Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache druidApache Druid: Users can provide MySQL JDBC properties not on allow listCVE-2024-45537Fix available6.5 Medium
- apache druidApache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle AttackCVE-2024-45384Fix available5.3 Medium
- apache seataApache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata ServerCVE-2024-22399Fix available9.8 Critical
- apache airflowApache Airflow: Authenticated DAG authors could execute code on scheduler nodesCVE-2024-45034Fix available8.8 High
- apache airflowApache Airflow: Command Injection in an example DAGCVE-2024-45498Fix available8.8 High
- apache ofbizApache OFBiz: Confused controller-view authorization logic (forced browsing)CVE-2024-45195In KEVPublic exploitEPSS 100.0%7.5 High
- apache ofbizApache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCECVE-2024-45507Public exploitEPSS 96.4%9.8 Critical
- apache portable runtime (apr), portable runtime +1 moreApache Portable Runtime (APR): Unexpected lax shared memory permissionsCVE-2023-49582Fix available5.5 Medium
- apache airflowApache Airflow: Stored XSS Vulnerability on provider linkCVE-2024-41937Fix available6.1 Medium
- apache seatunnel, apache software foundation seatunnel web +1 moreApache SeaTunnel Web: Arbitrary file read vulnerabilityCVE-2023-49198Fix available7.5 High
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: Denial of ServiceCVE-2024-38286Fix available8.6 High
- apache helix, apache software foundation helix front (ui), helix front\/ui\/ +2 moreApache Helix Front (UI): Helix front hard-coded secret in the express-sessionCVE-2024-222817.5 High
- apache dolphinschedulerApache DolphinScheduler: Remote Code Execution VulnerabilityCVE-2024-43202Public exploitFix available9.8 Critical
- apache mina sshdApache MINA SSHD: integrity check bypassCVE-2024-41909Fix available5.9 Medium
- apache answerApache Answer: The link for resetting user password is not Single-UseCVE-2024-41888Fix available5.3 Medium
- apache answerApache Answer: The link to reset the user's password will remain valid after sending a new linkCVE-2024-41890Fix available5.3 Medium
- apache dolphinschedulerApache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188Fix available8.1 High
- apache dolphinschedulerApache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831Fix available8.8 High
- apache cloudstackApache CloudStack: User Key Exposure to Domain AdminsCVE-2024-420627.2 High
- apache cloudstackApache CloudStack: Unauthorised Network List AccessCVE-2024-422224.3 Medium
- apache iotdb workbenchApache IoTDB Workbench: SSRF Vulnerability (EOL)CVE-2024-364487.3 High
- apache ofbizApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeCVE-2024-38856In KEVPublic exploitEPSS 99.4%9.8 Critical
- apache software foundation airflow providers fab, apache apache-airflow-providers-fab +1 moreApache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowCVE-2024-42447Fix available9.8 Critical
- apache inlong, apache software foundation inlong tubemq client +1 moreApache InLong TubeMQ Client: Remote Code Execution vulnerabilityCVE-2024-36268Fix available9.8 Critical
- apache linkis, apache software foundation linkis basic management services +1 moreApache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerabilityCVE-2024-27182Fix available4.9 Medium
- apache linkis, apache software foundation linkis basic management services +1 moreApache Linkis Basic management services: Privilege Escalation Attack vulnerabilityCVE-2024-27181Fix available8.8 High
- apache seatunnel, apache software foundation seatunnel web +1 moreApache SeaTunnel Web: Authentication bypassCVE-2023-48396Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Incomplete field name check allows request smugglingCVE-2023-38522Fix available7.5 High
- apache traffic serverApache Traffic Server: Invalid Accept-Encoding can force forwarding requestsCVE-2024-35296Fix available8.2 High
- apache traffic serverApache Traffic Server: Incomplete check for chunked trailer section allows request smugglingCVE-2024-35161Fix available7.5 High
- apache rollerApache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users modeCVE-2024-250905.4 Medium
- apache drillApache Drill: XXE Vulnerability in XML Format ReaderCVE-2023-48362Fix available8.8 High
- apache pinotApache Pinot: Unauthorized endpoint exposed sensitive informationCVE-2024-39676Fix available7.5 High
- apache arrow, apache software foundation arrow rust object store +1 moreApache Arrow Rust Object Store: AWS WebIdentityToken exposure in log filesCVE-2024-41178Fix available7.5 High
- apache streamparkApache StreamPark: session not invalidated after logoutCVE-2024-290709.1 Critical
- apache streamparkApache StreamPark IDOR VulnerabilityCVE-2024-344576.5 Medium
- apache syncopeApache Syncope: HTML tags can be injected into Console or Enduser text fieldsCVE-2024-38503Fix available5.4 Medium
- apache rocketmqApache RocketMQ: Unauthorized Exposure of Sensitive DataCVE-2024-23321Fix available8.8 High
- apache cloudstackApache CloudStack: SAML Signature ExclusionCVE-2024-41107Public exploitEPSS 17.8%8.1 High
- apache cxfApache CXF: Unrestricted memory consumption in CXF HTTP clientsCVE-2024-41172Fix available7.5 High
- apache cxfApache CXF Denial of Service vulnerability in JOSECVE-2024-32007Fix available7.5 High
- apache cxfApache CXF: SSRF vulnerability via WADL stylesheet parameterCVE-2024-29736Fix available9.1 Critical
- apache streamparkApache StreamPark: FreeMarker SSTI RCE VulnerabilityCVE-2024-29178Fix available8.8 High
- apache http serverApache HTTP Server: SSRF with mod_rewrite in server/vhost context on WindowsCVE-2024-40898Public exploitFix available7.5 High
- apache streamparkApache StreamPark: Information leakage vulnerabilityCVE-2024-29120Fix available5.9 Medium
- apache streampipesApache StreamPipes: Potential remote code execution (RCE) via file uploadCVE-2024-31411Fix available8.8 High
- apache streampipesApache StreamPipes: Possibility of SSRF in pipeline element installation processCVE-2024-31979Fix available4.3 Medium
- apache streampipesApache StreamPipes: Potential creation of multiple identical accountsCVE-2024-30471Fix available3.7 Low
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): maven build params could trigger remote command executionCVE-2024-29737Fix available4.7 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Unchecked maven build params could trigger remote command executionCVE-2023-52291Fix available4.7 Medium
- Show moreLoading…