| Sep 30 | Apache WSS4J: integer overflow High7.5Sep 30 | High7.5 | 4.0.2+2 more |
| Sep 30 | Apache WSS4J: insufficient authenticity checkCritical9.1Sep 30 | Critical9.1 | 4.0.2+2 more |
| Sep 30 | Apache WSS4J: protection mechanism failureHigh7.5Sep 30 | High7.5 | 4.0.2+2 more |
| Sep 30 | Apache WSS4J: authentication bypass by spoofingMedium4.8Sep 30 | Medium4.8 | 4.0.2+2 more |
| Sep 30 | Apache WSS4J: expression injectionCritical9.1Sep 30 | Critical9.1 | 4.0.2+2 more |
| Sep 30 | Apache WSS4J: authentication bypassCritical9.8Sep 30 | Critical9.8 | 4.0.2+2 more |
| Sep 30 | Apache WSS4J: resource exhaustionHigh7.5Sep 30 | High7.5 | 4.0.2+2 more |
| Sep 30 | Apache MINA SSHD: resource exhaustionMedium6.5Sep 30 | Medium6.5 | 2.20.0+1 more |
| Sep 30 | A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache...Critical9.1Sep 30 | Critical9.1 | 2.20.0+1 more |
| Sep 30 | Apache MINA SSHD: authentication bypassCritical9.1Sep 30 | Critical9.1 | 2.20.0+1 more |
| Sep 30 | Apache MINA SSHD: authentication bypassCritical9.1Sep 30 | Critical9.1 | 2.20.0+1 more |
| Sep 30 | Apache MINA SSHD: authentication bypassHigh8.1Sep 30 | High8.1 | 2.20.0+1 more |
| Sep 30 | Apache MINA SSHD: improper input validationMedium6.5Sep 30 | Medium6.5 | 2.20.0+1 more |
| Sep 30 | Apache MINA SSHD: resource exhaustionMedium6.5Sep 30 | Medium6.5 | 2.20.0+1 more |
| Sep 30 | Apache MINA SSHD: resource exhaustionHigh7.5Sep 30 | High7.5 | 2.20.0+1 more |
| Sep 30 | Apache PLC4X: denial of serviceHigh8.7Sep 30 | High8.7 | 1.0.0+1 more |
| Sep 30 | Apache PLC4X: integer overflowHigh8.7Sep 30 | High8.7 | 1.0.0 |
| Sep 30 | Apache PLC4X: improper array index validationHigh8.5Sep 30 | High8.5 | 1.0.0+2 more |
| Sep 30 | Apache PLC4X: improper certificate validationCritical9.2Sep 30 | Critical9.2 | 1.0.0 |
| Sep 29 | Apache Polaris: missing authorizationHigh8.1Sep 29 | High8.1 | 1.8.0 |
| Sep 29 | Apache DolphinScheduler: improper authorizationMedium4.3Sep 29 | Medium4.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: missing authorizationMedium6.5Sep 29 | Medium6.5 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: authentication bypassMedium5.3Sep 29 | Medium5.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: improper authorizationMedium4.3Sep 29 | Medium4.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: improper authorizationMedium4.3Sep 29 | Medium4.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: command injectionHigh8.8Sep 29 | High8.8 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: missing authenticationMedium6.5Sep 29 | Medium6.5 | 3.4.3 |
| Sep 29 | Apache XMLSchema: denial of serviceHigh7.5Sep 29 | High7.5 | 2.3.3 |
| Sep 29 | Apache XMLSchema: denial of serviceHigh7.5Sep 29 | High7.5 | 2.3.3 |
| Sep 29 | Apache XMLSchema: denial of serviceHigh7.5Sep 29 | High7.5 | 2.3.3 |
| Sep 29 | Apache Airflow Teradata provider: secrets in logsMedium6.5Sep 29 | Medium6.5 | 3.7.0 |
| Sep 29 | Apache Airflow's Google provider built Google Drive search expressions by...Medium4.3Sep 29 | Medium4.3 | 22.6.0 |
| Sep 29 | Apache Airflow Snowflake provider: weakly protected credentialsMedium6.3Sep 29 | Medium6.3 | 6.18.0 |
| Sep 29 | Apache Airflow Teradata provider: SQL injectionMedium6.3Sep 29 | Medium6.3 | 3.7.0 |
| Sep 29 | Apache Karaf: code executionCritical9.8Sep 29 | Critical9.8 | 4.4.12 |
| Sep 29 | Apache Karaf: missing authorizationMedium6.3Sep 29 | Medium6.3 | 4.4.12 |
| Sep 29 | Apache Karaf: improper access controlHigh8.8Sep 29 | High8.8 | 4.4.12 |
| Sep 29 | Apache Karaf: path traversalCritical9.8Sep 29 | Critical9.8 | 4.4.12 |
| Sep 28 | Apache Karaf: command injectionHigh8.8Sep 28 | High8.8 | 4.4.12 |
| Sep 28 | LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and...High7.3Sep 28 | High7.3 | 4.4.12 |
| Sep 28 | Apache Roller: cross-site scriptingMedium6.1Sep 28 | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: cross-site scriptingMedium6.1Sep 28 | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: cross-site scriptingMedium6.1Sep 28 | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: missing authenticationHigh8.2Sep 28 | High8.2 | No fix yet |
| Sep 28 | Apache Roller: unsafe deserializationCritical9.8Sep 28 | Critical9.8 | No fix yet |
| Sep 28 | Apache Roller: information disclosureMedium6.5Sep 28 | Medium6.5 | No fix yet |
| Sep 28 | Apache Roller: XML external entityHigh7.7Sep 28 | High7.7 | No fix yet |
| Sep 28 | Apache Roller: cross-site scriptingMedium5.4Sep 28 | Medium5.4 | No fix yet |
| Sep 28 | Apache Roller: cross-site scriptingMedium6.1Sep 28 | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: cross-site scriptingMedium6.1Sep 28 | Medium6.1 | No fix yet |
| Sep 28 | Apache Roller: server-side request forgeryHigh7.4Sep 28 | High7.4 | No fix yet |
| Sep 28 | Apache Roller: XML external entityHigh7.7Sep 28 | High7.7 | No fix yet |
| Sep 28 | Apache Roller: missing authorizationCritical9.9Sep 28 | Critical9.9 | No fix yet |
| Sep 28 | Apache Roller: improper authorizationCritical9.0Sep 28 | Critical9.0 | No fix yet |
| Sep 28 | Apache Roller: authentication bypassHigh7.7Sep 28 | High7.7 | No fix yet |
| Sep 28 | Apache Roller: cross-site request forgeryHigh8.1Sep 28 | High8.1 | No fix yet |
| Sep 28 | Apache Roller: cross-site scriptingMedium5.4Sep 28 | Medium5.4 | No fix yet |
| Sep 28 | Apache Roller: insecure direct object referenceHigh7.7Sep 28 | High7.7 | No fix yet |
| Sep 25 | Apache Qpid Broker-J: denial of serviceHigh7.5Sep 25 | High7.5 | No fix yet |
| Sep 23 | Improper Check for Certificate Revocation vulnerability in Apache TomcatMedium6.5Sep 23 | Medium6.5 | No fix yet |