Security42 mOctober 22, 2026, 13:20

Apache patches 17 flaws in Pulsar and IoTDB, including a CVSS 10.0

The Apache Software Foundation disclosed 17 vulnerabilities on 21 October 2026: 13 in Pulsar and four in IoTDB. The top-scored CVE-2026-105944 (10.0) affects the end-of-life Pulsar Manager, so decommissioning is the only remediation. Pulsar fixes ship in 4.0.14 and 4.2.5.

DEV Community

Open source

Apache patches 17 flaws in Pulsar and IoTDB, including a CVSS 10.0

CVE-2026-105944 (10.0) in Pulsar Manager lets unauthenticated users steal admin credentials
CVE-2026-105869 (9.2) bypasses auth via forged JWTs when anonymousUserRole is set
Flaws rated 8.7–5.3 break tenant isolation in shadow topics, packages, proxying and truncation
Pulsar Manager is end-of-life and will not be patched; decommissioning is advised

#Apache#Pulsar#IoTDB

GitLab patches CVSS 10.0 flaw allowing unauthenticated remote code execution

Security

Azure AI Foundry flaw with CVSS 10.0 was patched in about two hours

Security

Cisco patches seven Meraki and NX-OS flaws, including CVE-2026-76464 with CVSS 9.6

Security

Apache patches 17 flaws in Pulsar and IoTDB, including a CVSS 10.0

GitLab patches CVSS 10.0 flaw allowing unauthenticated remote code execution

Azure AI Foundry flaw with CVSS 10.0 was patched in about two hours

Cisco patches seven Meraki and NX-OS flaws, including CVE-2026-76464 with CVSS 9.6

SonicWall patches CVSS 10.0 SSRF in SMA1000 as exploits hit decoys two days later