Loading story…
Apache disclosed two important-severity vulnerabilities affecting the SkyWalking ecosystem: CVE-2025-54057, a stored cross-site scripting flaw in Apache SkyWalking through version 10.2.0, and CVE-2026-34476, a server-side request forgery issue in Apache SkyWalking MCP version 0.1.0. The XSS bug was attributed to improper neutralization of script-related HTML tags in web content, while the SSRF flaw was tied to handling of the SW-URL header in the MCP server.
Apache advised users to upgrade SkyWalking to version 10.3.0 and SkyWalking MCP to version 0.2.0 to address the vulnerabilities. The disclosures were published on the oss-sec mailing list, with Vinh Nguyễn Quang credited for reporting the SkyWalking XSS issue and Andrea Cosentino credited for reporting the SkyWalking MCP SSRF flaw.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2025-54057, a stored cross-site scripting vulnerability affecting Apache SkyWalking versions through 10.2.0. The advisory rated the issue as important, credited Vinh Nguyễn Quang as the reporter, and recommended upgrading to SkyWalking 10.3.0.
Apache disclosed CVE-2026-34476, an important-severity server-side request forgery vulnerability in Apache SkyWalking MCP 0.1.0 caused by the SW-URL header in the MCP server. The advisory credited Andrea Cosentino as the reporter and advised users to upgrade to version 0.2.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed five vulnerabilities in **Apache Answer** affecting versions through `2.0.0`, including a **critical** cross-site scripting issue tracked as `CVE-2026-25688`. The XSS flaw stems from insufficient sanitization of AI-generated answer content, allowing malicious script execution when users view affected pages. Apache also fixed `CVE-2026-25699`, an authorization bypass in timeline-related APIs that let authenticated users access deleted, private, or unapproved content and related revision history, potentially exposing personal information, and `CVE-2026-25700`, which left previously issued administrative tokens valid after an administrator account was suspended, deleted, or deactivated. The same release also addressed `CVE-2026-33582`, a denial-of-service bug in which a specially crafted TIFF upload could trigger excessive memory allocation and crash the server process, and `CVE-2026-34033`, which allowed authenticated users to inject arbitrary HTML into notification emails because script-related tags were not properly neutralized. Apache said all five issues are remediated in **Apache Answer `2.0.1`** and advised users to upgrade, with reports credited to Sho Odagiri, Reimar Fritz, and Andy Gill of ZephrSec Ltd.
Jun 29, 2026
Apache disclosed **CVE-2026-66390**, an important-severity cross-site scripting vulnerability in **Apache Wicket** caused by improper neutralization of input during web page generation. The flaw allows crafted `Link` URL strings to break out of an intended JavaScript sequence, creating a path for script injection in affected web applications built on the framework. The issue affects Apache Wicket versions **9.0.0 through 9.23.0** and **10.0.0 through 10.9.0**. A security notice published on the `oss-sec` mailing list advised users to remediate by upgrading to **Apache Wicket 10.10.0**, making patch validation and exposure review a priority for organizations running Wicket-based applications.
Jul 27, 2026
Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while `CVE-2026-57308` affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and `CVE-2026-62183` can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements. Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions **4.0.7** and **4.1.2** and noting that some older flaws were addressed in earlier point releases such as **4.1.1**, **4.0.6**, **4.0.4**, **4.0.3**, **3.0.16**, and **3.0.15**. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.
Jul 24, 2026