Apache Software Foundation vulnerabilities

Products

• Airflow 157
• Http Server 153
• Tomcat 152
• Traffic Server 118
• Camel 103
• Ofbiz 103
• Thrift 93
• Superset 67
• Cxf 59
• Nifi 55
• Cloudstack 52
• Syncope 49
• Dolphinscheduler 46
• Activemq 45
• Kylin 44
• Brpc 41
• Inlong 41
• Wicket 41
• Openoffice 40
• Answer 37
• Struts 35
• Apisix 34
• Pulsar 30
• Jspwiki 29
• Solr 29
• Iotdb 28
• Fineract 25
• Hadoop 25
• Roller 25
• Zeppelin 25
• Openmeetings 24
• Kafka 23
• Ranger 23
• Shiro 21
• Tika 21
• Activemq All 20
• Geode 20
• Allura 19
• Qpid Broker-j 19
• Zookeeper 19

Show 160 moreShow less

• Dubbo 18
• Hive 18
• Couchdb 17
• Karaf 17
• Mina Sshd 17
• Spark 17
• Activemq Artemis 16
• Ambari 16
• Activemq Broker 15
• Atlas 13
• Impala 13
• James 13
• Cassandra 12
• Druid 12
• Archiva 11
• Fory 11
• Guacamole 11
• Mina 11
• Neethi 11
• Nimble 11
• Ozone 11
• Commons Compress 10
• Doris 10
• Subversion 10
• Tapestry 10
• Airflow Fab Provider 9
• Artemis 9
• Juneau 9
• Kvrocks 9
• Streampark 9
• Cocoon 8
• Linkis 8
• Log4net 8
• Sling 8
• Spamassassin 8
• Streampark (incubating) 8
• Tomcat Native 8
• Directory Ldap Api 7
• Hertzbeat 7
• Opennlp 7
• Pdfbox 7
• Qpid Proton-j 7
• Storm 7
• Storm Nimbus 7
• Streampipes 7
• Traffic Control 7
• Wss4j 7
• Airflow Google Provider 6
• Commons Configuration 6
• Ignite 6
• James Server 6
• Jena 6
• Polaris 6
• Qpid Proton Dotnet 6
• Skywalking 6
• Ant 5
• Datasketches 5
• Mesos 5
• Oozie 5
• Pinot 5
• Plc4x 5
• Portable Runtime Utility 5
• Qpid Protonj2 5
• Shenyu (incubating) 5
• Sling Xss 5
• Storm Client 5
• Xml Graphics 5
• Activemq Client 4
• Airflow Hive Provider 4
• Airflow Keycloak Provider 4
• Airflow Spark Provider 4
• Any23 4
• Avro 4
• Camel K 4
• Cxf Fediz 4
• Flink 4
• Gravitino 4
• Hugegraph-server 4
• Iotdb Workbench 4
• Ivy 4
• Kyuubi 4
• Linkis Datasource 4
• Log4cxx 4
• Log4j 4
• Log4j 1.x 4
• Log4j Core 4
• Mynewt Nimble 4
• Netbeans 4
• Nutch 4
• Nuttx Rtos 4
• Poi 4
• Portable Runtime (apr) 4
• Portals 4
• Qpid Proton C 4
• Rocketmq 4
• Seata (incubating) 4
• Sling Engine 4
• Tomcat Connectors 4
• Accumulo 3
• Activemq Web 3
• Airflow Amazon Provider 3
• Airflow Cncf Kubernetes Provider 3
• Airflow Sftp Provider 3
• Arrow 3
• Avro Java Sdk 3
• Axis 3
• Brooklyn 3
• Calcite 3
• Commons Bcel 3
• Derby 3
• Flume 3
• Jackrabbit 3
• Jmeter 3
• Juddi 3
• Kafka Clients 3
• Log4j2 3
• Lucene.net 3
• Lucy 3
• Nifi Registry 3
• Nuttx (incubating) 3
• Shenyu 3
• Sis 3
• Sling App Cms 3
• Storm Ui 3
• Tomee 3
• Unomi 3
• Xmlschema 3
• Yunikorn 3
• Ibm Cloudant 3
• Activemq Broker 2
• Activemq Stomp 2
• Airflow Apache Hive Provider 2
• Airflow Drill Provider 2
• Airflow Ftp Provider 2
• Airflow Mysql Provider 2
• Airflow Odbc Provider 2
• Airflow Sqoop Provider 2
• Airflow Ssh Provider 2
• Airflow Teradata Provider 2
• Apisix Dashboard 2
• Batik 2
• Calcite Avatica 2
• Camel Jira 2
• Camel Karavan 2
• Cayenne 2
• Commons Email 2
• Commons Fileupload 2
• Commons Io 2
• Commons Vfs 2
• Cordova Android 2
• Deltaspike 2
• Doris Mcp Server 2
• Drill 2
• Fesod (incubating) 2
• Gobblin 2
• Hbase 2
• Helix 2
• Hertzbeat (incubating) 2
• Httpclient 2
• Httpcomponents Client 2

