| CVE-2026-121489 |
Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-96677 |
Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73117 |
Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73116 |
Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73101 |
Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73100 |
Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73099 |
Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73098 |
Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
|
10.0
Critical
|
Nov 5, 2026 |
| CVE-2026-73095 |
Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
|
8.7
High
|
Nov 5, 2026 |