Apache ActiveMQ Broker versions before 5.19.8 and from 6.0.0 before 6.2.7 contain a missing authorization vulnerability. Temporary destinations, which should be isolated to the connection that created them, can be accessed by other connections due to insufficient server-side enforcement. This allows unauthorized consumption from temporary destinations belonging to other connections. The issue is fixed in versions 5.19.8 and 6.2.7.
Apache ActiveMQ and its Web Console contain a cross-site scripting (XSS) vulnerability in the browse page of the web console. This flaw allows an authenticated message producer to craft a JMS message ID containing malicious HTML or JavaScript. When an administrator views the queue in the Web Console, the malicious script executes in their browser. Versions before 5.19.8 and from 6.0.0 before 6.2.7 are affected. Upgrading to versions 5.19.8 or 6.2.7 resolves the issue.
Apache ActiveMQ versions before 5.19.8 and from 6.0.0 before 6.2.7 contain an improper input validation vulnerability in the STOMP connector. A remote unauthenticated attacker can exploit this by sending a negative content-length, causing denial-of-service conditions. The attack can lead to out-of-memory conditions or abnormal connection closures depending on the STOMP transport type. Upgrading to versions 5.19.8 or 6.2.7 resolves this issue.
A vulnerability in Apache ActiveMQ allows an authenticated user to cause a denial of service (DoS) by sending a crafted OpenWire message with an excessively large encoded size value. This triggers an out-of-memory (OOM) condition and crashes the broker. The issue affects multiple Apache ActiveMQ components before versions 5.19.8 and from 6.0.0 before 6.2.7. Upgrading to versions 5.19.8 or 6.2.7 resolves the issue.
A Denial of Service (DoS) vulnerability exists in Apache ActiveMQ Broker versions 5.19.7 up to but not including 5.19.8, and 6.2.6 up to but not including 6.2.7. An unauthenticated attacker can cause an out-of-memory (OOM) condition by sending repeated BrokerInfo commands without sending a ConnectionInfo, leading to broker crash. The issue is fixed in versions 5.19.8 and 6.2.7.
Apache ActiveMQ Client and Apache ActiveMQ contain a vulnerability where an unauthenticated network attacker can cause a denial of service (DoS) by sending a crafted WireFormatInfo frame with a maliciously large size value. This triggers an out-of-memory (OOM) condition during pre-authentication negotiation, crashing the broker. Versions before 5.19.8 and from 6.0.0 before 6.2.7 are affected. The issue is fixed in versions 5.19.8 and 6.2.7.
Apache ActiveMQ contains an improper authorization vulnerability allowing authenticated low-privilege Web Console users to access administrative paths (/admin/*) by default due to incorrect Jetty settings. This affects versions before 5.19.8 and from 6.0.0 before 6.2.7. The issue is fixed in versions 5.19.8 and 6.2.7. The vulnerability has a high severity with a CVSS score of 8.1.
Apache ActiveMQ Broker versions before 5.19.8 and from 6.0.0 before 6.2.7 contain an improper input validation vulnerability. An attacker with the ability to publish or modify LDAP entries matching the configured searchBase and searchFilter can instantiate denied transports within the broker JVM. This can lead to fetching an attacker-controlled URL and spawning a second BrokerService inside the same JVM. The issue is fixed in versions 5.19.8 and 6.2.7.
Apache Tomcat versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22 contain an improper authorization vulnerability. This flaw causes security constraints for the default servlet to ignore method or method omission configurations, potentially allowing unauthorized access. Fixed versions are 11.0.23, 10.1.56, and 9.0.119. The vulnerability has a CVSS score of 6.5 (medium severity).
Apache Tomcat contains a cross-site scripting (XSS) vulnerability in the number guess example that affects multiple versions across the 7.x, 8.5.x, 9.x, 10.1.x, and 11.x branches. This vulnerability allows improper neutralization of script-related HTML tags, potentially enabling script injection. Fixed versions are available in Apache Tomcat 11.0.23, 10.1.56, and 9.0.119.
Apache Tomcat's rewrite valve contains an Always-Incorrect Control Flow Implementation vulnerability that causes the skipping of subsequent non-OR conditions if the first condition in an OR chain matches. This affects multiple versions of Apache Tomcat from 8.5.0 through 11.0.22. The issue is fixed in versions 11.0.23, 10.1.56, and 9.0.119. The vulnerability has a high severity with a CVSS score of 7.3.
Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22 contain an Always-Incorrect Control Flow Implementation vulnerability. This flaw causes special roles and empty authorization constraints to be omitted when the effective web.xml configuration is logged. The issue is fixed in versions 8.5.101, 9.0.119, 10.1.56, and 11.0.23. The vulnerability has a CVSS score of 9.1, indicating critical severity with high confidentiality and integrity impact but no availability impact.
Apache Tomcat contains an improper authentication vulnerability (CVE-2026-55955) affecting multiple versions from 7.0.100 through 11.0.22. This flaw allows a replay attack against the EncryptionInterceptor in the cluster component. The issue is fixed in versions 11.0.23, 10.1.56, and 9.0.119.
Apache Tomcat contains a vulnerability in its JNDIRealm authentication when configured to use GSSAPI. This flaw allows attackers to bypass password verification and authenticate without providing the correct credentials. The issue affects multiple versions across the 7.x, 8.5.x, 9.x, 10.1.x, and 11.x branches. Fixed versions have been released in 11.0.5, 10.1.37, and 9.0.101.
CVE-2026-48717 is an authorization bypass vulnerability in OpenAM Community Edition's OAuth2 authorization-code grant implementation. The flaw allows a PKCE-protected authorization code to be redeemed without providing the required code_verifier parameter when the realm-wide enforcement setting is disabled (the default). This enables an attacker who intercepts an authorization code to exchange it for tokens without the verifier, under default OAuth2 provider configurations. The issue affects OpenAM versions prior to 16.1.1 and has been fixed in version 16.1.1.
OpenAM Community Edition through version 16.0.6 contains an improper authentication vulnerability in its OAuth2 private_key_jwt client authentication mechanism. This flaw allows any registered OAuth2 client to impersonate other clients by minting access tokens in their name without possessing their signing keys, provided the victim client's keys are published via jwks_uri. The issue affects all realms hosted by the OpenAM process and was fixed in version 16.1.1.
A Protection Mechanism Failure in OpenAM's server-side scripting sandbox allows an authenticated script author to execute operating system commands from the OpenAM JVM. This vulnerability affects OpenAM Community Edition versions prior to 16.1.1 and was patched in version 16.1.1. An authenticated user with script authoring privileges can escalate from realm-scoped administration to full JVM and host execution, compromising the entire OpenAM process and all realms it serves.
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.
OpenAM Community Edition versions prior to 16.1.1 contain a vulnerability in the OAuth2 authentication module where a user's local password is silently changed to their username upon OAuth2 re-login. This allows an unauthenticated attacker to authenticate using the username as both username and password, gaining a session with the victim's privileges. The issue affects deployments with account creation enabled and can also reactivate disabled accounts. The vulnerability has been patched in version 16.1.1.
An LDAP Injection vulnerability in the MSISDN authentication module of OpenAM Community Edition allows unauthenticated remote attackers to bypass authentication and obtain an arbitrary session without a password. This affects versions prior to 16.1.1 where MSISDN is enabled and reachable via the default trusted gateway configuration. The vulnerability arises because the MSISDN value is directly concatenated into an LDAP search filter, enabling pre-authentication login bypass. The issue is patched in version 16.1.1.