Posted by Eric Covener on Oct 01 Severity: low Affected versions: - Apache HTTP Server 2.4.0 through 2.4.68 Description: Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is...
CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/26
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a…
Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. A secrets manager is the locked store where an application fetches the database…
CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective
Posted by Thomas Wolf on Sep 29 Severity: critical CVSS 3.1: 9.1 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected versions: - Apache MINA SSHD 1.2.0…
CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
Posted by Jean-Baptiste Onofré on Sep 29 Severity: important Affected versions: - Apache Polaris before 1.8.0 Description: Apache Polaris allows an authenticated…
CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
Posted by Shahar Epstein on Sep 29 Severity: moderate Affected versions: - Apache Airflow Teradata provider before 3.7.0 Description: Apache Airflow's Teradata provider…
Multiple vulnerabilities in Jenkins
Posted by Kevin Guerroudj on Oct 28 Jenkins is an open source automation server which enables developers around the world to reliably build, test, and deploy their…