apache Archives • Daily CyberSecurity

Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials Apache DolphinScheduler vulnerabilities CVE-2026-71896 and CVE-2026-71895 authorization bypass leaking Kubernetes credentials fixed in 3.4.3

Apache DolphinScheduler vulnerabilities CVE-2026-71896 and CVE-2026-71895 authorization bypass leaking Kubernetes credentials fixed in 3.4.3

Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials

Do Son October 8, 2026

TL;DR The Apache Software Foundation has fixed six Apache DolphinScheduler vulnerabilities in version 3.4.3. All six are...

Apache Jackrabbit Fixes Critical WebDAV Session Hijack Flaw CVE-2026-92414 Apache Jackrabbit vulnerabilities CVE-2026-92414 WebDAV session hijack and CVE-2026-92415 unsafe reflection fixed in 2.23.6

Apache Jackrabbit vulnerabilities CVE-2026-92414 WebDAV session hijack and CVE-2026-92415 unsafe reflection fixed in 2.23.6

Apache Jackrabbit Fixes Critical WebDAV Session Hijack Flaw CVE-2026-92414

Do Son October 7, 2026

TL;DR The Apache Software Foundation has patched two Apache Jackrabbit vulnerabilities in its WebDAV components. The worst,...

Apache Thrift 0.25.0 Fixes 61 Vulnerabilities, Including Two Critical Heap Overflows Apache Thrift vulnerabilities fixed in Apache Thrift 0.25.0 including CVE-2026-83632 and CVE-2026-91135

Apache Thrift vulnerabilities fixed in Apache Thrift 0.25.0 including CVE-2026-83632 and CVE-2026-91135

Apache Thrift 0.25.0 Fixes 61 Vulnerabilities, Including Two Critical Heap Overflows

Do Son October 6, 2026

TL;DR The Apache Thrift project has fixed 61 Apache Thrift vulnerabilities in version 0.25.0, published on October...

Apache OpenOffice vulnerability CVE-2026-59265 alongside Apache Directory LDAP API flaw CVE-2026-103877 and Traffic Server CVE-2026-102795

Unpatched Apache OpenOffice Vulnerability Leads New Apache Advisories for LDAP API and Traffic Server

Do Son October 3, 2026

TL;DR The Apache Software Foundation disclosed eight CVEs on October 2, 2026, across three projects. The most...

Apache HTTP Server 2.4.69 fixes CVE-2026-63292 mod_vhost_alias stack overflow

Apache HTTP Server 2.4.69 Fixes 20 Flaws, Including mod_vhost_alias Stack Overflow

Do Son October 2, 2026

TL;DR On October 1, the Apache Software Foundation released Apache HTTP Server 2.4.69 with fixes for 20...

Critical Apache Storm Vulnerabilities Fixed in Update Diagram of critical Apache Storm vulnerabilities and Apache Storm vulnerabilities architecture

Diagram of critical Apache Storm vulnerabilities and Apache Storm vulnerabilities architecture

Critical Apache Storm Vulnerabilities Fixed in Update

Do Son September 14, 2026

TL;DR The Apache Software Foundation addressed seventeen distinct vulnerabilities impacting Apache Storm version 3.0.0. These flaws enable...

Public Disclosure: Unpatched Log4j RCE Flaw in FilteredObjectInputStream, No CVE Assigned Log4j vulnerability enabling unauthenticated remote code execution via FilteredObjectInputStream deserialization, publicly disclosed on Apache issue tracker

Log4j vulnerability enabling unauthenticated remote code execution via FilteredObjectInputStream deserialization, publicly disclosed on Apache issue tracker

Public Disclosure: Unpatched Log4j RCE Flaw in FilteredObjectInputStream, No CVE Assigned

Do Son August 26, 2026

Update 3: Piotr Karwasz, a member of the Apache Software Foundation, stated that this alert re-covers an...

CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0 Apache InLong SQL injection CVE-2026-63038 path traversal SSRF vulnerability diagram

Apache InLong SQL injection CVE-2026-63038 path traversal SSRF vulnerability diagram

CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0

Do Son August 20, 2026

TL;DR Apache InLong patched three flaws in version 2.4.0. The most notable is an Apache InLong SQL...

Three SQL Injection Flaws Patched in Apache Fineract Core Banking Platform Apache Fineract SQL injection vulnerability affecting Office, Client, and report APIs

Apache Fineract SQL injection vulnerability affecting Office, Client, and report APIs

Three SQL Injection Flaws Patched in Apache Fineract Core Banking Platform

Do Son July 21, 2026

TL;DR Apache has patched three SQL injection flaws in Fineract, the open-source core banking platform. The Apache...

CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials Apache OpenMeetings vulnerability CVE-2026-49488 arbitrary file read path traversal flaw

Apache OpenMeetings vulnerability CVE-2026-49488 arbitrary file read path traversal flaw

CVE-2026-49488: Arbitrary File Read Flaw in Apache OpenMeetings Exposes Server Credentials

Do Son July 21, 2026

TL;DR Apache has patched a critical OpenMeetings vulnerability tracked as CVE-2026-49488. The path traversal flaw grants arbitrary...

