{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-24T10:56:22.718Z", "lastRun": "2026-10-24T10:33:55.388Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": null, "ecosystems": [], "tag": "apache-software-foundation" }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "incidents": [ { "id": "cve-2026-111812", "url": "https://cveboard.org/i/cve-2026-111812", "urlPt": "https://cveboard.org/pt/i/cve-2026-111812", "json": "https://cveboard.org/i/cve-2026-111812.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "high", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.1.11" }, { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-863", "name": "Incorrect Authorization" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-22T23:05:10.427Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111812" ], "ghsa": null, "cvss": { "score": 7, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00262, "percentile": 0.17053, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111812" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T19:18:19.526Z", "updatedAt": "2026-10-21T19:18:19.526Z" }, { "id": "cve-2026-111811", "url": "https://cveboard.org/i/cve-2026-111811", "urlPt": "https://cveboard.org/pt/i/cve-2026-111811", "json": "https://cveboard.org/i/cve-2026-111811.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.1.11" }, { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-22T23:05:09.363Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111811" ], "ghsa": null, "cvss": { "score": 9.4, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00259, "percentile": 0.16599, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111811" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T19:17:32.448Z", "updatedAt": "2026-10-21T19:17:32.448Z" }, { "id": "cve-2026-111809", "url": "https://cveboard.org/i/cve-2026-111809", "urlPt": "https://cveboard.org/pt/i/cve-2026-111809", "json": "https://cveboard.org/i/cve-2026-111809.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "moderate", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.1.11" }, { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests" } ], "ssvc": null, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111809" ], "ghsa": null, "cvss": { "score": 6.9, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00218, "percentile": 0.11648, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111809" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T19:16:16.439Z", "updatedAt": "2026-10-21T19:16:16.439Z" }, { "id": "cve-2026-111815", "url": "https://cveboard.org/i/cve-2026-111815", "urlPt": "https://cveboard.org/pt/i/cve-2026-111815", "json": "https://cveboard.org/i/cve-2026-111815.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "high", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": "Fundação Apache Software Apache Traffic Server", "summaryPt": "", "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.1.11" }, { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-295", "name": "Improper Certificate Validation" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-22T23:05:08.511Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111815" ], "ghsa": null, "cvss": { "score": 7.8, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00172, "percentile": 0.06245, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111815" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T19:13:55.811Z", "updatedAt": "2026-10-21T19:13:55.811Z" }, { "id": "cve-2026-111814", "url": "https://cveboard.org/i/cve-2026-111814", "urlPt": "https://cveboard.org/pt/i/cve-2026-111814", "json": "https://cveboard.org/i/cve-2026-111814.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "high", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-295", "name": "Improper Certificate Validation" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-22T23:05:07.346Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111814" ], "ghsa": null, "cvss": { "score": 7.8, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00172, "percentile": 0.06245, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111814" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T19:13:06.888Z", "updatedAt": "2026-10-21T19:13:06.888Z" }, { "id": "cve-2026-111816", "url": "https://cveboard.org/i/cve-2026-111816", "urlPt": "https://cveboard.org/pt/i/cve-2026-111816", "json": "https://cveboard.org/i/cve-2026-111816.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.1.11" }, { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-23T20:52:14.941Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111816" ], "ghsa": null, "cvss": { "score": 9.2, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00237, "percentile": 0.13887, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111816" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T18:26:32.566Z", "updatedAt": "2026-10-21T18:26:32.566Z" }, { "id": "cve-2026-111813", "url": "https://cveboard.org/i/cve-2026-111813", "urlPt": "https://cveboard.org/pt/i/cve-2026-111813", "json": "https://cveboard.org/i/cve-2026-111813.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Traffic Server", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "defaultStatus": "unaffected", "versions": [ { "version": "8.0.1", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.1.11" }, { "version": "9.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.2.15" }, { "version": "10.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.4" }, { "version": "10.2.0", "status": "affected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-22T23:05:00.564Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-111813" ], "ghsa": null, "cvss": { "score": 10, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00347, "percentile": 0.27034, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-111813" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T18:20:22.104Z", "updatedAt": "2026-10-21T18:20:22.104Z" }, { "id": "cve-2026-105944", "url": "https://cveboard.org/i/cve-2026-105944", "urlPt": "https://cveboard.org/pt/i/cve-2026-105944", "json": "https://cveboard.org/i/cve-2026-105944.