Threats affecting pkg:generic/lucene

CVE-2026-71891 is a high severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The flaw impacts multiple packages and is fixed in Apache NiFi versions 2.11.0-r3 and 26.6.4-r8. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a significant risk. No known exploits are reported in the wild at this time.

CVE-2026-18036 is a high-severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts multiple packages and has been fixed in Apache NiFi versions 2.11.0-r3 and 26.6.4-r8. No known exploits are reported in the wild at this time.

CVE-2026-17508 is a medium severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts Apache NiFi versions prior to 2.11.0-r3 and 26.6.4-r8. A fix is available in these versions. No known exploits in the wild have been reported.

CVE-2026-71892 is a medium severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions prior to 1. The vulnerability impacts multiple packages and has a CVSS 4.0 base score of 6.9. Fixed versions are available in Apache NiFi 2.11.0-r3 and 26.6.4-r8.

CVE-2026-71889 is a high-severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts multiple packages and has been assigned a CVSS 4.0 base score of 8.7. Fixed versions are available in Apache NiFi 2.11.0-r3 and Bouncy Castle 26.6.4-r8.

CVE-2026-71888 is a high-severity vulnerability affecting Apache NiFi due to an issue in Bouncy Castle for Java versions before 1. The vulnerability impacts multiple packages and has been fixed in Apache NiFi version 2.11.0-r3 and Bouncy Castle version 26.6.4-r8. The CVSS 4.0 score is 8.7, indicating a significant security risk. No known exploits are reported in the wild at this time.

A security vulnerability identified as CVE-2026-102460 affects the Keycloak package in Eclipse Vert. The vulnerability has a CVSS score of 5.9, indicating medium severity, and impacts availability without affecting confidentiality or integrity. A fix is available in version 26.6.4-r8.

A security vulnerability identified as CVE-2026-102477 affects the Keycloak package in Eclipse Vert. The vulnerability impacts availability but does not affect confidentiality or integrity. A fix is available in version 26.6.4-r8.

A security vulnerability identified as CVE-2026-102467 affects the Keycloak package integrated with Eclipse Vert. The flaw impacts versions of Keycloak prior to 26.6.4-r8 and has a medium severity rating with a CVSS score of 5.9. The vulnerability does not affect confidentiality or integrity but has an impact on availability. A patch is available in version 26.6.4-r8 to address this issue.

CVE-2026-110879 is a critical vulnerability affecting multiple Kafka package versions. It involves jackson-databind's improper validation of class-name type IDs, where the outer class is validated but attacker-controlled classes inside generic arguments are accepted even if they violate declared types or would normally be rejected. This flaw allows remote attackers to potentially execute arbitrary code or cause denial of service.

A security vulnerability in Rundeck affects versions prior to 6.1.0-r5. The issue involves the ftp and scp tasks of Apache Ant, which can download files from a remote server. This vulnerability has a high severity score and allows unauthorized remote file downloads. A fix is available in Rundeck version 6.1.0-r5.

Apache NiFi versions prior to 2.11.0-r3 contain a high-severity vulnerability involving unsafe reflection due to externally-controlled input in Apache Calcite Avatica. This flaw allows an attacker with low privileges to execute arbitrary code by influencing class or code selection. The vulnerability is addressed in version 2.11.0-r3.

A path-traversal vulnerability exists in the Quality of Service (QOS) component of Apache NiFi versions prior to 2.11.0-r3. This vulnerability could allow an unauthenticated attacker to access files outside the intended directory structure. The issue has been assigned CVE-2026-104721 and has a medium severity rating with a CVSS score of 6.3. A fix is available in version 2.11.0-r3.

A path-traversal vulnerability exists in the QOS component of Apache NiFi versions prior to 2.11.0-r3. This vulnerability allows unauthorized access to files outside the intended directory. The issue is addressed in Apache NiFi version 2.11.0-r3.

CVE-2026-93452 is a high-severity vulnerability affecting multiple packages including snappy-java versions up to but not including 1, and Kafka versions prior to 4.0.2-r6, 10.0.0-r12, and 2.11.0-r3. The vulnerability does not impact confidentiality or integrity but causes a high impact on availability. A patch is available in the specified fixed versions.

An information disclosure vulnerability exists in Apache NiFi versions prior to 2.11.0-r3 due to a missing ACL check in Apache ZooKeeper's SetWatches reconnect replay functionality. This flaw allows unauthorized disclosure of sensitive information without requiring user interaction or privileges. A high-severity CVSS 3.1 score of 7.5 has been assigned. The issue has been fixed in version 2.11.0-r3.

CVE-2026-56866 is a high-severity vulnerability affecting multiple Kubernetes packages. It involves an issue related to HTTP handling. The vulnerability allows an attacker to cause a high impact on confidentiality without requiring privileges or user interaction. Fixed versions are available for the affected packages.

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble",) request to an affected Apache NiFi instance. This vulnerability affects apache-nifi versions prior to 2.11.0-r3 and has a medium severity rating with a CVSS score of 5.3. A fix is available in version 2.11.0-r3.

CVE-2026-56857 is a critical vulnerability affecting Kubernetes on Windows platforms. It impacts multiple Kubernetes package versions prior to 1.34.11-r0, 1.34.13-r2, and 4.1.6-r1. The flaw allows for a high-severity compromise with full confidentiality, integrity, and availability impact. A patch is available in the specified fixed versions.

A security vulnerability in Apache NiFi affects versions prior to 2.11.0-r3 when audit logging is enabled for ZooKeeper. The vulnerability has a medium severity with a CVSS score of 5.3 and involves limited impact on integrity without affecting confidentiality or availability. A patch is available in version 2.11.0-r3 to address this issue.