Critical Vulnerability

Everything SecOps Signal has reported about Critical Vulnerability: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Apache Tomcat HTTP/2 Async Patch Fixes CVE-2026-101356 Request Mix-Up

A vulnerability in Apache Tomcat allows mixed HTTP/2 requests between users during asynchronous processing. Affected versions require immediate upgrade to 11.0.27, 10.1.61 or 9.0.123.

Oct 20, 2026

Vulnerabilities

Contao CMS Critical Unauthenticated RCE in Comments Bundle Exposes Admins to Script Injection

Unauthenticated visitors can inject scripts via comment metadata that execute in the backend session of any administrator viewing the moderation list.

Oct 10, 2026