CVEs in the news
27 CVEs this week0 in CISA KEV
| CVE | Vulnerability | CVSS | Exploitation | EPSS | Articles | Seen |
|---|---|---|---|---|---|---|
| CVE-2026-77185 | Apache MINA SSHD: Asynchronous authentication can bypass signature verificationApache Software Foundation Apache MINA SSHD | CVSS9.1Critical | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-65637 | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteApache Software Foundation Apache Tomcat | CVSS9.8Critical | Not in KEV | EPSS0.6% | 2articles | |
| CVE-2026-65182 | Apache Tomcat: Bypass longest prefix security constraintApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.5% | 2articles | |
| CVE-2026-68525 | Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.5% | 2articles | |
| CVE-2026-48830 | Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsApache Software Foundation Apache bRPC | CVSSUnrated | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-86249 | Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authApache Software Foundation Apache bRPC | CVSSUnrated | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-78334 | Apache bRPC: Missing Authentication for Streaming RPC FramesApache Software Foundation Apache bRPC | CVSSUnrated | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-84747 | Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path SegmentsApache Software Foundation Apache bRPC | CVSSUnrated | Not in KEV | EPSS0.2% | 1article | |
| CVE-2026-86146 | Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header ParsingApache Software Foundation Apache bRPC | CVSSUnrated | Not in KEV | EPSS0.2% | 1article | |
| CVE-2026-86147 | Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprofApache Software Foundation Apache bRPC | CVSSUnrated | Not in KEV | EPSS0.2% | 1article | |
| CVE-2026-111813 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationApache Software Foundation Apache Traffic Server | CVSS10.0Critical | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-105944 | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeApache Software Foundation Apache Pulsar Manager | CVSS10.0Critical | Not in KEV | EPSS0.7% | 1article | |
| CVE-2026-105869 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleApache Software Foundation Apache Pulsar | CVSS9.2Critical | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-105937 | Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataApache Software Foundation Apache Pulsar | CVSS8.7High | Not in KEV | EPSS0.2% | 1article | |
| CVE-2026-105945 | Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package StorageApache Software Foundation Apache Pulsar | CVSS7.7High | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-59229 | Apache IoTDB: Legacy Pipe Privilege EscalationApache Software Foundation Apache IoTDB | CVSSUnrated | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-58663 | Apache IoTDB: Auth Bypass in pipeTransfer() interfaceApache Software Foundation Apache IoTDB | CVSSUnrated | Not in KEV | EPSS0.3% | 1article | |
| CVE-2026-86471 | Apache CouchDB: Admin credentials leading to code execution as operating system userApache Software Foundation Apache CouchDB | CVSS9.3Critical | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-90800 | Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesApache Software Foundation Apache CouchDB | CVSS8.1High | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-90797 | Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionApache Software Foundation Apache CouchDB | CVSS7.7High | Not in KEV | EPSS0.7% | 1article | |
| CVE-2026-107755 | Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLsApache Software Foundation Apache CouchDB | CVSS6.0Medium | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-108089 | Apache Cocoon: Unauthenticated access to diagnostic interfacesApache Software Foundation Apache Cocoon | CVSS7.5High | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-90799 | Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence valuesApache Software Foundation Apache CouchDB | CVSS1.3Low | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-101296 | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-101356 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processingApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.5% | 1article | |
| CVE-2026-103119 | Apache Tomcat: AJP response mix-upApache Software Foundation Apache Tomcat | CVSS9.1Critical | Not in KEV | EPSS0.6% | 1article | |
| CVE-2026-64959 | Apache Kylin: Missing authentication on certain cache API endpointsApache Software Foundation Apache Kylin | CVSSUnrated | Not in KEV | EPSS0.7% | 1article |
27 CVEs of 27 in the news this week · 376 exploited CVEs tracked overall.