CWE-27 vulnerabilities

CVE-2026-62391 is a path traversal vulnerability in Apache Kyuubi affecting versions from 1.6.0 up to but not including 1.12.0. The issue arises because the security fix for a previous vulnerability (CVE-2025-66518) is incomplete, allowing clients with access to the Kyuubi Server via frontend protocols to bypass server-side directory allowlist restrictions using unprefixed Spark config aliases. This vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity without affecting availability.

An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.

Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. Users are recommended to upgrade to version 1.10.3 or upper, which fixes the issue.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog: before 21.7.