Skip to content

cveboard RSS feed

Maven

Thursday, October 8
- CISA KEVGitHub CVE-2016-3081
  Apache Struts RCE Vulnerability
  - Apache Struts
  - High
  - CVSS 8.1
  - EPSS 96.05%
  - Fixed version listed
  CISA due Oct 11, 2026
- GitHub CVE-2026-107282
  AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
  - AsyncHttpClient async-http-client
  - Critical
  - CVSS 9.4
  - EPSS 0.19%
  - Fixed version listed
  16:30 UTC
- GitHub CVE-2026-107726
  Hazelcast allows arbitrary member memory access by low-privileged client
  - hazelcast hazelcast
  - Critical
  - CVSS 9.3
  - EPSS 0.38%
  - Fixed version listed
  22:10 UTC
Monday, October 5
- GitHub CVE-2026-103922
  Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
  - ionic-team capacitor
  - Critical
  - CVSS 9.3
  - EPSS 0.21%
  - Fixed version listed
  22:53 UTC
Thursday, September 24
- GitHub CVE-2026-61741
  http4s-scala-xml has an XML External Entity (XXE) processing issue
  - http4s http4s-scala-xml
  - Critical
  - CVSS 9.3
  - EPSS 0.29%
  - Fixed version listed
  19:35 UTC
Wednesday, September 23
- GitHub CVE-2026-85724
  Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
  - moquette-io moquette
  - Critical
  - CVSS 9.6
  - EPSS 0.27%
  - Fixed version listed
  16:11 UTC