Posted by Benoit Tellier on Nov 06 Severity: low Affected versions: - Apache James before 3.9.1 Description: Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience. Credit: Wanxin Yin (finder) References: https://james.apache.org/...
CVE-2026-74756: Apache James: WebAdmin exposed without authentication on official Docker default
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/549
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
arXiv:2611.06036v1 Announce Type: new Abstract: Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and…
CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java 2.0.1 before 2.0.2 Description: Improper Neutralization of Input During Web…
CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability…
CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Improper Restriction of XML External Entity…
CVE-2026-85111: Apache James: Denial of service upon MIME parsing
Posted by Benoit Tellier on Nov 06 Severity: CVSS 4.0: 8.7 (high) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache James…