Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache shenyu, apache software foundation shenyu admin +1 moreApache ShenYu Admin bypass JWT authenticationCVE-2021-37580Public exploitFix availableEPSS 40.8%9.8 Critical
- apache supersetCredentials leakCVE-2021-41972Fix available6.5 Medium
- apache traffic controlLDAP filter injection vulnerability in Traffic OpsCVE-2021-43350Fix available9.8 Critical
- apache shardingsphere-uiDeserialization of Untrusted DataCVE-2021-265587.5 High
- apache traffic serverheap-buffer-overflow with stats-over-http pluginCVE-2021-43082Fix available9.8 Critical
- apache traffic serverATS stops accepting connections on FreeBSDCVE-2021-415857.5 High
- apache traffic server, debian linux +1 moreNot validating origin TLS certificateCVE-2021-38161Fix available8.1 High
- apache traffic server, debian linux +1 moreRequest Smuggling - multiple attacksCVE-2021-37149Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - transfer encoding validationCVE-2021-37148Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - LF line endingCVE-2021-37147Fix available7.5 High
- apache dolphinschedulerDolphinScheduler mysql jdbc connector parameters deserialize remote code executionCVE-2021-27644Fix available8.8 High
- apache mina, oracle banking payments, banking trade finance process management +6 more +8 moreApache MINA HTTP listener DOSCVE-2021-41973Fix available6.5 Medium
- apache stormUnsafe Pre-Authentication Deserialization In WorkersCVE-2021-40865Public exploitFix availableEPSS 64.2%9.8 Critical
- apache stormShell Command Injection Vulnerability in Nimbus Thrift ServerCVE-2021-38294Public exploitFix availableEPSS 83.8%9.8 Critical
- apache supersetPossible SQL Injection when template processing is enabledCVE-2021-41971Fix available8.8 High
- apache supersetXSS vulnerability on Explore pageCVE-2021-32609Fix available5.4 Medium
- apache tomcat, debian linux, netapp hci +15 more +17 moreDoS via memory leak with WebSocket connectionsCVE-2021-42340Fix availableEPSS 11.8%7.5 High
- apache couchdb, apache software foundation ibm cloudant +1 morePrivilege escalation vulnerability when using HTML attachmentsCVE-2021-38295Public exploitFix available7.3 High
- apache traffic controlApache Traffic Control Traffic Ops Email Injection VulnerabilityCVE-2021-42009Fix available4.3 Medium
- apache openofficeContent Manipulation with Certificate Validation AttackCVE-2021-418327.5 High
- apache openofficeTimestamp Manipulation with Signature WrappingCVE-2021-418315.3 Medium
- apache openofficeDouble Certificate AttackCVE-2021-418307.5 High
- apache http server, fedoraproject fedora, netapp cloud backup +3 more +5 morePath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)CVE-2021-42013In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- apache openofficeBillion LaughsCVE-2021-404396.5 Medium
- apache openofficeDEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupidCVE-2021-281297.8 High
- apache http server, fedoraproject fedora, netapp cloud backup +1 more +3 morePath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49CVE-2021-41773In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- apache http server, fedoraproject fedora, netapp cloud backup +1 more +3 morenull pointer dereference in h2 fuzzingCVE-2021-41524Fix availableEPSS 25.8%7.5 High
- apache ddlutils, apache software foundation db ddlutils +1 moreApache ddlutils 1.0 readobject vulnerabilityCVE-2021-416169.8 Critical
- apache druidApache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)CVE-2021-36749Public exploitFix availableEPSS 80.9%6.5 Medium
- apache openofficeBuffer overflow from a crafted DBF fileCVE-2021-33035Fix availableEPSS 50.6%7.8 High
- apache kafka, oracle communications brm - elastic charging engine, communications cloud native core policy +5 more +7 moreTiming Attack Vulnerability for Apache Kafka Connect and ClientsCVE-2021-38153Fix available5.9 Medium
- apache software foundation santuario, apache cxf, santuario xml security for java +16 more +18 moreBypass of the secureValidation propertyCVE-2021-40690Fix available7.5 High
- apache shiro, oracle financial services crime and compliance management studio +1 moreApache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassCVE-2021-41303Fix availableEPSS 76.1%9.8 Critical
- apache tomcat, debian linux, netapp management services for element software and netapp hci +2 moreApache Tomcat DoS with unexpected TLS packetCVE-2021-41079Fix available7.5 High
- apache, apache http server, broadcom brocade fabric operating system firmware +36 more +38 moremod_proxy SSRFCVE-2021-40438In KEVPublic exploitFix availableEPSS 100.0%9.0 Critical
- apache http server, debian linux, fedoraproject fedora +7 more +9 moreap_escape_quotes buffer overflowCVE-2021-39275Fix availableEPSS 39.4%9.8 Critical
- apache jenaXML External Entity (XXE) vulnerabilityCVE-2021-39239Fix available7.5 High
- apache http server, broadcom brocade fabric operating system firmware, debian linux +9 more +11 moremod_proxy_uwsgi out of bound readCVE-2021-36160Fix availableEPSS 63.7%7.5 High
- apache http server, broadcom brocade fabric operating system firmware, debian linux +14 more +16 moreNULL pointer dereference in httpd coreCVE-2021-34798Fix availableEPSS 64.5%7.5 High
- apache any23A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.javaCVE-2021-40146Fix available9.8 Critical
- apache any23An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.javaCVE-2021-38555Fix available9.1 Critical
- apache airflowApache Airflow: Variable Import endpoint missed authentication checkCVE-2021-38540Public exploitFix availableEPSS 80.9%9.8 Critical
- apache dubboBypass deserialization checks in Apache DubboCVE-2021-37579Fix available9.8 Critical
- apache dubboUnprotected input value toString cause RCECVE-2021-36161Fix available9.8 Critical
- apache dubboUnsafe deserialization in providers using the Hessian protocolCVE-2021-36163Fix available9.8 Critical
- apache dubboUnprotected yaml deserialization cause RCECVE-2021-36162Fix available8.8 High
- apache zeppelinCross Site Scripting in markdown interpreterCVE-2021-27578Fix available6.1 Medium
- apache zeppelinNotebook permissions bypassCVE-2020-13929Fix available7.5 High
- apache zeppelinbash command injection in spark interpreterCVE-2019-10095Fix available9.8 Critical
- apache nifi minifi c\+\+, apache software foundation nifi - minifi c++ +1 moreMiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocolCVE-2021-331919.8 Critical
- Show moreLoading…