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Pulsar Manager", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Pulsar Manager", "defaultStatus": "unaffected", "versions": [ { "version": "0.1.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "0.4.0" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://pulsar.apache.org/security/CVE-2026-105944/", "tag": "vendor-advisory" }, { "url": "https://lists.apache.org/thread.html/hol3z7fzhjntwvrv8xqqwx4l4d2jx796", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-306", "name": "Missing Authentication for Critical Function" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-23T20:54:26.790Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-105944" ], "ghsa": null, "cvss": { "score": 10, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00703, "percentile": 0.52767, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Pulsar Manager", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105944" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T18:17:37.844Z", "updatedAt": "2026-10-21T18:17:37.844Z" }, { "id": "cve-2026-105869", "url": "https://cveboard.org/i/cve-2026-105869", "urlPt": "https://cveboard.org/pt/i/cve-2026-105869", "json": "https://cveboard.org/i/cve-2026-105869.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Pulsar", "summary": "", "titlePt": "Fundação Apache Software Apache Pulsar", "summaryPt": "", "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Pulsar", "defaultStatus": "unaffected", "versions": [ { "version": "2.8.1", "status": "affected", "lessThan": "4.0.14", "lessThanOrEqual": null }, { "version": "4.1.0", "status": "affected", "lessThan": "4.2.5", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.0.14", "4.2.5" ] } ], "omitted": 0, "references": [ { "url": "https://pulsar.apache.org/security/CVE-2026-105869/", "tag": "vendor-advisory" }, { "url": "https://lists.apache.org/thread.html/lf36z1tlcsokp4gv97obkdjtt74ngmrw", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" } ], "ssvc": null, "fix": "listed", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-105869" ], "ghsa": null, "cvss": { "score": 9.2, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00303, "percentile": 0.21935, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Pulsar", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-105869" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-21T17:58:54.385Z", "updatedAt": "2026-10-21T17:58:54.385Z" }, { "id": "cve-2026-86471", "url": "https://cveboard.org/i/cve-2026-86471", "urlPt": "https://cveboard.org/pt/i/cve-2026-86471", "json": "https://cveboard.org/i/cve-2026-86471.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache CouchDB", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache CouchDB", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": "3.5.3", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "3.5.3" ] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/c8p73gswgogtnzvk7hpw8jb8d4mnosdp", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-20T00:00:00.000Z" }, "fix": "listed", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-86471" ], "ghsa": null, "cvss": { "score": 9.3, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.00606, "percentile": 0.48329, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache CouchDB", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-86471" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-20T15:38:09.681Z", "updatedAt": "2026-10-20T15:38:09.681Z" }, { "id": "cve-2026-103119", "url": "https://cveboard.org/i/cve-2026-103119", "urlPt": "https://cveboard.org/pt/i/cve-2026-103119", "json": "https://cveboard.org/i/cve-2026-103119.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Tomcat", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M25", "status": "affected", "lessThan": null, "lessThanOrEqual": "11.0.26" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-127", "name": "Buffer under-read" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-20T15:41:16.526Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-103119" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "CISA-ADP" }, "epss": { "percentage": 0.00609, "percentile": 0.48492, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-103119" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-20T13:54:13.558Z", "updatedAt": "2026-10-20T13:54:13.558Z" }, { "id": "cve-2026-101356", "url": "https://cveboard.org/i/cve-2026-101356", "urlPt": "https://cveboard.org/pt/i/cve-2026-101356", "json": "https://cveboard.org/i/cve-2026-101356.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Tomcat", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.22", "status": "affected", "lessThan": null, "lessThanOrEqual": "11.0.26" }, { "version": "10.1.55", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.60" }, { "version": "9.0.118", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.0.122" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "partial", "at": "2026-10-20T18:17:35.437Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-101356" ], "ghsa": null, "cvss": { "score": 9.1, "version": "3.1", "by": "CISA-ADP" }, "epss": { "percentage": 0.00518, "percentile": 0.43218, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-101356" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-20T13:46:50.842Z", "updatedAt": "2026-10-20T13:46:50.842Z" }, { "id": "cve-2026-101296", "url": "https://cveboard.org/i/cve-2026-101296", "urlPt": "https://cveboard.org/pt/i/cve-2026-101296", "json": "https://cveboard.org/i/cve-2026-101296.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Tomcat", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "status": "affected", "lessThan": null, "lessThanOrEqual": "11.0.26" }, { "version": "10.1.0-M1", "status": "affected", "lessThan": null, "lessThanOrEqual": "10.1.60" }, { "version": "9.0.0.M1", "status": "affected", "lessThan": null, "lessThanOrEqual": "9.0.122" }, { "version": "8.5.