Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache archivaApache Archiva Arbitrary user password reset vulnerabilityCVE-2022-29405Fix available6.5 Medium
- apache software foundation maven, apache maven shared utils, debian linux +2 moreCommandline class shell injection vulnerabilitiesCVE-2022-29599Fix available9.8 Critical
- apache shenyu, apache software foundation shenyu (incubating) +1 moreApache ShenYu (incubating) Regular expression denial of serviceCVE-2022-26650Fix available7.5 High
- apache tika, oracle primavera unifier +1 moreApache Tika Regular Expression Denial of Service in Standards ExtractorCVE-2022-30126Fix available5.5 Medium
- apache tika, oracle primavera unifier +1 moreApache Tika BPGParser Memory Usage DoSCVE-2022-25169Fix available5.5 Medium
- apache tomcat, debian linux, oracle hospitality cruise shipboard property management system +2 moreEncryptInterceptor does not provide complete protection on insecure networksCVE-2022-29885Public exploitFix availableEPSS 73.5%7.5 High
- apache jenaProcessing external DTDsCVE-2022-28890Fix available9.8 Critical
- apache nifiImproper Restriction of XML External Entity References in Multiple ComponentsCVE-2022-29265Fix available7.5 High
- apache doris, apache software foundation doris(incubating) +1 moreApache Doris hardcoded cryptography initializationCVE-2022-23942Fix available7.5 High
- apache couchdbRemote Code Execution Vulnerability in PackagingCVE-2022-24706In KEVPublic exploitFix availableEPSS 92.5%9.8 Critical
- apache apisixapisix/jwt-auth may leak secrets in error responseCVE-2022-29266Fix available7.5 High
- apache supersetSQL injection vulnerability in chart data APICVE-2022-27479Fix available9.8 Critical
- apache strutsForced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.CVE-2021-31805Public exploitFix availableEPSS 85.4%9.8 Critical
- apache hadoopArbitrary file write in FileUtil#unpackEntries on WindowsCVE-2022-26612Fix available9.8 Critical
- apache nifiInsufficiently protected credentialsCVE-2022-26850Fix available4.3 Medium
- apache pinotPinot segment push endpoint has a vulnerability in unprotected environmentsCVE-2022-23974Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler user registration is vulnerable to ReDoS attacksCVE-2022-25598Fix available7.5 High
- apache apisixApache APISIX: the body_schema check in request-validation plugin can be bypassedCVE-2022-25757Fix available9.8 Critical
- apache traffic server, debian linux +1 moreImproper authentication vulnerability in TLS origin verificationCVE-2021-44759Fix available8.1 High
- apache traffic server, debian linux +1 moreHTTP request line fuzzing attacksCVE-2021-44040Fix available7.5 High
- apache cloudstackApache Cloudstack insecure random number generation affects project email invitationCVE-2022-267797.5 High
- apache http server, debian linux, fedoraproject fedora +1 more +3 moremod_sed: Read/write beyond boundsCVE-2022-23943Public exploitFix availableEPSS 50.4%9.8 Critical
- apache http server, apple mac os x, macos +4 more +6 morecore: Possible buffer overflow with very large or unlimited LimitXMLRequestBodyCVE-2022-22721Fix availableEPSS 41.9%9.1 Critical
- apache http server, apple mac os x, macos +4 more +6 moreHTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierCVE-2022-22720Public exploitFix availableEPSS 28.2%9.8 Critical
- apache http server, apple mac os x, macos +3 more +5 moremod_lua Use of uninitialized value of in r:parsebodyCVE-2022-22719Fix availableEPSS 69.8%7.5 High
- apache spark, oracle financial services crime and compliance management studio +1 moreApache Spark Key Negotiation VulnerabilityCVE-2021-38296Fix available7.5 High
- apache any23An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractorCVE-2022-25312Fix available9.1 Critical
- apache poi, apache software foundation poi-scratchpad, netapp active iq unified manager +2 moreA carefully crafted TNEF file can cause an out of memory exceptionCVE-2022-26336Fix available5.5 Medium
- apache jspwikiApache JSPWiki Cross-site scripting vulnerability on User Preferences screenCVE-2022-24948Fix available6.1 Medium
- apache jspwikiApache JSPWiki CSRF Account TakeoverCVE-2022-24947Fix available8.8 High
- apache airflowApache Airflow: RCE in example DAGsCVE-2022-24288Fix availableEPSS 78.4%8.8 High
- apache airflowApache Airflow: Reflected XSS via Origin Query Argument in URLCVE-2021-45229Fix available6.1 Medium
- apache cayenneDeserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versionsCVE-2022-24289Fix available8.8 High
- apache apisixapisix/batch-requests plugin allows overwriting the X-REAL-IP headerCVE-2022-24112In KEVPublic exploitFix availableEPSS 96.1%9.8 Critical
- apache cassandraRemote code execution for scripted UDFsCVE-2021-44521Public exploitFix availableEPSS 58.9%9.1 Critical
- apache jamesPath traversal in Apache James 3.6.1CVE-2022-22931Public exploitFix available4.3 Medium
- apache traffic controlServer-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthCVE-2022-23206Fix available7.5 High
- apache artemis, apache software foundation activemq artemis, netapp active iq unified manager +1 more +3 moreApache ActiveMQ Artemis DoSCVE-2022-23913Fix available7.5 High
- apache gobblinInsecure TrustManager used in LDAP connectionsCVE-2021-36152Fix available9.8 Critical
- apache gobblinLocal Credentials Disclosure VulnerabilityCVE-2021-36151Fix available5.5 Medium
- apache supersetAPI sensitive information leakCVE-2021-44451Fix available6.5 Medium
- apache pulsarPulsar Admin API allows access to data from other tenants using getMessageById APICVE-2021-41571Fix available6.5 Medium
- apache tomcat, debian linux, oracle agile engineering data management +4 more +6 moreLocal privilege escalation with FileStoreCVE-2022-23181Fix available7.0 High
- apache karafPath traversal flawsCVE-2022-22932Public exploitFix available5.3 Medium
- apache karafInsecure Java Deserialization in Apache KarafCVE-2021-41766Fix available8.1 High
- apache shenyu, apache software foundation shenyu (incubating) +1 moreApache ShenYu missing authentication allows gateway registrationCVE-2022-23945Fix available7.5 High
- apache shenyu, apache software foundation shenyu (incubating) +1 moreApache ShenYu 2.4.1 Improper access controlCVE-2022-23944Fix availableEPSS 79.0%9.1 Critical
- apache shenyu, apache software foundation shenyu (incubating) +1 moreApache ShenYu Password leakageCVE-2022-23223Fix available7.5 High
- apache shenyu, apache software foundation shenyu (incubating) +1 moreApache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionCVE-2021-45029Fix available9.8 Critical
- apache software foundation xerces, apache xerces-j, netapp active iq unified manager +27 more +29 moreInfinite loop within Apache XercesJ xml parserCVE-2022-23437Fix availableEPSS 11.6%6.5 Medium
- Show moreLoading…