Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache airflowApache Airflow Reflected XSS via Origin Query Argument in URLCVE-2021-28359Fix availableEPSS 14.4%6.1 Medium
- apache ofbizUnsafe deserialization in Apache OFBizCVE-2021-30128Public exploitEPSS 81.2%9.8 Critical
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICVE-2021-29200Public exploitEPSS 55.4%9.8 Critical
- apache tapestryAn Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and laterCVE-2021-30638Fix available7.5 High
- apache supersetApache Superset Open RedirectCVE-2021-28125Fix availableEPSS 64.0%6.1 Medium
- apache ozoneOzone S3 Gateway allows bucket and key access to non authenticated usersCVE-2020-175177.5 High
- apache maven, oracle financial services analytical applications infrastructure, goldengate big data and application adapters +1 more +3 moreblock repositories using http by defaultCVE-2021-26291Public exploitFix available9.1 Critical
- apache openofficeCode execution in Apache OpenOffice via non-http(s) schemes in HyperlinksCVE-2021-302458.8 High
- apache tapestryBypass of the fix for CVE-2019-0195CVE-2021-27850Public exploitFix availableEPSS 93.6%9.8 Critical
- apache commons io, debian linux, netapp active iq unified manager +57 more +59 morePossible limited path traversal vulnerabily in Apache Commons IOCVE-2021-29425Public exploitFix availableEPSS 10.5%4.8 Medium
- apache solrApache Solr Unprivileged users may be able to perform unauthorized read/write to collectionsCVE-2021-29943Fix available9.1 Critical
- apache solrMisapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settingsCVE-2021-29262Fix available7.5 High
- apache solrSSRF vulnerability with the Replication handlerCVE-2021-27905Public exploitFix availableEPSS 93.1%9.8 Critical
- apache subversion, apple macos, debian linux +1 more +3 moreApache Subversion mod_dav_svn is vulnerable to memory corruptionCVE-2022-24070Fix available7.5 High
- apache subversion, apple macos, debian linux +1 more +3 moreApache Subversion SVN authz protected copyfrom paths regressionCVE-2021-28544Fix available4.3 Medium
- apache cxf, oracle business intelligence, communications diameter intelligence hub +3 more +5 moreOAuth 2 authorization service vulnerable to DDos attacksCVE-2021-22696Fix available7.5 High
- apache tika, oracle communications messaging server, healthcare foundation +2 more +4 moreInfinite loop in Apache Tika's MP3 parserCVE-2021-28657Fix available5.5 Medium
- apache druidApache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.CVE-2021-26919Fix availableEPSS 35.2%8.8 High
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICVE-2021-26295Public exploitEPSS 97.8%9.8 Critical
- apache pdfbox, fedoraproject fedora, oracle banking corporate lending process management +16 more +18 moreA carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileCVE-2021-27906Fix available5.5 Medium
- apache pdfbox, fedoraproject fedora, oracle banking trade finance process management +12 more +14 moreA carefully crafted PDF file can trigger an infinite loop while loading the fileCVE-2021-27807Fix available5.5 Medium
- apache ambariIn Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for...CVE-2020-139247.5 High
- apache hiveTiming attack in Cookie signature verificationCVE-2020-1926Fix available5.9 Medium
- apache openmeetingsApache OpenMeetings: bandwidth can be overloaded with public web serviceCVE-2021-27576Fix available7.5 High
- apache velocity tools, debian linux +1 moreVelocity Tools XSS VulnerabilityCVE-2020-13959Fix available6.1 Medium
- apache velocity engine, wss4j, debian linux +13 more +15 moreVelocity Sandbox BypassCVE-2020-13936Fix availableEPSS 22.7%8.8 High
- apache oozieOozie local privilege escalationCVE-2020-354514.7 Medium
- apache supersetApache Superset stored XSS on Dashboard markdownCVE-2021-27907Fix availableEPSS 86.4%5.4 Medium
- apache ambariStored XSS in Apache AmbariCVE-2020-1936Fix available6.1 Medium
- apache asterixdbunzip directory traversalCVE-2020-94795.5 Medium
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreIncomplete fix for CVE-2020-9484CVE-2021-25329Fix available7.0 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreApache Tomcat h2c request mix-upCVE-2021-25122Fix availableEPSS 18.1%7.5 High
- apache livy, apache software foundation livy (incubating) +1 moreApache Livy (Incubating) is vulnerable to cross site scriptingCVE-2021-26544Fix available5.4 Medium
- apache myfaces, apache software foundation myfaces core, netapp oncommand insight +2 moreCross-Site Request Forgery (CSRF) vulnerability in Apache MyFacesCVE-2021-26296Fix available7.5 High
- apache airflowApache Airflow: Lineage API endpoint for Experimental API missed authentication checkCVE-2021-26697Fix available5.3 Medium
- apache airflowCWE-284 Improper Access Control on Configurations Endpoint for the Stable APICVE-2021-26559Fix available6.5 Medium
- apache thrift, hive, oracle communications cloud native core network slice selection function +1 more +3 moreUncontrolled Resource Consumption in Apache ThriftCVE-2020-13949Fix available7.5 High
- apache subversion, debian linux +1 moreRemote unauthenticated denial-of-service in Subversion mod_authz_svnCVE-2020-17525Fix availableEPSS 40.1%7.5 High
- apache activemq, oracle communications session report manager, communications session route manager +2 moreCross-site scripting (XSS) in Apache ActiveMQCVE-2020-13947Fix availableEPSS 79.2%6.1 Medium
- apache shiroAuthentication bypass in Apache ShiroCVE-2020-17523Public exploitFix availableEPSS 85.9%9.8 Critical
- apache cassandraAuthentication Bypass in Apache CassandraCVE-2020-17516Fix available7.5 High
- apache druidAuthenticated users can override system configurations in their requests which allows them to execute arbitrary code.CVE-2021-25646Public exploitFix availableEPSS 99.1%8.8 High
- apache artemis, apache software foundation activemq artemis, netapp oncommand workflow automation +2 moreFlaw in ActiveMQ Artemis OpenWire supportCVE-2021-26118Fix available7.5 High
- apache activemq, artemis, debian linux +5 more +7 moreActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindCVE-2021-26117Fix availableEPSS 11.5%7.5 High
- apache hadoop, solr, oracle financial services crime and compliance management studio +2 moreImproper Privilege Management in Apache HadoopCVE-2020-9492Fix available8.8 High
- apache traffic controlCache Manipulation Attack in Apache Traffic ControlCVE-2020-17522Fix available5.8 Medium
- apache nutch, netapp snap creator framework +1 moreAn XML external entity (XXE) injection vulnerability exists in the Nutch DmozParserCVE-2021-23901Fix available9.1 Critical
- apache software foundation servicecomb-java-chassis, apache java chassis +1 moreApache ServiceComb Yaml remote deserialization vulnerabilityCVE-2020-17532Fix available8.8 High
- apache guacamoleUpdated guacd packages fix security vulnerabilitiesCVE-2020-11997Fix available4.3 Medium
- apache tomcat, debian linux, oracle agile product lifecycle management +2 moreApache Tomcat information disclosureCVE-2021-24122Fix availableEPSS 22.9%5.9 Medium
- Show moreLoading…