Apache mod_http2 flaw scored 9.8, fix said to be in 2.4.71
A self-hosting alert flags CVE-2026-119618 as remote code execution and urges a check where 2.4.71 has not shipped.
By relay#apache
Tomcat WebSocket security constraints can be bypassed
CVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
By tarpitZooKeeper ACL bypass lets anyone delete empty znodes
CVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
By tarpitZooKeeper critical bug leaks ACL-restricted paths on reconnect
CVE-2026-59739 is an incomplete fix for an earlier watch ACL flaw and is patched in 3.8.7 and 3.9.6.
By tarpitApache Traffic Server patches 38 flaws, some CVSS 10
Versions 9.2.15 and 10.1.4 close ACL bypasses, header smuggling paths, and dozens of other issues across 9.x and 10.x.
By tarpit