announce  

Messages by Date

• 2026/10/25 [ANNOUNCE] Apache Asyncband (Incubating) 0.7.4 released iqwqi
• 2026/10/24 [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-20 are released Hussein Awala
• 2026/10/23 [ANNOUNCE] Apache POI 6.0.0 release PJ Fanning
• 2026/10/23 CVE-2026-115721: Apache Vysper: Unbounded allocation Thomas Wolf
• 2026/10/23 CVE-2026-115748: Apache Vysper: Authorization bypass Thomas Wolf
• 2026/10/23 CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions Andrea Cosentino
• 2026/10/23 CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry Andrea Cosentino
• 2026/10/23 CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory Andrea Cosentino
• 2026/10/23 CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) Andrea Cosentino
• 2026/10/23 CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache Andrea Cosentino
• 2026/10/23 CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved Andrea Cosentino
• 2026/10/23 CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• 2026/10/22 [ANNOUNCE] Apache Camel 4.22.2 (LTS) Released Gregor Zurowski
• 2026/10/22 [ANNOUNCE] Release Apache Paimon Terraform 0.1.0 Jiajia Li
• 2026/10/22 CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing Piotr Karwasz
• 2026/10/21 CVE-2026-105869: Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role Lari Hotari
• 2026/10/21 CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands Lari Hotari
• 2026/10/21 CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization Lari Hotari
• 2026/10/21 CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life Lari Hotari
• 2026/10/21 CVE-2026-105930: Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download Lari Hotari
• 2026/10/21 CVE-2026-105927: Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission Lari Hotari
• 2026/10/21 CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint Lari Hotari
• 2026/10/21 CVE-2026-105932: Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints Lari Hotari
• 2026/10/21 CVE-2026-105934: Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic Lari Hotari
• 2026/10/21 CVE-2026-105937: Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data Lari Hotari
• 2026/10/21 CVE-2026-105942: Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation Lari Hotari
• 2026/10/21 CVE-2026-105935: Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission Lari Hotari
• 2026/10/21 CVE-2026-105931: Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants Lari Hotari
• 2026/10/21 CVE-2026-105938: Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all Lari Hotari
• 2026/10/21 CVE-2026-105945: Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage Lari Hotari
• 2026/10/21 CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation Haonan Hou
• 2026/10/21 CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Haonan Hou
• 2026/10/21 CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface Haonan Hou
• 2026/10/21 CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver Haonan Hou
• 2026/10/21 [ANNOUNCE] Apache Jackrabbit Oak 1.22.25 released Julian Reschke
• 2026/10/20 Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 Weibing Wang
• 2026/10/20 [ANNOUNCE] Apache BookKeeper 4.18.2 released Matteo Merli
• 2026/10/20 CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Jan Lehnardt
• 2026/10/20 [SECURITY] CVE-2026-101356 Apache Tomcat - HTTP/2 request/response mix-up after error during async processing Mark Thomas
• 2026/10/20 CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely Jan Lehnardt
• 2026/10/20 [ANNOUNCE] Apache Casbin SQLx Adapter (Incubating) 1.9.0 emryzhang
• 2026/10/20 [SECURITY] CVE-2026-74049 Apache Tomcat - Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) Mark Thomas
• 2026/10/20 [SECURITY] CVE-2026-74048 Apache Tomcat - OpenSSL-FFM FIPS failure does not prevent start-up Mark Thomas
• 2026/10/20 [SECURITY] CVE-2026-103119 Apache Tomcat - AJP response mix-up Mark Thomas
• 2026/10/20 [SECURITY] CVE-2026-101296 Apache Tomcat - JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Mark Thomas
• 2026/10/20 [SECURITY] CVE-2026-93446 Apache Tomcat - Possible TLS 1.3 connection failures Mark Thomas
• 2026/10/20 [SECURITY] CVE-2026-88041 Apache Tomcat - HTTP/2 trailer header cross-contamination Mark Thomas
• 2026/10/20 [SECURITY] CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Mark Thomas
• 2026/10/20 CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values Jan Lehnardt
• 2026/10/20 CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs Jan Lehnardt
• 2026/10/20 CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user Jan Lehnardt
• 2026/10/20 CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Jan Lehnardt
• 2026/10/20 Re: [ANNOUNCE] Apache CouchDB 3.5.3 released Jan Lehnardt
• 2026/10/20 CVE-2026-108087: Apache Cocoon: SQL Injection Arnout Engelen
• 2026/10/20 CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure Arnout Engelen
• 2026/10/20 CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces Arnout Engelen
• 2026/10/20 CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning Arnout Engelen
• 2026/10/20 [ANNOUNCE] Apache Jackrabbit Oak 2.8.0 released Julian Reschke
• 2026/10/19 CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation Adam Reeve
• 2026/10/19 [ANNOUNCE] Apache Commons JEXL 3.7.1 Gary Gregory
• 2026/10/19 CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account Jarek Potiuk
• 2026/10/19 [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-17 are released Jarek Potiuk
• 2026/10/19 [ANNOUNCE] Apache Arrow 26.0.0 released Raúl Cumplido
• 2026/10/19 CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Andrea Cosentino
• 2026/10/17 [ANNOUNCE] OpenDAL 0.59.5-rc.2 released xuanwo
