CVE-2026-41871

The record

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Affected packages

Related vulnerabilities

• CVE-2026-114660 Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in… CWE-470
• CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. CWE-470
• CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and… CWE-470
• CVE-2026-76825 RestrictedPython is a tool that helps define a subset of the Python language for… CWE-470
• CVE-2026-79987 A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp… CWE-470
• CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-470
• CVE-2026-58400 GeoNetwork is a catalog application to manage spatially referenced resources. CWE-470
• CVE-2026-19032 jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI… CWE-470