n0mi1k

Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache MyFaces: Denial of Service via Unbounded Request Parsing

Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

Apache Syncope: Cross-Realm authorization bypass in delegated administration

Apache Syncope: Cross-Realm boundaries reconciliation bypass