• 2026/10/17 [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-14 are released Jarek Potiuk
• 2026/10/17 CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure Andrea Cosentino
• 2026/10/17 CVE-2026-85245: Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target Andrea Cosentino
• 2026/10/17 CVE-2026-108743: Apache Kylin: spark job OS command injection Li Yang
• 2026/10/16 CVE-2026-85249: Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata Andrea Cosentino
• 2026/10/16 CVE-2026-85251: Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets Andrea Cosentino
• 2026/10/16 CVE-2026-80312: Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors Andrea Cosentino
• 2026/10/16 CVE-2026-83531: Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages Andrea Cosentino
• 2026/10/16 [ANNOUNCE] Apache Johnzon 1.3.1 Markus Jung
• 2026/10/16 CVE-2026-71253: Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON Markus Jung
• 2026/10/16 CVE-2026-85300: Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions Andrea Cosentino
• 2026/10/16 CVE-2026-85254: Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing Andrea Cosentino
• 2026/10/16 CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set Andrea Cosentino
• 2026/10/16 CVE-2026-85314: Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) Andrea Cosentino
• 2026/10/16 CVE-2026-85317: Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache Andrea Cosentino
• 2026/10/16 CVE-2026-85260: Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default Andrea Cosentino
• 2026/10/16 CVE-2026-85257: Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• 2026/10/16 CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State Andrea Cosentino
• 2026/10/16 CVE-2026-78165: Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads Andrea Cosentino
• 2026/10/16 CVE-2026-85246: Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• 2026/10/16 CVE-2026-84181: Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse Andrea Cosentino
• 2026/10/16 CVE-2026-85248: Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance Andrea Cosentino
• 2026/10/16 CVE-2026-85247: Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore Andrea Cosentino
• 2026/10/16 CVE-2026-85301: Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim Andrea Cosentino
• 2026/10/16 CVE-2026-85250: Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option Andrea Cosentino
• 2026/10/16 CVE-2026-85312: Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header Andrea Cosentino
• 2026/10/16 CVE-2026-91858: Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present Andrea Cosentino
• 2026/10/16 CVE-2026-85315: Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• 2026/10/16 CVE-2026-79986: Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• 2026/10/16 CVE-2026-85316: Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching Andrea Cosentino
• 2026/10/16 CVE-2026-88901: Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default Andrea Cosentino
• 2026/10/16 CVE-2026-80343: Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching Andrea Cosentino
• 2026/10/16 CVE-2026-79983: Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• 2026/10/16 CVE-2026-79984: Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• 2026/10/16 CVE-2026-84178: Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow Andrea Cosentino
• 2026/10/16 CVE-2026-78164: Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers Andrea Cosentino
• 2026/10/16 CVE-2026-71569: Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name Andrea Cosentino
• 2026/10/16 CVE-2026-78163: Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure Andrea Cosentino
• 2026/10/16 CVE-2026-78162: Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) Andrea Cosentino
• 2026/10/16 CVE-2026-79985: Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• 2026/10/16 CVE-2026-80344: Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address Andrea Cosentino
• 2026/10/16 CVE-2026-84176: Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection Andrea Cosentino
• 2026/10/16 CVE-2026-84180: Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• 2026/10/15 CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication Enxin Xie
• 2026/10/15 CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content Enxin Xie
• 2026/10/15 CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content Enxin Xie
• 2026/10/15 CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Enxin Xie
• 2026/10/15 CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Enxin Xie
• 2026/10/15 CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Enxin Xie
• 2026/10/15 CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Enxin Xie
• 2026/10/15 CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Enxin Xie
• 2026/10/15 CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Enxin Xie
• 2026/10/15 CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Enxin Xie
• 2026/10/15 CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup Enxin Xie
• 2026/10/15 CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Enxin Xie
• 2026/10/15 CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Enxin Xie
• 2026/10/15 CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation Li Yang
• 2026/10/15 CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass Li Yang
• 2026/10/15 CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF Li Yang
• 2026/10/15 CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization Li Yang
• 2026/10/15 CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection Li Yang
• 2026/10/15 CVE-2026-108766: Apache Kylin: missing JDBC-config authorization Li Yang
• 2026/10/15 CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue Li Yang
• 2026/10/15 CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement Li Yang
