Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache software foundation storm nimbusApache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar LocationCVE-2026-824266.5 Medium
- apache software foundation storm webappApache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web OriginsCVE-2026-824388.1 High
- apache software foundation storm drpcApache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPCCVE-2026-824399.8 Critical
- apache software foundation storm nimbusApache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency KeysCVE-2026-824419.1 Critical
- apache software foundation storm nimbus, storm ui +1 moreApache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology PageCVE-2026-841796.5 Medium
- apache software foundation syncopeApache Syncope: CAS service URL injection via Forwarded HTTP headersCVE-2026-731916.1 Medium
- apache software foundation syncopeApache Syncope: CSV export spreadsheet formula injectionCVE-2026-731957.3 High
- apache software foundation syncopeApache Syncope: Cross-Realm authorization bypass in delegated administrationCVE-2026-732367.5 High
- apache software foundation syncopeApache Syncope: Cross-Realm boundaries reconciliation bypassCVE-2026-733709.8 Critical
- apache software foundation syncopeApache Syncope: JWT Access Token takeoverCVE-2026-731787.5 High
- apache software foundation syncopeApache Syncope: Delegating users can grant unowned RolesCVE-2026-734709.8 Critical
- apache software foundation syncopeApache Syncope: Non-recursive Any search could skip Realms restrictionsCVE-2026-735799.8 Critical
- apache software foundation syncopeApache Syncope: Nested secrets leak cleartext into audit records readableCVE-2026-750154.9 Medium
- apache software foundation syncopeApache Syncope: Incomplete authorization checks for Group members deprovisioningCVE-2026-750309.8 Critical
- apache software foundation syncopeApache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events searchCVE-2026-770519.8 Critical
- apache software foundation syncopeApache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration valuesCVE-2026-736689.8 Critical
- apache software foundation syncopeApache Syncope: Groovy Sandbox escape for empty CommandArgsCVE-2026-771476.5 Medium
- apache software foundation syncopeApache Syncope: ClientApp update entitlement not effectiveCVE-2026-771819.8 Critical
- apache software foundation syncopeApache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylistCVE-2026-778834.9 Medium
- apache software foundation syncopeApache Syncope: Unauthenticated reflected XSS in Console and EnduserCVE-2026-783186.1 Medium
- apache software foundation syncopeApache Syncope: Privilege escalation for admin user via JWT authenticationCVE-2026-783309.8 Critical
- apache software foundation syncopeApache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated userCVE-2026-783367.5 High
- apache software foundation syncopeApache Syncope: SQL injection via sort parameter in Task searchCVE-2026-822329.8 Critical
- apache software foundation syncopeApache Syncope: Cypher Injection via FIQL Search on Neo4j PersistenceCVE-2026-864609.8 Critical
- apache software foundation syncopeApache Syncope: AES Secret Key disclosure via log outputCVE-2026-877797.5 High
- apache software foundation syncopeApache Syncope: JWT subject spoofingCVE-2026-877859.1 Critical
- apache software foundation syncopeApache Syncope: SRA OAuth2 JWT signature verification bypassCVE-2026-878029.1 Critical
- apache software foundation dorisApache Doris: Authorization bypass leading to unauthorized data accessCVE-2026-685706.5 Medium
- apache software foundation dorisApache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tablesCVE-2026-725248.8 High
- apache opennlpApache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsCVE-2026-82617Fix available10.0 Critical
- apache opennlpApache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializerCVE-2026-672117.5 High
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespaceCVE-2026-803548.1 High
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Tenant repositories reach Maven execution inside operator podCVE-2026-803519.8 Critical
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objectsCVE-2026-803529.8 Critical
- apache freemarkerApache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacksCVE-2026-84939Fix available9.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue CreationCVE-2026-49362Fix available7.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology SubscriptionCVE-2026-493637.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered PeersCVE-2026-493649.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of serviceCVE-2026-578226.5 Medium
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentCVE-2026-57967Public exploit9.8 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionCVE-2026-675939.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of serviceCVE-2026-758806.5 Medium
- apache activemq, activemq all, activemq broker +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdCVE-2026-74761Fix available7.5 High
- apache parquet, apache software foundation parquet hadoop +1 moreApache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validationCVE-2026-733348.1 High
- apache nutchApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)CVE-2026-418719.8 Critical
- apache nutchApache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)CVE-2026-418699.1 Critical
- apache nutchApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)CVE-2026-418708.8 High
- apache impalaApache Impala: RCE via External Data Source Class LoadingCVE-2026-651818.1 High
- apache impalaApache Impala: Secrets Exfiltration via SSRFCVE-2026-578668.8 High
- apache impalaApache Impala: SAML authentication bypass via forged bearer tokenCVE-2026-562079.8 Critical
- Show moreLoading…