Apache Software Foundation Apache Karaf

• CVE-2026-92142 High 8.8 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations 0.6%
• CVE-2026-91085 Medium 6.3 Apache Karaf: config:install missing ACL entry allows privilege escalation to admin 0.4%
• CVE-2026-91048 Critical 9.8 Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create 0.5%
• CVE-2026-91012 Critical 9.8 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation 0.6%
• CVE-2026-91006 High 8.8 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) 1.1%
• CVE-2026-90979 High 7.3 Apache Karaf: LDAP filter injection in JAAS LDAP login modules 0.4%
• CVE-2026-92230 High 7.5 Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching 0.5%
• CVE-2026-24656 Low 3.7 Apache Karaf: Decanter log-socket collector has deserialization vulnerability 0.7%
• CVE-2022-40145 Critical 9.8 Apache Karaf: JDBC JAAS LDAP injection 2.6%
• CVE-2022-22932 Unrated Path traversal flaws 2.8%
• CVE-2021-41766 Unrated Insecure Java Deserialization in Apache Karaf 2.0%