CVE Vulnerability Catalog

A Data Exposure vulnerability in the Firewall Analyzer syslog collector affects Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.

An XML Injection vulnerability in the Rule Tracking Compare Policies feature affects Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.

A Command Injection vulnerability in the Diagnose Settings feature affects Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below.

An Authentication Bypass vulnerability affects Zoho ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled.

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.

Vulnerability in Keycloak's Pushed Authorization Request (PAR) implementation. When silent authentication (prompt=none) is used, the authorization process skips certain steps, failing to enforce that a pushed request URI is used only once. An attacker can reuse the URI to obtain multiple authorization codes for a logged-in user, violating security standards like FAPI-2.

Vulnerability in Keycloak's Conditional OTP authenticator. The system evaluates specific HTTP headers to decide whether to skip OTP but does not verify if those headers are from a trusted source. An attacker with the user's password can bypass second-factor authentication by providing a crafted header.

Improper handling of length parameter inconsistency in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. Affects versions from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121; also known affected: 8.5.0-8.5.100 and 7.0.56-7.0.109.

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

A Broken Access Control vulnerability in Zoho ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.

A vulnerability in ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.710 and below) allows an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope. This is a broken access control issue.

A vulnerability in ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.710 and below) allows an authenticated low-privilege user to gain Administrator privileges through Report Profile import. This is a privilege escalation issue.

Open redirect vulnerability in AVESİS by Abis Technology allows input data manipulation, potentially redirecting users to untrusted sites.

A vulnerability in Apache Tomcat causes lost timeouts for asynchronous WebSocket writes, leading to denial of service (DoS). The issue affects many Tomcat versions, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121.

A vulnerability in Apache Tomcat related to incomplete cleanup can cause a malformed request to potentially (depending on timing) cause one request from another user to fail. Affects versions 11.0.19-11.0.25, 10.1.53-10.1.59, and 9.0.116-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource allocation allows an unauthenticated AJP request to pin an AJP processing thread, leading to denial of service. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M1-9.0.121.

Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

A vulnerability in Apache Tomcat involving uncontrolled resource consumption during sending of WebSocket close message enables a DoS attack. Affects versions 11.0.0-M5-11.0.25, 10.1.8-10.1.59, and 9.0.74-9.0.121.

A vulnerability in Apache Tomcat involving a race condition allows an attacker to inject trailer fields into another HTTP/2 request. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.39-9.0.121.