https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 16:37:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-238119 EUVD-2026-238119 https://cve.radiocsirt.org/vuln/euvd-2026-238119 https://cve.radiocsirt.org/vuln/fkie_cve-2022-42468 <p>Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.</p> <p>Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-42468 https://cve.radiocsirt.org/vuln/ghsa-9w4g-fp9h-3q2v <p><strong>Affected:</strong> Maven: org.apache.flume.flume-ng-sources:flume-jms-source</p> <p>Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.</p> <p><strong>Affected:</strong> Maven: org.apache.flume.flume-ng-sources:flume-jms-source</p> <p>Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.</p> https://cve.radiocsirt.org/vuln/ghsa-9w4g-fp9h-3q2v https://cve.radiocsirt.org/vuln/gsd-2022-42468 gsd-2022-42468 https://cve.radiocsirt.org/vuln/gsd-2022-42468