ActiveMQ, FZF, Keycloak, Tomcat Vulnerabilities Disclosed
Apache ActiveMQ, fzf, Keycloak, and Tomcat face multiple vulnerabilities including DoS, info disclosure, and privilege escalation.
A cluster of vulnerabilities in Apache ActiveMQ could allow attackers to disrupt services or gain unauthorized access. CVE-2026-54475 and CVE-2026-49434 detail information disclosure and unauthorized broker instantiation flaws, respectively, stemming from issues with temporary destinations and LDAP entries. Additionally, CVE-2026-49432, CVE-2026-50734, CVE-2026-50750, CVE-2026-53916, and CVE-2026-53917 highlight various denial-of-service (DoS) vulnerabilities within ActiveMQ's connectors and frame processing, including flaws in STOMP and OpenWire protocols. These ActiveMQ issues collectively present a significant risk to environments utilizing the messaging broker.
Several denial-of-service vulnerabilities have been identified in the popular command-line fuzzy finder tool, fzf. CVE-2026-53433 and CVE-2026-53432 exploit inefficient HTTP body processing and an integer overflow in the fuzzy matching algorithm, respectively. These flaws could allow an attacker to crash the fzf application, disrupting workflows that rely on its fast searching capabilities.
Apache Tomcat has seen multiple security advisories, including a privilege escalation vulnerability in Keycloak. CVE-2026-12388 allows an attacker to escalate privileges to realm administrator through improper authorization in the identity provider mapper. Additionally, CVE-2026-14209 in Keycloak's admin UI bypasses user view restrictions via an extension vulnerability. Other Tomcat-related issues include CVE-2026-53404 (unexpected rule processing in rewrite valve), CVE-2026-50229 (XSS in a Tomcat example), CVE-2026-55955 (replay attack via EncryptionInterceptor), CVE-2026-53434 (error handling in CRL configuration), and CVE-2026-55276 (misleading security logs).
A range of vulnerabilities affect various JavaScript libraries and Python packages. CVE-2026-13149 in brace-expansion allows for DoS due to exponential-time complexity. The npm package decode-uri-component is vulnerable to DoS via crafted input (CVE-2026-45822). NLTK, a Python natural language processing library, suffers from an information disclosure vulnerability via path traversal (CVE-2026-12243). Lastly, PostgreSQL Anonymizer has an information disclosure flaw exploitable via brute-force attacks on its hash function (CVE-2026-13455).