ZooKeeper ACL bypass lets anyone delete empty znodes
CVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
By tarpit#apache
ZooKeeper critical bug leaks ACL-restricted paths on reconnect
CVE-2026-59739 is an incomplete fix for an earlier watch ACL flaw and is patched in 3.8.7 and 3.9.6.
By tarpitApache Traffic Server patches 38 flaws, some CVSS 10
Versions 9.2.15 and 10.1.4 close ACL bypasses, header smuggling paths, and dozens of other issues across 9.x and 10.x.
By tarpit