Apache HTTP Server version 2.4.66 contains a double-free vulnerability in the 'mod_http2' module that can lead to a denial of service condition. This vulnerability allows an attacker to cause the server to crash by triggering improper memory management in the HTTP/2 module. The issue affects specifically version 2.4.66 and has been classified with medium severity. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time.
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
Apache Shiro versions 1.0, 3.0.0-alpha, and up to 2.1.0 have a session fixation vulnerability in their default configurations. The issue occurs because existing sessions are not invalidated nor replaced with new session IDs upon successful login. This vulnerability allows an attacker to fixate a user's session ID, potentially leading to unauthorized session use. The vulnerability is fixed in Apache Shiro versions 2.1.1 and 3.0.0-alpha-2 or later.
Apache Syncope contains a vulnerability that allows exposure of sensitive information through crafted data queries. Specifically, an administrator with entitlements to manage Derived Schemas can create malicious JEXL expressions. These expressions enable any administrator with User read entitlements to access security-sensitive user information. The issue affects Apache Syncope versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Upgrading to versions 4.0.6 or 4.1.1 mitigates this vulnerability by restricting JEXL expression definitions.
Apache Syncope versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 contain an improper isolation vulnerability. An administrator with sufficient privileges can create malicious Groovy code that executes outside the intended sandbox, including static initializers. This can lead to unauthorized code execution with high impact on confidentiality, integrity, and availability. Fixed versions 4.0.6 and 4.1.1 enforce sandboxing even for static initializers in Groovy code.
Apache Airflow FAB Auth Manager has an LDAP injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. This affects versions prior to 3.6.4 of the apache-airflow-providers-fab package. The vulnerability has a medium severity with a CVSS score of 5.3. Users are advised to upgrade to version 3.6.4 or later. If upgrading immediately is not possible, disabling LDAP authentication is recommended until the provider is updated.
Apache Airflow Google provider versions before 22.0.0 have a vulnerability in the ComputeEngineSSHHook where SSH host-key verification is disabled by default. This exposes SSH traffic between Airflow workers and Compute Engine VMs to interception or modification by in-path attackers. Users are advised to upgrade to version 22.0.0 or later to address this issue.
Apache ECharts versions prior to 6.1.0 contain a cross-site scripting (XSS) vulnerability in the Lines series tooltip rendering logic. When using Lines series with tooltips and no custom tooltip.formatter, raw HTML content in series.data[i].name can be rendered without proper escaping, potentially allowing script execution. This vulnerability breaks the usual automatic HTML escaping convention in built-in tooltip formatters. The issue is fixed in version 6.1.0.
The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
CVE-2026-44618 is a medium severity vulnerability in Apache CXF's WS-Transfer module caused by insecure XML parser configuration that allows XML External Entity (XXE) attacks. This vulnerability affects Apache CXF versions 4.2.0 and 4.0.0. The issue is addressed in Apache CXF versions 4.2.1, 4.1.
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Apache Fory versions before 1.0.0 contain a critical deserialization vulnerability (CWE-502) in the PyFory ReduceSerializer. This vulnerability allows bypassing of DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution when using Python-native mode with strict mode disabled. Exploitation requires deserializing attacker-controlled data under these conditions. Upgrading to Apache Fory 1.0.0 or later mitigates the issue by enforcing DeserializationPolicy validation.
(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K. Authorized users in a Kubernetes namespace can create a Build resource, controlling the Pod generation in a namespace of their choice, including the operator namespace.
This issue affects Apache Camel K: from 2.0.0 before 2.8.1, from 2.9.0 before 2.9.2, from 2.10.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1 (or 2.8.1 or 2.9.2), which fixes the issue.
JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.
In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `"my_team/conn"`) to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.
Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering
The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-cxf-transport, and KnativeHttpHeaderFilterStrategy in camel-knative-http) only filter outbound Camel-internal headers via setOutFilterStartsWith, while not configuring inbound filtering via setInFilterStartsWith. As a result, an unauthenticated attacker can inject Camel-internal headers (e.g. CamelExecCommandExecutable, CamelFileName) via HTTP requests to CXF-RS or CXF-SOAP endpoints. When a route forwards messages from these endpoints to header-driven components such as camel-exec or camel-file, the injected headers override configured values, enabling remote code execution or arbitrary file writes. This is the same pattern that was previously addressed in camel-undertow (CVE-2025-30177), the broader incoming-header filter (CVE-2025-27636 and CVE-2025-29891), and non-HTTP strategies (CVE-2026-40453).
This issue affects Apache Camel: from 3.18.0 before 4.14.6, from 4.15.0 before 4.18.2.
Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.18.x LTS releases stream, then they are suggested to upgrade to 4.18.2. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6.
CVE-2026-46586 is a high-severity vulnerability in Apache OFBiz prior to version 24.09.06 involving improper control of code generation, specifically code injection and eval injection issues. This allows an attacker with low privileges to execute arbitrary code without user interaction, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is fixed in Apache OFBiz version 24.09.06. No known exploits are reported in the wild at this time.
CVE-2026-45434 is a critical improper authentication vulnerability in Apache OFBiz before version 24.09.06. The flaw exists in the password-change logic and can lead to remote code execution without requiring authentication. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. Users are advised to upgrade to Apache OFBiz version 24.09.06, which addresses this issue.
Improper Authorization vulnerability in Apache OFBiz Webtools.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.