Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UICVE-2026-613989.1 Critical
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UICVE-2026-613994.8 Medium
- apache cloudstackApache CloudStack: Get and Run Diagnostics Command InjectionCVE-2026-614008.8 High
- apache cloudstackApache CloudStack: Authenticated pre-validation SSRF in registerTemplateCVE-2026-614224.3 Medium
- apache cloudstackApache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulationCVE-2026-624409.1 Critical
- apache cloudstackApache CloudStack: Webhook Deliveries Incorrect AccessCVE-2026-656134.3 Medium
- apache cloudstackApache CloudStack: Authorization issue with listHostTags for domain adminsCVE-2026-667212.7 Low
- apache cloudstackApache CloudStack: ProjectRole & ProjectRolePermission authorization issueCVE-2026-667227.2 High
- apache cloudstackApache CloudStack: Unauthorised comment creation and disclosureCVE-2026-667975.4 Medium
- apache cloudstackApache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdPCVE-2026-687458.1 High
- apache inlongApache InLong: Authenticated SSRF via POST /api/node/testConnectionCVE-2026-630445.4 Medium
- apache inlongApache InLong: Agent path traversal via unvalidated file source pathCVE-2026-630437.5 High
- apache inlongApache InLong: Missing authorization on DataNode management endpointsCVE-2026-630428.1 High
- apache inlongApache InLong: Missing authorization in StreamSource forceDeleteCVE-2026-630408.1 High
- apache inlongApache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleServiceCVE-2026-63039Public exploit9.8 Critical
- apache inlongApache InLong: SQL Injection via String Concatenation Vulnerability ReportCVE-2026-630389.8 Critical
- apache inlongApache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpointCVE-2026-630379.8 Critical
- apache inlongApache InLong: Ordinary users can create new packagesCVE-2026-630165.3 Medium
- apache inlongApache InLong: Non-template responsible persons can view template informationCVE-2026-630154.3 Medium
- apache tomcatApache Tomcat: Authenticated WebSocket session survives end of HTTP sessionCVE-2026-73180Fix available6.8 Medium
- apache tomcatApache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is resetCVE-2026-68763Fix available7.5 High
- apache tomcatApache Tomcat: Redirect after FORM auth may bypass method specific constraintsCVE-2026-68525Fix available9.1 Critical
- apache tomcatApache Tomcat: Servlet role references can bypass declarative role constraintsCVE-2026-66422Fix available8.1 High
- apache tomcatApache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access controlCVE-2026-65927Fix available7.5 High
- apache tomcatApache Tomcat: Limited replay attack possible with DIGEST authenticationCVE-2026-65905Fix available9.8 Critical
- apache tomcatApache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteCVE-2026-65637Fix available9.8 Critical
- apache tomcatApache Tomcat: TOCTOU when setting specific permissions for Unix Domain SocketsCVE-2026-65183Fix available8.1 High
- apache tomcatApache Tomcat: Bypass longest prefix security constraintCVE-2026-65182Fix available9.1 Critical
- apache skywalking mcpApache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP ServerCVE-2026-348849.8 Critical
- apache strutsApache Struts: Shared serialization state in the JSON pluginCVE-2026-736324.3 Medium
- apache strutsApache Struts: Shared parsing state in the JSON pluginCVE-2026-736314.3 Medium
- apache strutsApache Struts: Unbounded growth of localized-text caches driven by the request localeCVE-2026-736357.5 High
- apache strutsApache Struts: Unbounded read of a Content Security Policy violation reportCVE-2026-736347.5 High
- apache strutsApache Struts: Unbounded read of a JSON request bodyCVE-2026-73633Public exploit7.5 High
- apache shindig, apache software foundation shindig common, shindig social-api +2 moreApache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)CVE-2026-662567.2 High
- apache alluraApache Allura: XSS in markdown pipelineCVE-2026-732376.1 Medium
- apache alluraApache Allura: XSS in code displayCVE-2026-732386.1 Medium
- apache alluraApache Allura: Missing permission checks IDORCVE-2026-732396.5 Medium
- apache alluraApache Allura: Git command injectionCVE-2026-732409.8 Critical
- apache airflowApache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UICVE-2026-59244Fix available6.5 Medium
- apache airflowApache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API ServerCVE-2026-58076Fix available8.8 High
- apache airflowApache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpointCVE-2026-59242Fix available5.4 Medium
- apache airflowApache Airflow: Airflow Variables were not masked in the UI for authenticated usersCVE-2026-54183Fix available4.3 Medium
- apache airflowApache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserializationCVE-2026-67260Fix available7.3 High
- apache airflowApache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadgetCVE-2026-67587Fix available8.8 High
- apache airflowApache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)CVE-2026-65017Fix available6.5 Medium
- apache airflowApache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill idCVE-2026-68968Fix available7.5 High
- apache airflowApache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartextCVE-2026-68969Fix available6.5 Medium
- apache airflowApache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UICVE-2026-68970Fix available6.5 Medium
- apache airflowApache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpointsCVE-2026-68971Fix available6.5 Medium
- Show moreLoading…