| CVE-2026-92142 |
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC)…
|
Not rated
|
Sep 29, 2026 |
| CVE-2026-91085 |
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files…
|
Not rated
|
Sep 29, 2026 |
| CVE-2026-91048 |
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
|
Not rated
|
Sep 29, 2026 |
| CVE-2026-91012 |
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the…
|
Not rated
|
Sep 29, 2026 |
| CVE-2026-91006 |
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf…
|
Not rated
|
Sep 28, 2026 |
| CVE-2026-90979 |
LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting…
|
Not rated
|
Sep 28, 2026 |
| CVE-2026-92230 |
Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container…
|
Not rated
|
Sep 17, 2026 |
| CVE-2026-24656 |
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter
|
Not rated
|
Jan 26, 2026 |
| CVE-2022-40145 |
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in…
|
Not rated
|
Dec 21, 2022 |
| CVE-2022-22932 |
Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out…
|
Not rated
|
Jan 26, 2022 |
| CVE-2021-41766 |
Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX)
|
Not rated
|
Jan 26, 2022 |
| CVE-2018-11788 |
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file…
|
Not rated
|
Jan 7, 2019 |
| CVE-2018-11787 |
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available…
|
Not rated
|
Sep 18, 2018 |
| CVE-2018-11786 |
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the…
|
Not rated
|
Sep 18, 2018 |
| CVE-2016-8750 |
Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP
|
Not rated
|
Feb 19, 2018 |