CVE-2026-97849

The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

• CWE-1327

• https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv9glffhq

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97843Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97844Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97845An uncontrolled recursion vulnerability has been discovered …4.3
• CVE-2026-97846Keycloak provides a feature called mTLS holder-of-key bindin…6.8
• CVE-2026-97847A flaw was found in the protocol mapper and identity resolut…7.1
• CVE-2026-97848A flaw was found in the token sanitization logic of Keycloak…6.5
• CVE-2026-9785Quest NetVault Backup NVBULibrarySlot SQL Injection Remote C…8.8
• CVE-2026-97851The storage status-change REST service allows location recor…9.1
• CVE-2026-97853Memory Allocation with Excessive Size Value vulnerability in…6.9
• CVE-2026-97854Yamaha wireless LAN router NWR100 provided by Yamaha Corpora…9.8
• CVE-2026-97858An attacker can cause the server to unbind the target device…5.3
• CVE-2026-97859Seven Gitea API routes under `/api/v1/users/{username}` (fol…6.5