Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVEs Apache Software Foundation products: 8 critical CVEs Worst: path traversal in DirectoryResource (CVE-2026-121489) Patch → 9.2.1 https://cve.now/CVE-2026-121489?release=CVE-2026-73098,CVE-2026-73099,CVE-2026-73100,CVE-2026-73101,CVE-2026-73116,CVE-2026-73117,CVE-2026-96677&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-121489 (CVSS: 10) Apache Softw... CVE-2026-122051 (CVSS: 10) edimax CVE-2026-73098 (CVSS: 10) Apache Softw... CVE-2026-73099 (CVSS: 10) Apache Softw... CVE-2026-73100 (CVSS: 10) Apache Softw... ..🧵👇
[CVE] CVE-2026-73099 [HIGH PRIORITY] CVSS: 10 | Vendor: #ApacheSoftwareFoundation #Apache Juneau: Cross-site request forgery via default-enabled content query-p... 🔗 https://exploitgrid.net/cve/CVE-2026-73099
Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override CVE-2026-73099 · Critical · CVSS 10.0 Published Nov 5, 6:17 AM · Updated Nov 5, 1:17 PM Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an endpoint without a CORS preflight, defeating protections that rely on the HTTP method or content type instead of an anti-CSRF token. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue. Applications that do not use the content parameter can also set disableContentParam to true.
CVE-2026-73099 · CRITICAL · CVSS 10.0 Apache Juneau through 9.2.0 has a cross-site request forgery vulnerability due to a default-enabled content query parameter. CVSS 4.0 · apache https://cve.new/CVE-2026-73099
🆕 New CVE: CVE-2026-73099 (CVSS 10.0, Enclave score 4/10) Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override Remote, no login needed. Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. https://app.enclave.ai/threat-feed/CVE-2026-73099