubernetes affecting the FileServer(FS), ServeContent, and ServeFile(FS) components. It occurs when parsing a Range header containing a large number of small ranges, which can cause excessive CPU consumption. This can lead to denial of service conditions due to resource exhaustion. Fixed versions are available.
CVE-2026-97032 is a vulnerability in Gitea HTTP/2 servers where concurrent modification of the HPACK encoder can cause the server to crash. Multiple affected versions exist, and patches have been released to address the issue.
CVE-2026-78663 is a critical vulnerability in the Gitea HTTP/2 server where connection-level flow control can be refunded twice for the same data. This occurs once when a client resets a stream and again when the request handler reads buffered data, potentially leading to denial of service or other impacts. Multiple versions of Gitea prior to specific fixed releases are affected. A patch is available to address this issue.
CVE-2026-78669 is a vulnerability in Gitea where a malicious HTTP/2 peer can cause excessive CPU consumption on the client or server. This is achieved by opening many streams and sending numerous small SETTINGS frames with SETTINGS_INITIAL_WINDOW_SIZE values. The issue affects multiple versions of Gitea and has been assigned a high severity rating.
CVE-2026-78660 is a high-severity vulnerability in Gitea's HTTP/2 implementation related to lax handling of malformed framing-related headers. Although historically these malformed headers could not interfere with HTTP/2 framing, this issue allows for potential integrity impact. Multiple versions of Gitea prior to specific fixed releases are affected. A patch is available to address this vulnerability.
CVE-2026-78659 is a high-severity vulnerability in Gitea where the HTTP server uses client-sent "Trailer" headers to populate the Request internally. This flaw affects multiple Gitea package versions prior to their respective fixed releases. The vulnerability has a CVSS score of 7.5 with an impact on availability but no confidentiality or integrity loss reported. Fixed versions are available for all affected releases.