CVE-2026-66797 is an improper access control vulnerability in Apache CloudStack's annotation functionality. It allows any authenticated user to create and view annotations on entities they do not own by bypassing ownership checks. The flaw affects versions from 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
Apache CloudStack versions 4.20.3.0 and 4.22.1.0 contain a vulnerability in SAML authentication where improper verification of cryptographic signatures allows a malicious actor to forge SAML responses. This can enable unauthorized login if the attacker spoofs the IdP IP address or registers a URL with the management server. Fixed versions 4.20.3.1 and 4.22.1.1 address this issue.
CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong that allows any authenticated user, without requiring admin privileges, to make the InLong Manager server send outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This affects Apache InLong versions from 2.0.0 up to but not including 2.4.0. The issue is addressed in version 2.4.0 and can also be mitigated by applying the referenced patch from the Apache InLong GitHub repository.
CVE-2026-63043 is a Relative Path Traversal vulnerability in Apache InLong that allows arbitrary file read from the Agent host filesystem. It affects versions from 2.0.0 up to but not including 2.4.0. The vulnerability has a high severity with a CVSS score of 7.5. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.
CVE-2026-63042 is a vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. It allows any authenticated user with access to the manager interface to create, modify, and delete Data Node definitions due to files or directories being accessible to external parties. This issue is addressed in Apache InLong version 2.4.0.
CVE-2026-63040 is a vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. The issue arises because the StreamSource component does not perform authorization checks, allowing any authenticated user to logically delete all stream sources. This vulnerability has a high severity score of 8.1 and impacts integrity and availability without affecting confidentiality. Users are advised to upgrade to version 2.4.0 or apply the specific patch referenced in the vendor's pull request to remediate the issue.
CVE-2026-63039 is a critical SQL Injection vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. This flaw allows attackers to inject malicious SQL commands by improperly neutralizing special elements in SQL statements. The vulnerability is fixed in Apache InLong version 2.4.0. Users should upgrade to version 2.4.0 or apply the relevant patch to remediate this issue.
CVE-2026-63038 is a critical SQL Injection vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw allows attackers to inject arbitrary SQL code via the dbName, tableName, schemaName, and username parameters. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.
CVE-2026-63037 is a critical SQL injection vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw allows improper neutralization of special elements in SQL commands, specifically in the ORDER BY clause of the Manager backend database. Exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system. Users are advised to upgrade to Apache InLong version 2.4.0 or apply the recommended patch from the official Apache issue tracker.
Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/12095 https://github.com/apache/inlong/pull/11732
Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information.
This issue affects Apache InLong: from 2.0.0 before 2.4.0.
Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/12093 https://github.com/apache/inlong/pull/11732
Apache SkyWalking MCP version 0.1.0 contains a critical Server-Side Request Forgery (SSRF) vulnerability and a GraphQL expression injection issue. These vulnerabilities allow an attacker to manipulate server requests and inject malicious GraphQL expressions. The issue is fixed in version 0.2.0, which users are advised to upgrade to.
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected.
This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig.
This issue affects Apache Shindig: all versions.
Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field -- the Keycloak auth manager, for example, checks the `DAG` resource instead of `DAG:<team>` -- so the team-scoped permission that should gate the request was never consulted. In a deployment running multi-team mode with a team-aware auth manager, an authenticated user in one team could trigger Dag runs belonging to another team, supplying their own `dag_run_id` and `conf`, and could read another team's XCom values. Deployments using the FAB auth manager are unaffected, as it has no multi-team support. Users are advised to upgrade to apache-airflow 3.3.1 or later, which resolves the Dag's team at both sites.