Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache solrApache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPluginCVE-2026-22022Fix available8.2 High
- apache solrApache Solr: Insufficient file-access checking in standalone core-creation requestsCVE-2026-22444Public exploitFix available7.1 High
- apache linkisApache Linkis: Password ExposureCVE-2025-59355Fix available6.5 Medium
- apache linkisApache Linkis: Arbitrary File Read via Double URL Encoding BypassCVE-2025-29847Fix available7.5 High
- apache airflowApache Airflow: proxy credentials for various providers might leak in task logsCVE-2025-68675Fix available7.5 High
- apache airflowApache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncatedCVE-2025-68438Fix available7.5 High
- apache brpcApache bRPC: Remote command injection vulnerability in heap builtin serviceCVE-2025-60021Public exploitEPSS 55.2%9.8 Critical
- apache camel, apache software foundation camel neo4j +1 moreApache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j componentCVE-2025-66169Fix available5.3 Medium
- apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 moreApache Struts, Apache Struts: XXE vulnerability in outdated XWork componentCVE-2025-68493Public exploitFix availableEPSS 50.4%8.1 High
- apache nimble, apache software foundation mynewt nimble +1 moreApache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controllerCVE-2025-524357.5 High
- apache nimble, apache software foundation mynewt nimble +1 moreApache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driverCVE-2025-534703.1 Low
- apache nimble, apache software foundation mynewt nimble +1 moreApache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layerCVE-2025-534777.5 High
- apache nimble, apache software foundation mynewt nimble +1 moreApache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairingCVE-2025-622358.1 High
- apache uniffleApache Uniffle: Insecure SSL Configuration in Uniffle HTTP ClientCVE-2025-686379.1 Critical
- apache software foundation sis, apache spatial information system +1 moreApache SIS: XML External Entity (XXE) vulnerabilityCVE-2025-68280Fix available6.5 Medium
- apache kyuubiApache Kyuubi: Unauthorized directory access due to missing path normalizationCVE-2025-66518Fix available8.8 High
- apache streampipesApache StreamPipes: Leverage of User ID for Privilege EscalationCVE-2025-47411Fix availableEPSS 15.3%8.1 High
- apache nuttx, apache software foundation nuttx rtos +1 moreApache NuttX RTOS: fs/vfs/fs_rename: use after freeCVE-2025-487698.1 High
- apache nuttx, apache software foundation nuttx rtos +1 moreApache NuttX RTOS: fs/inode: fs_inoderemove root inode removalCVE-2025-487686.5 Medium
- apache nifiApache NiFi: Deserialization of Untrusted Data in GetAsanaObject ProcessorCVE-2025-66524Fix available7.5 High
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Missing TLS hostname verification in Socket appenderCVE-2025-68161Fix available6.3 Medium
- apache software foundation airflow providers edge3, apache apache-airflow-providers-edge3 +1 moreApache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2CVE-2025-67895Fix available9.8 Critical
- apache airflowApache Airflow: Secrets in rendered templates not redacted properly and exposed in the UICVE-2025-66388Fix available6.5 Medium
- apache streamparkApache StreamPark: Uses the user’s password as the secret keyCVE-2025-53960Fix available5.9 Medium
- apache streamparkApache StreamPark: Use hard-coded key vulnerabilityCVE-2025-54947Fix available9.8 Critical
- apache streamparkApache StreamPark: Weak Encryption Algorithm in StreamParkCVE-2025-54981Fix available7.5 High
- apache hugegraph, apache software foundation hugegraph-server +1 moreApache HugeGraph-Server: RAFT and deserialization vulnerabilityCVE-2025-26866Fix available8.8 High
- apache fineractApache Fineract: IDOR via self-service APICVE-2025-581378.1 High
- apache fineractApache Fineract: Server Key not maskedCVE-2025-581309.1 Critical
- apache fineractApache Fineract: weak password policyCVE-2025-234088.5 High
- apache strutsApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedCVE-2025-66675Fix available8.2 High
- apache http serverApache HTTP Server: Server Side Includes adds query string to #exec cmd=...CVE-2025-58098Public exploitFix available8.3 High
- apache http serverApache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfoCVE-2025-66200Fix available5.4 Medium
- apache http serverApache HTTP Server: CGI environment variable overrideCVE-2025-65082Fix available6.5 Medium
- apache http serverApache HTTP Server: mod_md (ACME), unintended retry intervalsCVE-2025-55753Fix available7.5 High
- apache http serverApache HTTP Server: NTLM Leakage on Windows through UNC SSRFCVE-2025-59775Fix available7.5 High
- apache strutsApache Struts: File leak in multipart request processing causes disk exhaustion (DoS)CVE-2025-64775Fix available7.5 High
- apache brpcApache bRPC: Stack Exhaustion via Unbounded Recursion in JSON ParserCVE-2025-597897.5 High
- apache kvrocksApache Kvrocks: MONITOR command reveals plaintext credentials to non-adminsCVE-2025-597925.3 Medium
- apache kvrocksApache Kvrocks: RESET command grants admin privilegesCVE-2025-597905.4 Medium
- apache skywalkingApache SkyWalking: Stored XSS vulnerabilityCVE-2025-540576.1 Medium
- apache cloudstackApache CloudStack: Potential remote code execution on Javascript engine defined rulesCVE-2025-593024.7 Medium
- apache cloudstackApache CloudStack: Lack of user permission validation leading to data leak for few APIsCVE-2025-594544.3 Medium
- apache druidApache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.CVE-2025-59390Public exploitFix available9.8 Critical
- apache hiveApache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIsCVE-2025-62728Fix available5.4 Medium
- apache syncopeApache Syncope: Default AES key used for internal password encryptionCVE-2025-65998Fix available7.5 High
- apache causewayApache Causeway: Java deserialization vulnerability to authenticated attackersCVE-2025-64408Fix availableEPSS 11.6%6.3 Medium
- apache ofbizApache OFBiz: Reflected Cross-site ScriptingCVE-2025-616236.5 Medium
- apache ofbizApache OFBiz: Critical Remote Command Execution via Unrestricted File UploadCVE-2025-591187.3 High
- apache openofficeApache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variablesCVE-2025-644075.3 Medium
- Show moreLoading…