Threat database

1,432 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	8.6	EPSS 0.7%	CVE-2026-58182Apache Traffic Server · Uncontrolled Resource Consumption High8.6EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58182 The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-400	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58181Apache Traffic Server · Stack-based Buffer Overflow High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58181 The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-121	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58180Apache Traffic Server · Stack-based Buffer Overflow High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58180 The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-121	CVE Database V5	2026-07-29
High	8.1	EPSS 0.6%	CVE-2026-58179Apache Traffic Server · Stack-based Buffer Overflow High8.1EPSS 0.6%2026-07-29CVE Database V5CVE-2026-58179 The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.6%Vulnerability Apache Software Foundation #cwe-121	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58178Apache Traffic Server · Uncontrolled Recursion High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58178 The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-674	CVE Database V5	2026-07-29
High	8.1	EPSS 0.6%	CVE-2026-58177Apache Traffic Server · Out-of-bounds Write High8.1EPSS 0.6%2026-07-29CVE Database V5CVE-2026-58177 CVE-2026-58177 is a high severity vulnerability in Apache Traffic Server's Cripts framework involving out-of-bounds write, path traversal, and use-after-free errors. It affects versions from 10.0.0 through 10.1.3. The issue can lead to partial confidentiality and integrity loss, and high availability impact. Users are advised to upgrade to version 10.1.4, which addresses the vulnerability. EPSS 0.6%Vulnerability Apache Software Foundation #cwe-787	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58175Apache Traffic Server · Missing Release of Memory after Effective Lifetime High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58175 Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-401	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58164Apache Traffic Server · Use After Free High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58164 Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-416	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58163Apache Traffic Server · Deserialization of Untrusted Data High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58163 Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-502	CVE Database V5	2026-07-29
Critical	10.0	EPSS 0.4%	CVE-2026-58162Apache Traffic Server · Improper Certificate Validation Critical10.0EPSS 0.4%2026-07-29CVE Database V5CVE-2026-58162 The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.4%Vulnerability Apache Software Foundation #cwe-295	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-58161Apache Traffic Server · NULL Pointer Dereference High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-58161 Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-476	CVE Database V5	2026-07-29
Critical	9.8	EPSS 0.6%	CVE-2026-59243Apache Airflow FAB provider · Improper Verification of Cryptographic Signature Critical9.8EPSS 0.6%2026-07-29CVE Database V5CVE-2026-59243 The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`. EPSS 0.6%Vulnerability Apache Software Foundation #cwe-347	CVE Database V5	2026-07-29
Medium	6.5	EPSS 0.6%	CVE-2026-58160Apache Traffic Server · Out-of-bounds Read Medium6.5EPSS 0.6%2026-07-29CVE Database V5CVE-2026-58160 Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.6%Vulnerability Apache Software Foundation #cwe-125	CVE Database V5	2026-07-29
High	8.2	EPSS 0.6%	CVE-2026-58159Apache Traffic Server · Incorrect Authorization High8.2EPSS 0.6%2026-07-29CVE Database V5CVE-2026-58159 Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.6%Vulnerability Apache Software Foundation #cwe-863	CVE Database V5	2026-07-29
Medium	5.9	EPSS 0.6%	CVE-2026-58158Apache Traffic Server · Stack-based Buffer Overflow Medium5.9EPSS 0.6%2026-07-29CVE Database V5CVE-2026-58158 Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.6%Vulnerability Apache Software Foundation #cwe-121	CVE Database V5	2026-07-29
High	8.7	EPSS 0.5%	CVE-2026-58157Apache Traffic Server · Exposure of Sensitive Information to an Unauthorized Actor High8.7EPSS 0.5%2026-07-29CVE Database V5CVE-2026-58157 Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.5%Vulnerability Apache Software Foundation #cwe-200	CVE Database V5	2026-07-29
Medium	4.9	EPSS 0.4%	CVE-2026-58156Apache Traffic Server · Incorrect Authorization Medium4.9EPSS 0.4%2026-07-29CVE Database V5CVE-2026-58156 Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.4%Vulnerability Apache Software Foundation #cwe-863	CVE Database V5	2026-07-29
Critical	9.3	EPSS 0.5%	CVE-2026-58155Apache Traffic Server · Inconsistent Interpretation of HTTP Requests Critical9.3EPSS 0.5%2026-07-29CVE Database V5CVE-2026-58155 Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.5%Vulnerability Apache Software Foundation #cwe-444	CVE Database V5	2026-07-29
High	8.9	EPSS 0.5%	CVE-2026-58154Apache Traffic Server · Out-of-bounds Write High8.9EPSS 0.5%2026-07-29CVE Database V5CVE-2026-58154 Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.5%Vulnerability Apache Software Foundation #cwe-787	CVE Database V5	2026-07-29
High	7.5	EPSS 0.7%	CVE-2026-65324Apache Traffic Server · Uncontrolled Resource Consumption High7.5EPSS 0.7%2026-07-29CVE Database V5CVE-2026-65324 Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. EPSS 0.7%Vulnerability Apache Software Foundation #cwe-400	CVE Database V5	2026-07-29

Showing 681–700 of 1,432 results