• 2026/10/15 CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion Li Yang
• 2026/10/15 CVE-2026-108833: Apache Kylin: default startup profile miss security settings Li Yang
• 2026/10/15 CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard Li Yang
• 2026/10/15 CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass Li Yang
• 2026/10/15 CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup Li Yang
• 2026/10/15 CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env Li Yang
• 2026/10/15 CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController Li Yang
• 2026/10/15 CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints Li Yang
• 2026/10/15 CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) Li Yang
• 2026/10/15 CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure Li Yang
• 2026/10/15 CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump Li Yang
• 2026/10/15 CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization Li Yang
• 2026/10/15 CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
• 2026/10/15 CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
• 2026/10/15 CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default Jarek Potiuk
• 2026/10/15 CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token Jarek Potiuk
• 2026/10/15 CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read Jarek Potiuk
• 2026/10/15 [ANNOUNCE] Apache Camel 4.23.0 Released Gregor Zurowski
• 2026/10/15 [ANNOUNCE] Apache Pekko HTTP 1.4.2 released PJ Fanning
• 2026/10/15 [ANNOUNCE] Apache SeaTunnel 3.0.0 Released — A Major Milestone Release lidongdai
• 2026/10/14 [ANNOUNCE] Apache SedonaDB 0.5.0 released Dewey Dunnington
• 2026/10/14 [ANNOUNCEMENT] HttpComponents Core 5.5-beta4 released Oleg Kalnichevski
• 2026/10/13 [ANNOUNCE] Apache SIS 1.7 Release Martin Desruisseaux
• 2026/10/13 [ANNOUNCE] Apache Tika 3.3.3 released Tim Allison
• 2026/10/13 [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-06 are released Jarek Potiuk
• 2026/10/13 CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan
• 2026/10/13 [ANNOUNCE] Apache Pulsar Helm Chart version 4.8.0 Released Lari Hotari
• 2026/10/13 Subject: [ANNOUNCE] Release Apache Paimon Rust 0.4.0 hope
• 2026/10/12 CVE-2026-92119: Apache Allura: REST API Mass Assignment Dave Brondsema
• 2026/10/12 CVE-2026-92116: Apache Allura: OAuth1 missing callback validation Dave Brondsema
• 2026/10/12 CVE-2026-92120: Apache Allura: Oauth1 Replay Attack Dave Brondsema
• 2026/10/12 [ANNOUNCEMENT] HttpComponents Client 5.6.5 Released Oleg Kalnichevski
• 2026/10/12 [ANN] Apache Tomcat 11.0.27 Available Mark Thomas
• 2026/10/12 [ANN] Apache Tomcat 9.0.123 available Rémy Maucherat
• 2026/10/12 [ANN] Apache Tomcat 10.1.61 Available Christopher Schultz
• 2026/10/12 [ANNOUNCE] Apache CouchDB 3.5.3 released Jan Lehnardt
• 2026/10/11 [ANNOUNCE] Apache Camel 4.18.5 (LTS) Released Gregor Zurowski
• 2026/10/11 [ANNOUNCE] Apache Commons Codec 1.23.0 Gary Gregory
• 2026/10/09 CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Colm O hEigeartaigh
• 2026/10/09 CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Lee Rhodes
• 2026/10/09 CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
• 2026/10/09 CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
• 2026/10/09 CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch Lee Rhodes
• 2026/10/09 CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch Lee Rhodes
• 2026/10/09 CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests Colm O hEigeartaigh
• 2026/10/09 CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Colm O hEigeartaigh
• 2026/10/09 [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.4 released David Jensen
• 2026/10/09 CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits Colm O hEigeartaigh
• 2026/10/09 CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git Andrea Cosentino
• 2026/10/09 CVE-2026-79650: Apache CXF: OIDC RP Open Redirect Colm O hEigeartaigh
• 2026/10/09 CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml Andrea Cosentino
• 2026/10/09 CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. Colm O hEigeartaigh
• 2026/10/09 CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security Colm O hEigeartaigh
• 2026/10/09 CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic Colm O hEigeartaigh
• 2026/10/09 CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) Colm O hEigeartaigh
• 2026/10/09 CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Colm O hEigeartaigh
• 2026/10/09 CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service Colm O hEigeartaigh
• 2026/10/08 [ANNOUNCE] Apache Maka 0.2.0 (incubating) released Yuhan Lei
• 2026/10/08 Apache Beam 2.77.0 Released! Vitalii Terentev
• 2026/10/07 CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint Wenjun Ruan
• 2026/10/07 CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） Wenjun Ruan
• 2026/10/07 CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords Wenjun Ruan
• 2026/10/07 CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint Wenjun Ruan
• 2026/10/07 CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information Wenjun Ruan
• 2026/10/07 CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials Wenjun Ruan
• 2026/10/07 CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File Jinwoo Hwang
• 2026/10/07 [ANNOUNCE] Apache Jackrabbit 2.23.6-beta released Julian Reschke
• 2026/10/07 CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Julian Reschke
• 2026/10/07 CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Julian Reschke
• 2026/10/07 [ANNOUNCE] Apache Jackrabbit 2.22.5 released Julian Reschke
• 2026/10/07 [ANNOUNCE] Apache Pekko HTTP 1.4.1 released PJ Fanning

• Earlier messages