AK
Product
Apache Karaf
7
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 4Medium 1Low 0
Watch
Add Apache Karaf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-91048 | 9.8 | Sep 29 | Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create Affected: before 4.4.12 |
| CVE-2026-91012 | 9.8 | Sep 29 | Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation Affected: before 4.4.12 |
| CVE-2026-92142 | 8.8 | Sep 29 | Apache Karaf: Authorization bypass in JMX MBean lifecycle operations Affected: before 4.4.12 |
| CVE-2026-91006 | 8.8 | Sep 28 | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) Affected: before 4.4.12 |
| CVE-2026-92230 | 7.5 | Sep 17 | Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching Affected: before 4.4.11 |
| CVE-2026-90979 | 7.3 | Sep 28 | Apache Karaf: LDAP filter injection in JAAS LDAP login modules Affected: before 4.4.12 |
| CVE-2026-91085 | 6.3 | Sep 29 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin Affected: before 4.4.12 |
Showing 7