Apache HttpComponents Core Patches Two DoS Vulnerabilities in HTTP Parsers Apache HttpComponents Core vulnerabilities CVE-2026-54399 denial of service advisory

Apache HttpComponents Core vulnerabilities CVE-2026-54399 denial of service advisory

Apache HttpComponents Core Patches Two DoS Vulnerabilities in HTTP Parsers

Do Son July 2, 2026

TL;DR The Apache Software Foundation has disclosed two Apache HttpComponents Core vulnerabilities, CVE-2026-54399 and CVE-2026-54428. Both carry...

Ghost Folders: “Directory Shadowing” Hack Hijacks WordPress SEO WordPress Directory Shadowing SEO Spam Malware

Ghost Folders: “Directory Shadowing” Hack Hijacks WordPress SEO

Do Son February 5, 2026

A new and stealthy malware campaign is targeting WordPress sites, turning trusted pages into billboards for online...

Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption CVE-2022-23307 Log4j TLS Bypass, Socket Appender Vulnerability

Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption

Do Son December 19, 2025

The Apache Software Foundation has released a security update for its widely used Log4j logging library, addressing...

Critical Plesk Flaw (CVE-2025-66430) Risks Full Server Takeover via LPE and Apache Config Injection Plesk privilege escalation flaw CVE-2026-44962 patch Plesk LPE, Root Command Execution

Plesk privilege escalation flaw CVE-2026-44962 patch Plesk LPE, Root Command Execution

Critical Plesk Flaw (CVE-2025-66430) Risks Full Server Takeover via LPE and Apache Config Injection

Do Son December 15, 2025

A critical security vulnerability has been discovered in Plesk, a leading web hosting and data center automation...

Apache HTTP Server 2.4.64 Released: Patches 8 Vulnerabilities, Including HTTP Splitting, SSRF & DoS CVE-2024-38472 Apache HTTP Server, Security Patches

Apache HTTP Server 2.4.64 Released: Patches 8 Vulnerabilities, Including HTTP Splitting, SSRF & DoS

Do Son July 11, 2025

The Apache Software Foundation has issued a new release—Apache HTTP Server version 2.4.64—patching eight security vulnerabilities that...

ModSecurity DoS Flaw: PoC Available for Apache Vulnerability (No Workaround, Patch Pending) libmodsecurity3 Denial of Service WAF Security Vulnerability CVE-2025-27110 ModSecurity vulnerability, JSON DoS

libmodsecurity3 Denial of Service WAF Security Vulnerability CVE-2025-27110 ModSecurity vulnerability, JSON DoS

ModSecurity DoS Flaw: PoC Available for Apache Vulnerability (No Workaround, Patch Pending)

Do Son May 23, 2025

A newly disclosed vulnerability in ModSecurity’s Apache module, tracked as CVE-2025-47947, exposes web servers to a potentially...

Apache mod_auth_openidc Vulnerability Exposes Protected Content mod_auth_openidc, Apache security

Apache mod_auth_openidc Vulnerability Exposes Protected Content

Do Son April 9, 2025

In a recently published security advisory, OpenIDC has revealed a vulnerability in mod_auth_openidc, the widely used OpenID...

Apache OpenMeetings Users Urged to Patch Critical Flaw – CVE-2024-54676 (CVSS 9.8)

Do Son January 8, 2025

A critical security vulnerability (CVE-2024-54676, CVSS 9.8) has been discovered in Apache OpenMeetings, a popular open-source platform...

CVE-2024-45720: Code Execution Flaw Discovered in Apache Subversion for Windows Apache Subversion - CVE-2024-45720

CVE-2024-45720: Code Execution Flaw Discovered in Apache Subversion for Windows

Do Son October 9, 2024

A critical security vulnerability, CVE-2024-45720 (CVSS 8.2), has been identified in Apache Subversion (SVN), a popular version...

CVE-2024-47561: Critical Flaw in Apache Avro Java SDK Allows Arbitrary Code Execution Apache Avro - CVE-2024-47561

CVE-2024-47561: Critical Flaw in Apache Avro Java SDK Allows Arbitrary Code Execution

Do Son October 3, 2024

A critical security vulnerability (CVE-2024-47561) has been discovered in the Apache Avro Java SDK, potentially allowing attackers...

Critical Security Advisory for Apache CloudStack: CVE-2024-38346 and CVE-2024-39864 CVE-2024-38346 & CVE-2024-39864

Critical Security Advisory for Apache CloudStack: CVE-2024-38346 and CVE-2024-39864

Do Son July 8, 2024

The Apache Software Foundation has issued an urgent security advisory, disclosing two critical vulnerabilities (CVE-2024-38346 and CVE-2024-39864)...

CVE-2024-27348: Apache HugeGraph RCE Vulnerability, PoC Exploit Published CVE-2024-27348 exploit

CVE-2024-27348: Apache HugeGraph RCE Vulnerability, PoC Exploit Published

Do Son June 4, 2024

The Apache Software Foundation has issued a critical security advisory warning users of a remote code execution...