Apache Software Foundation Apache Juneau

• CVE-2026-121489 Critical 10.0 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 0.5%
• CVE-2026-96677 Critical 10.0 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 0.4%
• CVE-2026-73117 Critical 10.0 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 0.4%
• CVE-2026-73116 Critical 10.0 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 0.4%
• CVE-2026-73101 Critical 10.0 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults 0.4%
• CVE-2026-73100 Critical 10.0 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors 0.4%
• CVE-2026-73099 Critical 10.0 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override 0.2%
• CVE-2026-73098 Critical 10.0 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing 0.5%
• CVE-2026-73095 High 8.7 Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling 0.4%