Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smugglingCVE-2025-65114Fix available7.5 High
- apache traffic serverApache Traffic Server: A simple legitimate POST request causes a crashCVE-2025-58136Fix available7.5 High
- apache software foundation airflow provider for databricks, apache airflow providers databricks +1 moreApache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token ExchangeCVE-2026-32794Public exploitFix available4.8 Medium
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permissionCVE-2026-32642Fix available2.3 Low
- apache airflowApache Airflow: DAG authorization bypassCVE-2026-28563Fix available4.3 Medium
- apache airflowApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataCVE-2026-26929Fix available6.5 Medium
- apache airflowApache Airflow: Execution API HITL Endpoints Missing Per-Task AuthorizationCVE-2026-30911Fix available8.1 High
- apache airflowApache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applicationsCVE-2026-28779Fix available7.5 High
- apache sparkApache Spark: Spark History Server Code Execution VulnerabilityCVE-2025-54920Fix available8.8 High
- apache livyApache Livy: Restrict file accessCVE-2025-60012Public exploitFix available6.3 Medium
- apache livyApache Livy: Unauthorized directory accessCVE-2025-66249Public exploitFix available6.3 Medium
- apache software foundation pdfbox examples, apache pdfbox-examples +1 moreApache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example CodeCVE-2026-23907Public exploitFix available5.3 Medium
- apache apache-airflow-providers-amazon, apache software foundation airflow providers amazon +1 moreApache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication BypassCVE-2026-25604Public exploitFix available5.4 Medium
- apache airflow providers httpApache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorCVE-2025-69219Public exploitFix available8.8 High
- apache iotdbApache IoTDB: JEXL Expression Injection VulnerabilityCVE-2026-24713Fix available9.8 Critical
- apache iotdbApache IoTDB: Insecure Default Configuration VulnerabilityCVE-2026-24015Fix available9.8 Critical
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Sensitive information disclosure in client configuration handlingCVE-2026-24308Fix available7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24281Fix available7.4 High
- apache artemis, apache software foundation activemq artemis, red hat amq broker 7.12.6 +17 more +19 moreApache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federationCVE-2026-27446Fix availableEPSS 11.4%9.3 Critical
- apache activemq, apache software foundation activemq all module, activemq mqtt module +2 moreApache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validatedCVE-2025-66168Fix available5.4 Medium
- apache rangerApache Ranger: Hostname verification bypass in NiFiRegistryClientCVE-2025-59060Fix available5.3 Medium
- apache rangerApache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreatorCVE-2025-59059Public exploitFix available9.8 Critical
- apache supersetApache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function FilteringCVE-2026-23969Fix available5.3 Medium
- apache supersetApache Superset: Improper Neutralization of Special Elements used in a SQL CommandCVE-2026-23980Public exploitFix available5.3 Medium
- apache supersetApache Superset: Improper Authorization in Dataset Creation Allows Access Control BypassCVE-2026-23982Fix available7.1 High
- apache supersetApache Superset: Sensitive Data Exposure via REST API (disabled by default)CVE-2026-23983Fix available2.3 Low
- apache supersetApache Superset: SQLLab Read-Only Bypass on PostgreSQLCVE-2026-23984Fix available7.1 High
- apache airflowApache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cliCVE-2025-27555Fix available6.5 Medium
- apache airflowApache Airflow: SSTI to Code Execution in Airflow through Shared DB InformationCVE-2024-56373Fix available8.4 High
- apache camel, apache software foundation camel leveldb, red hat build of apache camel for spring boot 4 +3 more +5 moreApache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDBCVE-2026-25747Public exploitFix available8.8 High
- apache camelApache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicyCVE-2026-23552Public exploitFix available9.1 Critical
- apache airflowApache Airflow: Disclosure of secrets to UI via kwargsCVE-2025-65995Fix available6.5 Medium
- apache arrowApache Arrow: Potential use-after-free when reading IPC file with pre-bufferingCVE-2026-25087Fix available7.0 High
- apache nifiApache NiFi: Missing Authorization of Restricted Permissions for Component UpdatesCVE-2026-25903Fix available8.7 High
- apache avro, apache software foundation avro java sdk +1 moreApache Avro Java SDK: Code injection on Java generated codeCVE-2025-33042Fix available7.3 High
- apache hertzbeatApache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsCVE-2026-243438.8 High
- apache druidApache Druid: Authentication Bypass via LDAP Anonymous BindCVE-2026-23906Fix available9.8 Critical
- apache shiroApache Shiro: Brute force attack possible to determine valid user namesCVE-2026-23901Fix available1.0 Low
- apache airflowApache Airflow: Airflow externalLogUrl Permission BypassCVE-2026-22922Fix available6.5 Medium
- apache airflowApache Airflow: Assigning single DAG permission leaked all DAGs Import ErrorsCVE-2026-24098Fix available6.5 Medium
- apache shiroApache Shiro: Auth bypass when accessing static files only on case-insensitive filesystemsCVE-2026-23903Fix available5.3 Medium
- apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 moreApache Tomcat Native, Apache Tomcat: OCSP revocation bypassCVE-2026-24734Fix available7.5 High
- apache tomcatApache Tomcat: Security constraint bypass with HTTP/0.9CVE-2026-24733Public exploitFix available3.7 Low
- apache tomcatApache Tomcat: Client certificate verification bypass due to virtual host mappingCVE-2025-66614Fix available9.1 Critical
- apache answerApache Answer: Revision API Improper Access Control leads to Information DisclosureCVE-2026-24735Fix available7.5 High
- apache syncopeApache Syncope: Reflected XSS on Enduser LoginCVE-2026-23794Fix available6.8 Medium
- apache syncopeApache Syncope: Console XXE on Keymaster parametersCVE-2026-23795Fix available4.9 Medium
- apache continuumApache Continuum: Command injection leading to RCECVE-2016-15057Public exploit9.9 Critical
- apache hadoop, apache software foundation hdfs native client +1 moreHDFS native client: Out of bounds write in URI parser of native HDFS clientCVE-2025-27821Fix available7.3 High
- apache karaf decanter, apache software foundation karaf +1 moreApache Karaf: Decanter log-socket collector has deserialization vulnerabilityCVE-2026-24656Fix available3.7 Low
- Show moreLoading…