announce  

Messages by Thread

• CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server Thomas Wolf
• CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server Thomas Wolf
• CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies Thomas Wolf
• CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap Thomas Wolf
• CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension Thomas Wolf
• CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes Colm O hEigeartaigh
• CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures Colm O hEigeartaigh
• CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials Jean-Baptiste Onofré
• CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource Wenjun Ruan
• [ANNOUNCE] Apache LDAP API 2.1.9 released Emmanuel Lecharny
• CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths Wenjun Ruan
• CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker Colm O hEigeartaigh
• CVE-2026-71897: Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints Wenjun Ruan
• CVE-2026-71899: Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure Wenjun Ruan
• CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions Wenjun Ruan
• CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin Wenjun Ruan
• CVE-2026-81569: Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution Wenjun Ruan
• CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names Shahar Epstein
• CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs Shahar Epstein
• CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain Shahar Epstein
• [ANNOUNCE] Apache Accumulo 4.0.0-alpha-1 Dave Marion
• [ANNOUNCE] Apache MINA SSHD 2.20.0 released Thomas Wolf
• [ANNOUNCE] Apache MINA SSHD 3.0.0-M6 released Thomas Wolf
• https://karaf.apache.org/security/cve-2026-92142.txt: CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations Jean-Baptiste Onofré
• https://karaf.apache.org/security/cve-2026-91085.txt: CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin Jean-Baptiste Onofré
• CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation Jean-Baptiste Onofré
• CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create Jean-Baptiste Onofré
• https://karaf.apache.org/security/cve-2026-90979.txt: CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP login modules Jean-Baptiste Onofré
• [ANNOUNCE] Apache Polaris 1.8.0 Jean-Baptiste Onofré
  • Re: [ANNOUNCE] Apache Polaris 1.8.0 Alex Dutra
• CVE-2026-85499: Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy Hongtao Gao
• https://karaf.apache.org/security/cve-2026-91006.txt: CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) Jean-Baptiste Onofré
• [ANNOUNCE] Apache Karaf 4.4.12 has been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache ActiveMQ 6.2.10 has been released! Jean-Baptiste Onofré
• CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed David M. Johnson
• CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation David M. Johnson
• CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs David M. Johnson
• CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering David M. Johnson
• CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI David M. Johnson
• CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter David M. Johnson
• CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint David M. Johnson
• CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity David M. Johnson
• CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser David M. Johnson
• CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files David M. Johnson
• CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers David M. Johnson
• CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import David M. Johnson
• CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL David M. Johnson
• CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups David M. Johnson
• CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links David M. Johnson
• CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type David M. Johnson
• CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator David M. Johnson
• CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments David M. Johnson
• [ANN] Apache CycloneDX Antlib 0.2 Released Stefan Bodewig
• [ANNOUNCE] Apache Grails 7.2.4 Mattias Reichel
• [ANNOUNCE] Apache Grails 7.1.7 Mattias Reichel
• [ANNOUNCE] Apache Groovy 6.0.0 Released Paul King
• [ANN] Apache Maven 4.0.0-rc-7 Release Guillaume Nodet
• CVE-2026-92550: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder Daniil Kirilyuk
• CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder Daniil Kirilyuk
• CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing Daniil Kirilyuk
• CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering Daniil Kirilyuk
• CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication Daniil Kirilyuk
• CVE-2026-92608: Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 Daniil Kirilyuk
• CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key Jarek Potiuk
• [ANNOUNCE] Apache Grails 7.0.17 Mattias Reichel
• [ANNOUNCEMENT] HttpComponents Core 5.4.4 GA released Oleg Kalnichevski
• [ANNOUNCEMENT] HttpComponents Core 5.5-beta3 released Oleg Kalnichevski
• CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations Wenjun Ruan
• [ANNOUNCE] Apache XMLBeans 5.4.1 release PJ Fanning
• CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin Joerg Hoh
• [SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
• [SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas
• [SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas
• [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
• [SECURITY] CVE-2026-86247 Apache Tomcat Native - Client certificate requirements can be down-graded Mark Thomas
• [SECURITY] CVE-2026-86246 Apache Tomcat Native - Insecure OpenSSL options enabled Mark Thomas
• [SECURITY] CVE-2026-86243 Apache Tomcat Native - DoS via TLS handshake Mark Thomas
• [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas
• [SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• [SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas
• [SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
• [SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
• [SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• [SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas
• [SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
  • [UPDATE][SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution Calvin Kirs
• CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service Calvin Kirs
• CVE-2026-92001: Apache Sling XSS: Missing parser resource limits Joerg Hoh
• CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence Joerg Hoh
• CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource Joerg Hoh
• CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms Joerg Hoh
• CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl Joerg Hoh
• CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref() Joerg Hoh
• CVE-2026-82331: Apache BuildStream: tar source extraction escape Jürg Billeter