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "8.5.100" }, { "version": "7.0.0", "status": "affected", "lessThan": null, "lessThanOrEqual": "7.0.109" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-304", "name": "Missing critical step in authentication" } ], "ssvc": { "exploitation": "none", "automatable": "no", "impact": "total", "at": "2026-10-20T00:00:00.000Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-101296" ], "ghsa": null, "cvss": { "score": 9.1, "version": "4.0", "by": "CISA-ADP" }, "epss": { "percentage": 0.00652, "percentile": 0.50612, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-101296" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-20T13:45:39.959Z", "updatedAt": "2026-10-20T13:45:39.959Z" }, { "id": "cve-2026-71253", "url": "https://cveboard.org/i/cve-2026-71253", "urlPt": "https://cveboard.org/pt/i/cve-2026-71253", "json": "https://cveboard.org/i/cve-2026-71253.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Johnzon", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Johnzon", "defaultStatus": "unaffected", "versions": [ { "version": "2.0.0", "status": "affected", "lessThan": "2.2.0", "lessThanOrEqual": null }, { "version": "1.0.0", "status": "affected", "lessThan": "1.3.1", "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "2.2.0", "1.3.1" ] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68", "tag": "vendor-advisory" }, { "url": "https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30", "tag": "patch" }, { "url": "https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6", "tag": "patch" } ], "cwes": [ { "id": "CWE-470", "name": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-20T19:34:08.742Z" }, "fix": "listed", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-71253" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "CISA-ADP" }, "epss": { "percentage": 0.00654, "percentile": 0.5072, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Johnzon", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-71253" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-19T10:36:41.781Z", "updatedAt": "2026-10-19T10:36:41.781Z" }, { "id": "cve-2026-78162", "url": "https://cveboard.org/i/cve-2026-78162", "urlPt": "https://cveboard.org/pt/i/cve-2026-78162", "json": "https://cveboard.org/i/cve-2026-78162.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Camel", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Camel", "defaultStatus": "unaffected", "versions": [ { "version": "4.0.0", "status": "affected", "lessThan": "4.18.5", "lessThanOrEqual": null }, { "version": "4.19.0", "status": "affected", "lessThan": "4.22.1", "lessThanOrEqual": null }, { "version": "4.18.5", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "4.22.1", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null }, { "version": "4.23.0", "status": "unaffected", "lessThan": null, "lessThanOrEqual": null } ], "omitted": 0, "fixed": [ "4.18.5", "4.22.1", "4.23.0" ] } ], "omitted": 0, "references": [ { "url": "https://camel.apache.org/security/CVE-2026-78162.html", "tag": "vendor-advisory" }, { "url": "https://github.com/apache/camel/pull/25566", "tag": "patch" }, { "url": "https://github.com/apache/camel/pull/25595", "tag": "patch" }, { "url": "https://github.com/apache/camel/pull/25599", "tag": "patch" }, { "url": "https://github.com/apache/camel/pull/25600", "tag": "patch" } ], "cwes": [ { "id": "CWE-502", "name": "Deserialization of Untrusted Data" } ], "ssvc": { "exploitation": "poc", "automatable": "yes", "impact": "total", "at": "2026-10-19T00:00:00.000Z" }, "fix": "listed", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-78162" ], "ghsa": null, "cvss": { "score": 10, "version": "4.0", "by": "apache" }, "epss": { "percentage": 0.01263, "percentile": 0.69495, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Camel", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-78162" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-19T10:03:57.474Z", "updatedAt": "2026-10-19T10:03:57.474Z" }, { "id": "cve-2026-90910", "url": "https://cveboard.org/i/cve-2026-90910", "urlPt": "https://cveboard.org/pt/i/cve-2026-90910", "json": "https://cveboard.org/i/cve-2026-90910.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Answer", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Answer", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "lessThan": null, "lessThanOrEqual": "2.0.2" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-306", "name": "Missing authentication for critical function" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-19T18:50:33.766Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-90910" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "CISA-ADP" }, "epss": { "percentage": 0.00637, "percentile": 0.49933, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Answer", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-90910" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-19T09:35:54.679Z", "updatedAt": "2026-10-19T09:35:54.679Z" }, { "id": "cve-2026-108709", "url": "https://cveboard.org/i/cve-2026-108709", "urlPt": "https://cveboard.org/pt/i/cve-2026-108709", "json": "https://cveboard.org/i/cve-2026-108709.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Apache Software Foundation Apache Kylin", "summary": "", "titlePt": null, "summaryPt": null, "affected": [ { "vendor": "Apache Software Foundation", "product": "Apache Kylin", "defaultStatus": "unaffected", "versions": [ { "version": "4.0.4", "status": "affected", "lessThan": null, "lessThanOrEqual": "5.0.4" } ], "omitted": 0, "fixed": [] } ], "omitted": 0, "references": [ { "url": "https://lists.apache.org/thread.html/okkvcvoj1007f6cxhwp9v6j6t4ynfnwb", "tag": "vendor-advisory" } ], "cwes": [ { "id": "CWE-287", "name": "Improper Authentication" } ], "ssvc": { "exploitation": "none", "automatable": "yes", "impact": "total", "at": "2026-10-20T18:06:55.535Z" }, "fix": "none", "tags": [ "apache-software-foundation" ], "cves": [ "CVE-2026-108709" ], "ghsa": null, "cvss": { "score": 9.8, "version": "3.1", "by": "CISA-ADP" }, "epss": { "percentage": 0.00663, "percentile": 0.5111, "asOf": "2026-10-23", "by": "FIRST" }, "packages": [], "vendor": "Apache Software Foundation", "product": "Apache Kylin", "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "cve.now", "url": "https://cve.now/CVE-2026-108709" } ], "cveVersion": 1, "cvePending": false, "publishedAt": "2026-10-16T19:38:21.601Z", "updatedAt": "2026-10-16T19:38:21.601Z" } ], "tag": { "tag": "apache-software-foundation", "name": "Apache Software Foundation", "kev": null } }