Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache qpid protonj2Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-675927.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-675556.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-680786.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-662776.5 Medium
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of serviceCVE-2026-675546.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unbounded disposition range handling can lead to denial of serviceCVE-2026-680776.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Unbounded disposition range handling can lead to denial of serviceCVE-2026-662766.5 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Incoming session flow control window can be exceededCVE-2026-675916.5 Medium
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Incoming session flow control window can be exceededCVE-2026-675536.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Incoming session flow control window can be exceededCVE-2026-680756.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Incoming session flow control window can be exceededCVE-2026-662756.5 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflowCVE-2026-675907.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflowCVE-2026-675527.5 High
- apache qpid broker-jApache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflowCVE-2026-680737.5 High
- apache qpid proton-jApache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowCVE-2026-66274Fix available7.5 High
- apache qpid protonj2Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-675897.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-675517.5 High
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-680607.5 High
- apache qpid proton-jApache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-662737.5 High
- apache qpid protonj2Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-675887.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-674657.5 High
- apache qpid broker-jApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-680747.5 High
- apache qpid proton-jApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-662577.5 High
- apache nifiApache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsCVE-2026-68981Fix available8.8 High
- apache nifiApache NiFi: Authorization Bypass for Parameter Context Asset DeletionCVE-2026-68980Fix available2.3 Low
- apache nifiApache NiFi: Incorrect Authorization for Parameter Context Validation RequestsCVE-2026-62354Fix available7.7 High
- apache nifiApache NiFi: Missing Authorization for Components Referenced by Parameter Context UpdatesCVE-2026-68979Fix available5.9 Medium
- apache jena fusekiApache Jena Fuseki: Web requests using SPARQL Update can escape file restrictionsCVE-2026-613727.5 High
- apache zeppelinPath traversal in NotebookRepo note and folder path compositionCVE-2026-446156.5 Medium
- apache httpclient, apache software foundation httpcomponents client +1 moreApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSCVE-2026-64607Fix available5.3 Medium
- apache kyuubiApache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliasesCVE-2026-623918.1 High
- apache tikaApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseCVE-2026-667566.9 Medium
- apache tikaApache Tika: Arbitrary Local File Read in ISArchiveParserCVE-2026-66755Fix available5.9 Medium
- apache supersetApache Superset: Regular Expression Denial of Service (ReDoS) in SQL ParserCVE-2026-23985Fix available5.3 Medium
- apache supersetApache Superset: Improper Authorization in Chart Update allowing Dashboard ModificationCVE-2026-23981Fix available5.3 Medium
- apache kyuubiApache Kyuubi: REST batch multipart upload path traversal allows controlled file writeCVE-2026-52680Public exploit9.8 Critical
- apache jspwikiApache JSPWiki: Markdown parser allows XSS injection in Markdown error processingCVE-2026-489106.5 Medium
- apache jspwikiApache JSPWiki: Pre-Authentication Arbitrary Wiki Markup RenderingCVE-2026-288147.5 High
- apache jspwikiApache JSPWiki: JSPWiki vulnerable to JSON hijackingCVE-2026-288138.8 High
- apache jspwikiApache JSPWiki: UserManager does not sanity-check user database at startupCVE-2026-288129.8 Critical
- apache jspwikiApache JSPWiki: Error Handling - Reveals Error DetailsCVE-2026-288117.5 High
- apache zeppelinApache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867CVE-2026-446176.5 Medium
- apache zeppelinApache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionCVE-2026-446166.5 Medium
- apache zeppelinApache Zeppelin: Cross-site request forgery in REST and WebSocket request handlingCVE-2026-44613Public exploit6.1 Medium
- apache atlasApache Atlas: Missing Authorization on Admin EndpointsCVE-2026-506228.8 High
- apache kyuubiApache Kyuubi: Unrestricted access via Kyuubi engine-ui proxyCVE-2026-239047.3 High
- apache traffic serverApache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeCVE-2026-651006.3 Medium
- apache traffic serverApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplificationCVE-2026-581898.2 High
- apache traffic serverApache Traffic Server: Memory-safety and limit-bypass errors across experimental pluginsCVE-2026-581888.4 High
- apache traffic serverApache Traffic Server: Multiplexer plugin chunk decoder enables a denial of serviceCVE-2026-581876.3 Medium
- Show moreLoading…