CVE-2026-111812 is a critical authorization vulnerability in Apache Traffic Server's origin_server_auth plugin. It allows a client to force the proxy to sign attacker-chosen AWS request headers using the proxy's own credentials. This flaw affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1. The vulnerability has a CVSS score of 10.0, indicating critical severity.
Apache Traffic Server's experimental tsmemcache plugin has a critical vulnerability (CVE-2026-111811) that allows unauthenticated network users to read, write, and delete the shared proxy cache. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and exactly 10.2.0. The vulnerability is due to missing authentication for critical functions in the plugin. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
A high-severity vulnerability (CVE-2025-55702) affects Trafficserver versions including multiple Ubuntu package builds from 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1. The issue involves handling of POST requests with the Expect: 100-continue header and the origin header, potentially leading to a critical impact on confidentiality and integrity without requiring privileges or user interaction.
CVE-2026-111816 is a critical HTTP request/response smuggling vulnerability in Apache Traffic Server. The issue arises from the server forwarding a malformed 302 response that should have been rejected due to a parsing error. However, a Transfer-Encoding: chunked carve-out bypassed the rejection path, causing the server to store and serve a response that peers interpret differently. This discrepancy allows cache poisoning and response-framing desynchronization attacks. The vulnerability affects Apache Traffic Server versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2025-31699 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when the server returns an origin connection to the shared pool while the origin is still waiting on a request body that the client declared but never fully sent, including cases using Expect: 100-continue. This allows the origin to misinterpret subsequent requests as leftover body data, enabling attackers to smuggle requests past access controls, disrupt other users' requests, or poison the cache. The issue affects multiple versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server's experimental magick plugin contains an argument injection vulnerability (CWE-88) that allows unauthenticated clients to control ImageMagick convert arguments in its default unsigned configuration. This affects versions from 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-78119 is a vulnerability in the Zephyr project's Nuvoton NPCX eSPI driver affecting versions 3.6.0 up to but not including 4.5.0. The flaw involves improper bounds checking when parsing Target-Attached-Flash (TAF) requests, allowing out-of-bounds writes and reads in the eSPI controller memory. This can lead to controller crashes, hangs, or corruption of driver state that controls flash protection. The vulnerability requires host firmware or bus-level control to exploit and is not reachable by ordinary host software. A fix is available in Zephyr version 4.5.0 that adds proper bounds checking and rejects invalid requests. No in-tree board enables the vulnerable feature by default.
CVE-2026-78116 is a use-after-free vulnerability in the Broadcom AFBR-S50 time-of-flight sensor driver within Zephyr OS versions 4.3.0 up to but not including 4.5.0. The flaw occurs when sensor data evaluation fails, causing the same RTIO submission to be completed twice, leading to memory corruption and potential loss of availability. The issue can be triggered by environmental sensor conditions without requiring software or physical access. A fix is available in Zephyr version 4.5.0.
CVE-2026-105942 is an authorization vulnerability in Apache Pulsar affecting versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5. The flaw allows a proxy role to authorize requests on behalf of another user (the original principal) incorrectly, potentially granting elevated permissions if the proxy's token includes superuser or tenant admin roles. Additionally, tenant admin checks may succeed based solely on the proxy role if it is a tenant admin, allowing unauthorized tenant administration. Fixed versions ensure both proxy and original principal are authorized correctly with their own credentials.
CVE-2026-105938 is an authorization bypass vulnerability in Apache Pulsar affecting subscription-related admin REST API operations. Certain namespace-level and bundle-level operations, such as clearing backlog, unsubscribing, and expiring messages for subscriptions, did not enforce subscription-level authorization policies properly. This allows authenticated users with consume permission on a namespace or topic to perform these operations on subscriptions they are not authorized to access. The vulnerability impacts the integrity of subscription state by allowing unauthorized clearing or expiring of message backlogs and deletion of subscriptions without requiring tenant admin or superuser privileges. It does not allow reading message contents or affect broker availability. The issue is fixed in Apache Pulsar versions 4.0.14 and 4.2.5.
CVE-2026-105937 is a missing authorization vulnerability in Apache Pulsar's shadow topic feature. It allows an authenticated user with tenant admin role in their own tenant to create or update shadow topics bound to source topics in other tenants without authorization on those source topics. This can lead to unauthorized reading of retained messages and unintended deletion of source topic ledger data. The issue affects Apache Pulsar versions from 3.0.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions disable shadow topics by default and require superuser role for cross-tenant shadow topic binding.
CVE-2026-113461 is a local privilege escalation vulnerability in Checkmk version 2.5.0p14. It affects systems where a local user has write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself. If the Checkmk agent has the 'mk-oracle' plugin enabled, an attacker can execute code with root privileges.
Apache Pulsar contains a missing authorization vulnerability in its Pulsar Functions worker REST API. Specifically, the deprecated functions connectors endpoints allow any authenticated user to read the catalog of installed Pulsar IO connectors without requiring super-user access, even when authorization is enabled. This exposure is limited to metadata disclosure of connector type definitions and does not allow modification or management of connectors. The issue affects versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions require super-user access for these endpoints, aligning with the worker connectors endpoint's authorization checks.
Apache Pulsar versions from 2.0.0-rc1-incubating before 4.0.14 and from 4.1.0 before 4.2.5 have a missing authorization vulnerability in the Functions Worker REST API trigger endpoint. Authenticated users authorized to manage functions in a namespace can cause the Functions Worker to publish messages to input topics they are not authorized to produce to, potentially affecting data integrity. The issue is fixed in versions 4.0.14 and 4.2.5.
CVE-2026-105934 is a missing authorization vulnerability in Apache Pulsar's broker admin REST API truncate operation for partitioned topics. Authenticated users with lookup permission but without tenant admin rights can truncate partitioned topics, causing subscription cursors to move to the end and deleting inactive ledgers, potentially leading to message loss. The issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.
CVE-2026-105932 is a missing authorization vulnerability in Apache Pulsar's broker admin REST API for non-persistent topics. The API endpoints for managing topic-level entry filter policies on non-persistent topics do not properly enforce authorization checks, allowing authenticated users with produce or consume permissions—but without policy management rights—to read, modify, or remove these policies. This issue only affects deployments where entry filters are installed and topic-level overrides are enabled, both of which are disabled by default. The vulnerability affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5.
Apache Pulsar versions 2.8.0 through before 4.0.14 and 4.1.0 through before 4.2.5 contain a missing authorization vulnerability in the transaction administration REST API. Authenticated users without proper permissions can read transaction metadata and statistics across tenant boundaries if transaction support is enabled. The vulnerability does not permit modification of transactions or access to message contents. Transaction support is disabled by default, which limits exposure if not in use. Fixed versions are 4.0.14 and 4.2.5.
CVE-2026-105930 is an authorization vulnerability in Apache Pulsar affecting deployments with authentication, authorization, and package management enabled. It allows an authenticated user with permission to register or update functions, sources, or sinks in their own tenant namespace to access package contents stored in another tenant's namespace without having explicit package permissions there. The issue leads to disclosure of package contents, which may include sensitive application code or credentials, but does not allow modification or deletion of packages or affect service availability. The vulnerability affects Apache Pulsar versions from 2.8.0 before 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 before 4.2.5. Fixed versions are 4.0.14 and 4.2.5 and later.