Newest

• apache software foundation axis 1.x (eol) Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName CVE-2026-90436 No scoreNovember 6, 2026
• apache software foundation james Apache James: Denial of service upon MIME parsing CVE-2026-85111 8.7 HighNovember 6, 2026
• apache software foundation james mime4j core, james mime4j dom +1 more Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling CVE-2026-85108 No scoreNovember 6, 2026
• apache software foundation james Apache James: ManageSieve file implementation cross-user path traversal CVE-2026-76168 No scoreNovember 6, 2026
• apache software foundation james Apache James: WebAdmin exposed without authentication on official Docker default CVE-2026-74756 No scoreNovember 6, 2026
• apache software foundation james Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client CVE-2026-76171 No scoreNovember 6, 2026
• apache software foundation james Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol CVE-2026-49939 No scoreNovember 6, 2026
• apache software foundation james Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred CVE-2025-66621 No scoreNovember 6, 2026
• apache software foundation ofbiz Apache OFBiz: Authenticated Path Traversal in Catalog Image Management CVE-2026-66903 6.5 MediumNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Dispatch arbitrary internal services on SFA component CVE-2026-71901 8.1 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading CVE-2026-68524 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unauthenticated path-suffix view authorization bypass CVE-2026-73577 Public exploit No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact CVE-2026-73578 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unauthenticated HR organization and employee disclosure CVE-2026-73580 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode CVE-2026-74841 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage CVE-2026-76150 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Missing authorization - catalog quick-admin product writes CVE-2026-81734 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services CVE-2026-76152 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Authorization bypass - self-grant content OWNER CVE-2026-81744 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Missing authorization - search-result bulk catalog mutation CVE-2026-81808 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB CVE-2026-81815 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: XML external entity injection (XXE) CVE-2026-81816 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Server-side request forgery in SurveyWrapper CVE-2026-81828 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Content renderer runs a service name stored on the row CVE-2026-82894 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile CVE-2026-82902 4.3 MediumNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unbounded multi-form row count from a parameter name CVE-2026-82904 7.5 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound CVE-2026-82907 9.8 CriticalNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: renderLink compiles link parameters as FreeMarker source CVE-2026-82910 8.8 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unsandboxed Groovy compiled from a service parameter CVE-2026-82912 8.8 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: webtools xmldsdump exports any entity to any path CVE-2026-82916 7.1 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE CVE-2026-82960 8.8 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers CVE-2026-83538 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Unauthenticated RCE via login-page widget injection CVE-2026-83542 Public exploit 9.8 CriticalNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Content Manager VIEW-only RCE in updateLayout CVE-2026-84183 8.8 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login CVE-2026-84728 5.4 MediumNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Authenticated Code Execution Vulnerability CVE-2026-85627 8.8 HighNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation CVE-2026-92887 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service CVE-2026-97355 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass CVE-2026-97356 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Missing Authorization vulnerability CVE-2026-100168 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation CVE-2026-100228 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations CVE-2026-105325 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access CVE-2026-105330 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities CVE-2026-105461 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification CVE-2026-109129 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association CVE-2026-109837 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation CVE-2026-109856 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover CVE-2026-109928 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session CVE-2026-114229 No scoreNovember 5, 2026
• apache software foundation ofbiz Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders CVE-2026-114233 No scoreNovember 5, 2026
• Show olderLoading…