diff --git a/content/projects/_index.md b/content/projects/_index.md
index 3c968835..01c379a4 100644
--- a/content/projects/_index.md
+++ b/content/projects/_index.md
@@ -160,6 +160,13 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
[security@apache.org](mailto:security@apache.org?subject=Beam)
- Advisories (experimental):\
none so far
+- **Apache BifroMQ**
+ - **Security contact:**\
+ [security@apache.org](mailto:security@apache.org?subject=BifroMQ)
+ - Advisories (experimental):\
+ none so far
+ - Security model:
+ - [Apache BifroMQ security model](https://bifromq.apache.org/docs/admin_guide/security/intro/)
- 
**Apache Bigtop**
- **Security contact:**\
[security@apache.org](mailto:security@apache.org?subject=Bigtop)
@@ -447,9 +454,9 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
[flink.apache.org](https://flink.apache.org/what-is-flink/security/)
- Security model:
- [Apache Flink security model](https://flink.apache.org/what-is-flink/security/)
-- **Apache Fluss (Incubating)**
+- **Apache Fluss**
- **Security contact:**\
- [security@apache.org](mailto:security@apache.org?subject=Fluss%20%28Incubating%29)
+ [security@apache.org](mailto:security@apache.org?subject=Fluss)
- Advisories (experimental):\
[security.apache.org](/projects/fluss/)
- **Apache Fory**
diff --git a/content/projects/axis/_index.md b/content/projects/axis/_index.md
index 750d53cb..1e84f7ca 100644
--- a/content/projects/axis/_index.md
+++ b/content/projects/axis/_index.md
@@ -20,43 +20,6 @@ You can read more about the security policy on:
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security pages linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
{.bg-warning}
-## deserialization of untrusted Data ## { #CVE-2026-66713 }
-
-CVE-2026-66713 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-66713) [\[CVE json\]](./CVE-2026-66713.cve.json) [\[OSV json\]](./CVE-2026-66713.osv.json)
-
-
-
-_Last updated: 2026-07-28T13:44:22.395Z_
-
-### Affected
-
-* Apache Axis2/Java through 2.0.0
-
-
-### Description
-
-Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
-
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
-
(only when Tribes clustering is enabled, which is off by default) allows an
-
unauthenticated remote attacker with network access to the clustering port to
-
execute arbitrary code via a crafted serialized Java object delivered to the cluster
-
channel and deserialized in
-
org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are
-
recommended to upgrade to version 2.0.1, which fixes this issue by removing the
-
clustering feature entirely.
-
-
-
-
-### References
-* https://github.com/apache/axis-axis2-java-core/commit/e6f53b230bddcb40577c84ff290ba51e7265fa15
-* https://lists.apache.org/thread/fgggbv3sjjqw7p6q0j88gspt9b2rb728
-
-
-### Credits
-* liuhuajin of Huawei (finder)
-
-
## Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API ## { #CVE-2023-51441 }
CVE-2023-51441 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2023-51441) [\[CVE json\]](./CVE-2023-51441.cve.json) [\[OSV json\]](./CVE-2023-51441.osv.json)
diff --git a/content/projects/fluss/_index.md b/content/projects/fluss/_index.md
index 32d6f65e..a5ac8bd0 100644
--- a/content/projects/fluss/_index.md
+++ b/content/projects/fluss/_index.md
@@ -1,12 +1,12 @@
---
-title: Apache Fluss (Incubating) security advisories
-description: Security information for Apache Fluss (Incubating)
+title: Apache Fluss security advisories
+description: Security information for Apache Fluss
layout: single
---
# Reporting
-Do you want disclose a potential security issue for Apache Fluss (Incubating)? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Fluss%20%28Incubating%29).
+Do you want disclose a potential security issue for Apache Fluss? Send your report to the [Apache Security Team](mailto:security@apache.org?subject=Fluss).
# Advisories
diff --git a/content/projects/thrift/_index.md b/content/projects/thrift/_index.md
index cee36f2b..1f6391cc 100644
--- a/content/projects/thrift/_index.md
+++ b/content/projects/thrift/_index.md
@@ -387,7 +387,7 @@ CVE-2026-43870 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-43870) [\[CVE jso
-_Last updated: 2026-05-05T07:45:34.804Z_
+_Last updated: 2026-08-01T15:14:33.689Z_
### Affected
@@ -408,7 +408,7 @@ CVE-2026-43869 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-43869) [\[CVE jso
-_Last updated: 2026-05-05T07:25:46.713Z_
+_Last updated: 2026-08-01T15:15:50.815Z_
### Affected
@@ -476,7 +476,7 @@ CVE-2026-41608 [\[CVE\]](https://cve.org/CVERecord?id=CVE-2026-41608) [\[CVE jso
-_Last updated: 2026-07-27T10:53:37.845Z_
+_Last updated: 2026-08-01T15:15:08.921Z_
### Affected
diff --git a/scripts/project-coordinates.json b/scripts/project-coordinates.json
index cacf1862..01dd3e1c 100644
--- a/scripts/project-coordinates.json
+++ b/scripts/project-coordinates.json
@@ -191,6 +191,14 @@
"contact": "security@apache.org",
"logo_link": "https://www.apache.org/logos/res/beam/default.png"
},
+ "bifromq": {
+ "name": "Apache BifroMQ",
+ "security_model_link": "https://bifromq.apache.org/docs/admin_guide/security/intro/",
+ "security_model_source": "https://raw.githubusercontent.com/apache/bifromq-sites/master/docs/admin_guide/security/intro.md",
+ "advisory_link": null,
+ "contact": "security@apache.org",
+ "logo_link": null
+ },
"bigtop": {
"name": "Apache Bigtop",
"security_model_link": null,