Apache Software Foundation
Apache Syncope 4.0.9 and 4.1.4 Fix Authorization and Code-Execution FlawsNew!!
Apache publishes security fixes. Match the affected branch and feature use, deploy the supported version, validate operations, and retain change evidence.
Apache Arrow Rust Fixes RunEndEncoded Array Out-of-Bounds ReadsNew!!
Apache publishes security fixes. Match the affected branch and feature use, deploy the supported version, validate operations, and retain change evidence.
Apache Wicket Fixes Authorization, Session, Upload, and XSS FlawsNew!!
Apache Wicket fixes authorization, session, upload, and XSS flaws. Match components and versions, upgrade the affected branch, and test access controls.
Apache Camel 4.22.2 Fixes A2A Webhook SSRF
Apache Camel 4.22.2 fixes blind SSRF in A2A push webhooks. Confirm untrusted registration paths, update, restrict egress, and retain evidence.
Apache Qpid Proton C 0.41.1 Fixes Four Security Flaws
Apache Qpid Proton C 0.41.1 fixes four AMQP, SASL, TLS, and parser flaws. Inventory linked applications, update, validate, and retain evidence.
Apache Kafka October Update Fixes Twelve Vulnerabilities
Apache Kafka fixes twelve broker, OAuth, Connect, Streams, and client flaws. Match CVE ranges, update supported branches, validate, and retain evidence.
Apache DataSketches C++ 5.3.0 Hardens Five Deserialization Paths
Apache DataSketches C++ 5.3.0 fixes five deserialization flaws. Find untrusted sketch inputs, upgrade, validate consumers, and retain evidence.
Apache HTTP Server 2.4.69 Fixes Twenty Vulnerabilities
Apache HTTP Server 2.4.69 fixes twenty module- and configuration-dependent flaws. Inventory enabled CGI, WebDAV, HTTP/2, proxy and authentication paths, then use upstream or distribution fixes; a distribution's base version alone is not a patch verdict.
Apache MINA Corrects an Incomplete Deserialization Fix
MINA's announced deserialization fix missed the 2.0 and 2.1 maintenance branches. Verify the deployed artifact and use the corrected 2.0.31 or 2.1.15 release, reopening remediation records that relied on the earlier fix claim.
Apache Airflow 3.3.2 Fixes Authorization and Token Handling
Airflow fixes separate asset-event disclosure, cookie/bearer identity confusion and logout token-revocation failures. Match each issue's version and permissions, update the deployment, and validate event visibility and authentication behavior with authorized test accounts.