CVEs published in October 2026

CVE-2026-101607Critical

Denial of Service in Server Optimizer

CVE-2026-101516High

Enhance Certificate Constraint Checking (Oracle CPU 2026-10)

CVE-2026-107755Medium

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own

CVE-2026-90800High

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint

CVE-2026-90799Low

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion

CVE-2026-90798Low

missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop

CVE-2026-90797High

unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion

CVE-2026-86471Critical

unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user

CVE-2026-103119Critical

Information disclosure via buffer under-read during non-blocking writes

CVE-2026-101356Critical

Information disclosure via incorrect object recycling in HTTP/2 processing

CVE-2026-101296Critical

Apache Tomcat Vulnerability in NetApp Products

CVE-2026-93446High

Possible TLS 1.3 connection failures

CVE-2026-88041High

Information disclosure via incomplete HTTP trailer cleanup

CVE-2026-80353High

Unauthorized socket access via TOCTOU race condition

CVE-2026-74049Low

Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

CVE-2026-74048Low

Cryptographic policy bypass via FIPS activation failure

CVE-2026-108089High

** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon

CVE-2026-108088Unrated

Apache Cocoon: Cross-user cache poisoning

CVE-2026-108087Unrated

Apache Cocoon: SQL Injection

CVE-2026-108086Unrated

Apache Cocoon: XEE could lead to SSRF and information disclosure

CVE-2026-92287Medium

Information disclosure via unvalidated KMS URLs in Parquet files

CVE-2026-86467Unrated

Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

CVE-2026-12489Medium

incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device

CVE-2026-88464Unrated

MikroTik RouterOS: stack buffer overflow vulnerability has been identified in the SNMP service of RouterOS (the service behind /snmp, listening on UDP port 161)

CVE-2026-75596High

DoS (Denial of Service) io.netty:netty-handler Dependency in Bamboo Data Center

CVE-2026-75595Critical

BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Confluence Data Center

CVE-2026-71891High

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

CVE-2026-68495High

DoS (Denial of Service) com.fasterxml.jackson.dataformat:jackson-dataformat-cbor, tools.jackson.dataformat:jackson-dataformat-cbor Dependency in Confluence Data Center

CVE-2026-59651High

Security Misconfiguration org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

CVE-2026-59645High

DoS (Denial of Service) org.bouncycastle:bcutil-jdk18on Dependency in Bamboo Data Center

CVE-2026-59641High

Cryptographic Failure in org.bouncycastle:bcmail-lts8on Dependency in Confluence Data Center

CVE-2026-58061High

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

CVE-2026-18036High

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Jira Software Data Center

CVE-2026-14682High

DoS (Denial of Service) org.bouncycastle:bc-fips, org.bouncycastle:bcprov-jdk18on Dependency in Bitbucket Data Center

CVE-2026-12860High

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

CVE-2026-12802High

Cryptographic Failure org.bouncycastle:bcpkix-lts8on Dependency in Bitbucket Data Center

CVE-2026-12185High

RCE (Remote Code Execution) org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

CVE-2026-88900High

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component

CVE-2026-91858Medium

Information disclosure via XML external entity injection

CVE-2026-88901High

Information disclosure via XML external entity injection

CVE-2026-85317Medium

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component

CVE-2026-85316Medium

Unauthorized request forwarding via improper path prefix matching

CVE-2026-85315Medium

Information disclosure via unhandled gRPC route exception messages

CVE-2026-85314Medium

Email configuration manipulation via unfiltered multipart headers

CVE-2026-85313Medium

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component

CVE-2026-85312Medium

Unauthorized transaction association via unfiltered message header

CVE-2026-85300Medium

Incorrect Default Permissions vulnerability in Apache Camel PQC component

CVE-2026-85301Medium

Improper Authentication vulnerability in Apache Camel Keycloak component

CVE-2026-85296Medium

Information disclosure via shared request signing state

CVE-2026-85260Medium

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component

CVE-2026-85257Medium

Information disclosure via undeclared route exceptions

CVE-2026-85254Medium

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component

CVE-2026-71253Critical

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon

CVE-2026-85251High

Information disclosure via improper credential handling during HTTP redirects

CVE-2026-85250High

Information disclosure via XML external entity references

CVE-2026-85249Medium

Improper Input Validation vulnerability in Apache Camel Tika component

CVE-2026-85248Medium

Signature verification bypass via unsynchronized signature instance

CVE-2026-85247Medium

Information disclosure via improper certificate validation

CVE-2026-85246Medium

Information disclosure via exception error messages

CVE-2026-85245Medium

Information disclosure via shared object reuse

CVE-2026-85243Medium

Message tampering via missing integrity check enforcement

CVE-2026-84181Medium

Improper Authentication vulnerability in Apache Camel Shiro component

CVE-2026-84180Medium

Information disclosure via error responses

CVE-2026-84178Medium

Login Cross-Site Request Forgery via missing state parameter validation

CVE-2026-84176Medium

org.apache.camel/camel-platform-http-vertx: camel-platform-http-vertx: Information disclosure via overly permissive CORS configuration

CVE-2026-83531High

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel

CVE-2026-80344High

Server-Side Request Forgery via unvalidated receipt destination

CVE-2026-80343High

Security constraint bypass via case sensitivity mismatch

CVE-2026-80312High

Improper Authentication vulnerability in Apache Camel OAuth component

CVE-2026-79986High

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component

CVE-2026-79985High

Unauthorized file access via path traversal

CVE-2026-79984High

Unauthorized file access via path traversal

CVE-2026-79983High

Unauthorized remote file access via path traversal

CVE-2026-78165High

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component

CVE-2026-78164High

information disclosure via improper property placeholder evaluation in HTTP headers

CVE-2026-78163Medium

Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component

CVE-2026-78162Critical

CVE-2026-90910Critical

Missing authentication for critical function vulnerability in Apache Answer

CVE-2026-86589Unrated

Apache Answer: User Center integration does not revoke first-login sessions after central account suspension

CVE-2026-79633Unrated

Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

CVE-2026-79624Unrated

Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

CVE-2026-79620Unrated

Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata

CVE-2026-79613Unrated

Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles

CVE-2026-76994Unrated

Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles

CVE-2026-71563Unrated

Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions

CVE-2026-68482Unrated

Apache Answer: Improper Authorization in Question Invite User Lookup

CVE-2026-67249Unrated

Apache Answer: Email Code Purpose Confusion May Allow Account Takeover

CVE-2026-64945Unrated

Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

CVE-2026-64944Unrated

Apache Answer: Stored XSS via unsanitized HTML in imported question content

CVE-2026-64943Unrated

Apache Answer: API keys logged in plaintext during authentication

CVE-2026-108837Unrated

Apache Kylin: Potential computed-column resource exhaustion

CVE-2026-108833Unrated

Apache Kylin: default startup profile miss security settings

CVE-2026-108823Unrated

Apache Kylin: Potential unauthenticated job metadata replacement

CVE-2026-108780Unrated

Apache Kylin: Potential JDBC source configuration validation issue

CVE-2026-108776Unrated

Apache Kylin: tables/names SparkSQL injection

CVE-2026-108771Unrated

Apache Kylin: unauthenticated broadcast API and polymorphic deserialization

CVE-2026-108766Unrated

Apache Kylin: missing JDBC-config authorization

CVE-2026-108764Unrated

Apache Kylin: job-driver UI proxy SSRF

CVE-2026-108762Unrated

Apache Kylin: delete metadata backup path-confinement bypass

CVE-2026-98489Medium

fix soft lockup on out-of-range tpd_cons read