Posted by Jean-Baptiste Onofré on Sep 28 Severity: moderate Affected versions: - Apache Karaf (org.apache.karaf:org.apache.karaf.instance.core) before 4.4.12 Description: Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...
CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/962
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
28th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The FBI has…
Attack Surface Management in 2026: Why Point-in-Time Scans Can’t Keep Up With Cloud Sprawl
Cloud infrastructure now changes by the hour, yet many security teams still map their external attack surface once a quarter or once a year. That mismatch creates blind…
Other users can watch your browsing and time your keystrokes through OS file notifications
Researchers at Graz University of Technology have used the file-notification systems in Windows, Linux, and macOS to spy on activity in other accounts. On Windows, a…
[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes
Posted by Vyom Yadav on Sep 28 Hello Kubernetes Community, A security issue was discovered in Kubernetes where a malicious tar binary in a container may be able to write…
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 116
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Threat Intel |…
[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM
Posted by advisories on Sep 26 ---------------------------------------------------------------------------- NotCVE Advisory — NotCVE-2026-0015…