Apache Karaf

Apache Karaf Vulnerabilities Let Low-Privilege Users Reach Admin and Code Execution Apache Karaf vulnerabilities CVE-2026-92142, CVE-2026-91012 and CVE-2026-91048 allowing privilege escalation and remote code execution, fixed in Karaf 4.4.12

Apache Karaf vulnerabilities CVE-2026-92142, CVE-2026-91012 and CVE-2026-91048 allowing privilege escalation and remote code execution, fixed in Karaf 4.4.12

Apache Karaf Vulnerabilities Let Low-Privilege Users Reach Admin and Code Execution

Do Son September 29, 2026

TL;DR The Apache Karaf project has fixed four Apache Karaf vulnerabilities in version 4.4.12. Two are rated...

CVE-2026-24656: Deserialization Flaw in Apache Karaf Exposes Systems to DoS

CVE-2026-24656: Deserialization Flaw in Apache Karaf Exposes Systems to DoS

Do Son January 26, 2026

A significant security vulnerability has been identified in Apache Karaf Decanter, a monitoring solution widely used in...

CVE-2022-40145: Apache Karaf Remote Code Execution Vulnerability

CVE-2022-40145: Apache Karaf Remote Code Execution Vulnerability

Do Son December 21, 2022

Security researcher Xun Bai has found a remote code execution vulnerability in the popular Apache Karaf that...

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-86950CVSS 8.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and...
Admin intel📅 Updated: Sep 29, 2026
CVE-2026-88772
Memory overflow vulnerability leading to remote code execution or denial of service.
Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
CVE-2026-88771
Remote code execution due to improper input validation that can allow an unauthenticated attacker to execute arbitrary commands.
Admin intelCISA KEV📅 Added to KEV: Sep 27, 2026📅 Updated: Sep 27, 2026
CVE-2026-65660CVSS 8.8
Improper control of generation of code (\'code injection\') in Microsoft Office SharePoint allows an authorized attacker to execute...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 25, 2026
CVE-2026-5430CVSS 10.0
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-71362CVSS 9.1
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could...
CISA KEV📅 Added to KEV: Sep 24, 2026
CVE-2026-48842CVSS 8.1
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via...
Admin intel📅 Updated: Sep 23, 2026
CVE-2026-87902
Unauthenticated path traversal in page-template resolution leading to conditional RCE An unauthenticated attacker can make get_page_template() page-template resolution...
Admin intelCISA KEV📅 Added to KEV: Sep 25, 2026📅 Updated: Sep 23, 2026

CVE-2025-62023CVSS 9.0
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from...
📅 Updated: Sep 29, 2026
CVE-2026-84154CVSS 9.9
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could...
📅 Updated: Sep 29, 2026
CVE-2026-87799CVSS 9.9
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14,...
📅 Updated: Sep 29, 2026
CVE-2026-82384CVSS 9.8
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled...
📅 Updated: Sep 29, 2026
CVE-2026-85526CVSS 9.9
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with...
📅 Updated: Sep 29, 2026
CVE-2026-82378CVSS 9.0
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who...
📅 Updated: Sep 29, 2026
CVE-2026-82377CVSS 9.9
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging...
📅 Updated: Sep 29, 2026
CVE-2026-61741CVSS 9.3
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders...
📅 Updated: Sep 29, 2026