• CVE-2026-70410: Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins Stamatis Zampetakis
• [ANNOUNCE] OpenDAL 0.59.3-rc.1 released xuanwo
• [ANNOUNCE] Apache Groovy 5.1.3 Released Paul King
• CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate Emmanuel Lécharny
• CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter Rahul Vats
• CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation Rahul Vats
• CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry Rahul Vats
• CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 Emmanuel Lécharny
• [ANNOUNCE] Apache Fory 1.7.4 released Shawn Yang
• [ANNOUNCE] Apache Calcite Avatica 1.29.0 Released Francis Chuang
• CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion Colm O hEigeartaigh
• CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service Colm O hEigeartaigh
• CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service Colm O hEigeartaigh
• CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely Colm O hEigeartaigh
• CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service Colm O hEigeartaigh
• CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) Rahul Vats
• [ANNOUNCE] Apache Groovy 6.0.0-RC-3 Released Paul King
• https://karaf.apache.org/security/cve-2026-92230.txt: CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching Jean-Baptiste Onofré
• [ANNOUNCE] Apache Airflow 3.3.2 Released Rahul Vats
• [ANNOUNCE] Apache Camel 4.22.1 (LTS) Released Gregor Zurowski
• [ANNOUNCE] Apache Pulsar 5.0.0-M2 released Lari Hotari
• CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs Francesco Chicchiriccò
• CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration David Handermann
• CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing Volodymyr Siedlecki
• CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability Volodymyr Siedlecki
• CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods David Handermann
• CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration David Handermann
• CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles David Handermann
• CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests David Handermann
• [ANNOUNCE] Apache Fory 1.7.3 released Shawn Yang
• [ANNOUNCE] Apache BookKeeper 4.18.1 released Matteo Merli
• [ANN] Apache Tomcat 9.0.122 available Rémy Maucherat
• CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false Vincent Beck
• CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key Vincent Beck
• CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access Vincent Beck
• CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated Vincent Beck
• CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT Vincent Beck
• CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity Vincent Beck
• CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration Vincent Beck
• CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions Vincent Beck
• CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources Andor Molnar
• CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode Andor Molnar
• CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider Andor Molnar
• CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay Andor Molnar
• CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode Andor Molnar
• [ANN] Apache Tomcat 11.0.26 Available Mark Thomas
• [ANN] Apache Tomcat 10.1.60 Available Christopher Schultz
• [ANNOUNCE] OpenDAL 0.59.2-rc.2 released xuanwo
• CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers Francesco Chicchiriccò
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-09-09 are released Vincent Beck
• CVE-2026-87785: Apache Syncope: JWT subject spoofing Francesco Chicchiriccò
• CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search Francesco Chicchiriccò
• CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning Francesco Chicchiriccò
• CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist Francesco Chicchiriccò
• CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective Francesco Chicchiriccò
• CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser Francesco Chicchiriccò
• CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output Francesco Chicchiriccò
• CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access Calvin Kirs
• CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables Calvin Kirs
• CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication Francesco Chicchiriccò
• CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user Francesco Chicchiriccò
• CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence Francesco Chicchiriccò
• CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass Francesco Chicchiriccò
• [ANN] Apache Syncope 4.1.3 Francesco Chicchiriccò
• [ANN] Apache Syncope 4.0.8 Francesco Chicchiriccò
• CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection Francesco Chicchiriccò
• CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass Francesco Chicchiriccò
• CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration Francesco Chicchiriccò
• CVE-2026-73178: Apache Syncope: JWT Access Token takeover Francesco Chicchiriccò
• CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles Francesco Chicchiriccò
• CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values Francesco Chicchiriccò
• CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions Francesco Chicchiriccò
• CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search Francesco Chicchiriccò
• CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable Francesco Chicchiriccò
• [ANNOUNCE] Apache Camel Karaf 4.18.4 has been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache IoTDB 2.0.11 released Haonan Hou
• [ANNOUNCE] Apache Groovy 6.0.0-RC-2 Released Paul King
• CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides Richard Zowalla
• CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys Richard Zowalla
• CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name Richard Zowalla
• CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users Richard Zowalla
• CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer Richard Zowalla
• CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI Richard Zowalla
• CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder Richard Zowalla
• CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher Richard Zowalla
• CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location Richard Zowalla
• CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant Richard Zowalla
• CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs Richard Zowalla
• CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC Richard Zowalla
• CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins Richard Zowalla
• CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys Richard Zowalla
• CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page Richard Zowalla
• [ANNOUNCE] Apache Storm 3.1.0 released Rui Abreu
• [ANNOUNCE] OpenNLP 2.5.12 and 3.0.0-M6 released Richard Zowalla

• Earlier messages
• Later messages