n0mi1k

Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache MyFaces: Denial of Service via Unbounded Request Parsing

Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location