Posted by Markus Jung on Nov 12 On 10 November 2026, the Apache TomEE project published 38 security advisories on users () tomee apache org. This message consolidates those announcements for oss-security. Apache TomEE 10.3.0 and 11.0.0-M2 fix 26 of the vulnerabilities.
Apache TomEE: 38 CVEs addressed in 10.3.0 and 11.0.0-M2 (combined announcement)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/681
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-126641: ansible-pylibssh / ansible.netcommon libssh: changed SSH host key accepted when host_key_auto_add is enabled
Posted by Ryo utomo on Nov 12 Hello, This is a public disclosure of CVE-2026-126641, a host key verification flaw in ansible-pylibssh and in the ansible.netcommon libssh…
PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released, fixes 52 security vulnerabilities
Posted by Alan Coopersmith on Nov 12 https://www.postgresql.org/about/news/postgresql-187-1712-1616-1520-1425-and-19-rc-2-released-3442/ announces:
0% GPU utilization: How SANSAR hides Linux cryptomining
Elastic Security Labs is tracking REF3364, a Linux cryptomining intrusion that combines custom malware with publicly available miners. The toolkit includes SANSAR, a…
CVE-2026-124023: Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper
Posted by Robert Lazarski on Nov 11 Severity: low Affected versions: - Apache Axis2/C f2b30c159720cf63ada72f19183828533154c749 before…
The global socket: how threat actors are weaponizing GSocket for stealthy C2
When one RCE stops being just one RCE Observed attack chains How threat actors deploy and operate GSocket How GSocket reconnects without a fixed C2 address Mitigation…
Re: Node.js security release pre-alert
Posted by Antoine du Hamel on Nov 11 Releases are out, more info at https://nodejs.org/en/blog/vulnerability/november-2026-security-releases