TL;DR The Apache Software Foundation released version 10.1.1 to patch six Apache Qpid Broker-J vulnerabilities. These critical security defects include unauthenticated denial of service attacks an…

TL;DR The Apache Karaf project has fixed four Apache Karaf vulnerabilities in version 4.4.12. Two are rated important and two moderate. Each lets a user with a low-privilege role, such as “v…

TL;DR The Apache Software Foundation disclosed CVE-2026-102508, a critical Apache PLC4X vulnerability in its OPC UA driver, on September 30, 2026. It scores 9.2 under CVSS 4.0. An attacker in a ne…

TL;DR Developers disclosed six Apache WSS4J vulnerabilities. These critical security defects include authentication bypasses and denial of service flaws. Administrators must update their libraries…

TL;DR The Apache Software Foundation resolved eight Apache MINA SSHD vulnerabilities. These critical security defects include authentication bypasses and server-side memory exhaustion flaws. Admin…

TL;DR On October 1, the Apache Software Foundation released Apache HTTP Server 2.4.69 with fixes for 20 security flaws. Five rate moderate, led by a mod_vhost_alias stack overflow that may allow c…

TL;DR The Apache Software Foundation disclosed eight CVEs on October 2, 2026, across three projects. The most urgent is an Apache OpenOffice vulnerability, CVE-2026-59265, that runs attacker code …

TL;DR The Apache Struts team has fixed four Apache Struts vulnerabilities in Struts 7.4.0 and 6.12.0. The most serious, CVE-2026-104711, allows OGNL injection that may lead to remote code executio…

TL;DR The Apache Thrift project has fixed 61 Apache Thrift vulnerabilities in version 0.25.0, published on October 2, 2026. Two flaws are rated critical at CVSS 9.2, 49 are high and 10 are medium.…

TL;DR The Apache Software Foundation has patched two Apache Jackrabbit vulnerabilities in its WebDAV components. The worst, CVE-2026-92414, scores 9.3 on CVSS 4.0 and lets an attacker hijack a cac…

TL;DR The Apache Software Foundation has fixed six Apache DolphinScheduler vulnerabilities in version 3.4.3. All six are missing or broken authorization checks that logged-in users can abuse. The …

Two high-severity Apache Camel Karavan vulnerabilities put open-source cloud integration environments at risk. Specifically, these flaws allow attackers to execute arbitrary code and inject malici…

TL;DR Amazon Web Services (AWS) published security bulletin 2026-136-AWS on October 15, 2026, addressing a critical Amazon Neptune vulnerability. Tracked as CVE-2026-110812 (CVSS 9.9), the flaw in…

TL;DR On October 16, 2026, Apache disclosed 12 Apache Kylin vulnerabilities, including a critical SQL injection flaw, CVE-2026-64959. Version 5.0.5 fixes all of them. Meanwhile, Apache Airflow pat…

TL;DR On October 20, 2026, the Apache Software Foundation disclosed eight Apache Tomcat vulnerabilities. Three rate Important, including a JNDIRealm authentication bypass and two flaws that can mi…

TL;DR On October 20, 2026, Apache disclosed six Apache CouchDB vulnerabilities, led by a CVSS 9.3 command execution flaw. CouchDB 3.5.3 fixes all of them. Apache also published four flaws in the r…

TL;DR The Apache Software Foundation disclosed 17 security flaws on October 21, 2026. These include 13 Apache Pulsar vulnerabilities and four Apache IoTDB bugs. The most severe issues include a 10…

TL;DR Apache disclosed 15 Apache Traffic Server vulnerabilities, including a CVSS 10.0 flaw in the experimental magick plugin. Several bugs allow request smuggling and cache poisoning. Versions 9.…

TL;DR The Apache Software Foundation released Apache bRPC 1.18.0 to patch 35 newly disclosed Apache bRPC vulnerabilities. This update resolves 16 high-severity and 19 moderate-severity flaws that …

TL;DR The Apache Camel project disclosed eight Apache Camel vulnerabilities across components such as camel-saxon, camel-aws2-s3 and camel-keycloak. The most severe, CVE-2026-90885, is a high-seve…