A flaw was found in Claude Code, an agentic coding tool, in its handling of worktrees. This vulnerability allowed the creation of specially named worktrees and navigation outside of the intended secure environment, leading to what is known…

▾ TwilightRed Hat · OpenShift LightspeedEPSS 0.69%via CSAF

CVE-2026-55955Medium· 6.5⚖ disputed

4mo ago

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…

▾ Sunlitapache · tomcatEPSS 0.44%via NVD

CVE-2026-55276Critical· 9.1⚖ disputed

4mo ago

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.…

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.…

▾ Midnightapache · tomcatEPSS 0.61%via NVD

CVE-2026-53434Critical· 9.1⚖ disputed

4mo ago

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 th…

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 th…

▾ Midnightapache · tomcatEPSS 0.59%via NVD

Tagged “ghsa”

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

oban_web missing authorization check on `save-job` event handler

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Open Babel has an out-of-bounds read in CIF transform3d::DescribeAsString

Open Babel has NULL pointer dereference in MOL2 OBAtom::SetFormalCharge

Open Babel has a NULL pointer dereference in CDXML OBAtom::GetExplicitValence

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

Paymenter has race condition in payWithCredit() that enables credit double-spend

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

Apache Tomcat has an Improper Authorization vulnerability

Apache Tomcat has a Missing Critical Step in Authentication vulnerability

Claude Code: @anthropic-ai/claude-code: Claude Code: Arbitrary code execution through git directory confusion (CVE-2026-55607)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55,…

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.…

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 th…