Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache software foundation tomcatApache Tomcat: HTTP/2 DoS via malformed requestCVE-2026-78437Fix available7.3 High
- apache software foundation tomcatApache Tomcat: AJP DoS via missing request bodyCVE-2026-78383Fix available7.5 High
- apache software foundation tomcatApache Tomcat: DoS via busy wait during WebSocket closeCVE-2026-77791Fix available7.5 High
- apache software foundation tomcatApache Tomcat: Stale HPACK emitter injects trailers into recycled pooled RequestCVE-2026-77762Fix available8.1 High
- apache software foundation tomcatApache Tomcat: Transfer-Encoding honored for HTTP/1.0 requestsCVE-2026-77756Fix available3.7 Low
- apache software foundation tomcatApache Tomcat: Bypass of security constraints for WebSocket endpointsCVE-2026-76183Public exploitFix available9.8 Critical
- apache software foundation tomcatApache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configuredCVE-2026-75973Fix available7.3 High
- apache software foundation tomcatApache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystoreCVE-2026-73581Fix available6.5 Medium
- apache software foundation minaApache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232CVE-2026-943019.8 Critical
- apache airflowApache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryCVE-2026-86473Fix available9.1 Critical
- apache airflowApache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filterCVE-2026-75158Fix available4.3 Medium
- apache airflowApache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixationCVE-2026-82355Fix available4.2 Medium
- apache neethiApache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitelyCVE-2026-918674.3 Medium
- apache neethiApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceCVE-2026-918667.5 High
- apache neethiApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceCVE-2026-918657.5 High
- apache neethiApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionCVE-2026-918647.5 High
- apache neethiApache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceCVE-2026-918637.5 High
- apache software foundation minaApache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateCVE-2026-47321Fix available7.5 High
- apache software foundation airflowApache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)CVE-2026-75157Public exploitFix available7.5 High
- apache software foundation karafApache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingCVE-2026-922307.5 High
- apache nifiApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsCVE-2026-70469Fix available7.5 High
- apache nifiApache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector ConfigurationCVE-2026-81866Fix available0.5 Low
- apache nifiApache NiFi: Missing Authorization for Components Referenced in Flow Update MethodsCVE-2026-82561Fix available5.9 Medium
- apache nifiApache NiFi: Missing Process Group Authorization for Connector MigrationCVE-2026-86089Fix available2.3 Low
- apache nifi, apache software foundation nifi registry +1 moreApache NiFi Registry: Improper Limitation of Pathname in Persisted Extension BundlesCVE-2026-87976Fix available7.2 High
- apache software foundation myfacesApache MyFaces: Denial of Service via Unbounded Request ParsingCVE-2026-766467.5 High
- apache software foundation myfacesApache MyFaces: Server-Side Request Forgery / Local File Inclusion VulnerabilityCVE-2026-685369.8 Critical
- apache zookeeperApache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProviderCVE-2026-84501Fix available5.3 Medium
- apache zookeeperApache ZooKeeper: Audit log injection via unsanitized output from multiple sourcesCVE-2026-84439Fix available5.3 Medium
- apache zookeeperApache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znodeCVE-2026-79993Fix available7.5 High
- apache zookeeperApache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeCVE-2026-59969Fix available7.5 High
- apache zookeeperApache ZooKeeper: Information disclosure via SetWatches reconnect replayCVE-2026-59739Fix available7.5 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedCVE-2026-864668.1 High
- apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 moreApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTCVE-2026-761879.8 Critical
- apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 moreApache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identityCVE-2026-761869.1 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessCVE-2026-823107.2 High
- apache apache-airflow-providers-apache-kafka, apache software foundation airflow apache kafka provider +1 moreApache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationCVE-2026-86792Fix available8.8 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsCVE-2026-864629.1 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseCVE-2026-823119.8 Critical
- apache apache-airflow-providers-akeyless, apache software foundation airflow akeyless provider +1 moreApache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled keyCVE-2026-864656.5 Medium
- apache software foundation storm nimbusApache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local NameCVE-2026-824277.8 High
- apache software foundation storm clientApache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob KeysCVE-2026-824288.8 High
- apache software foundation storm worker launcherApache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker LauncherCVE-2026-824297.8 High
- apache software foundation storm worker launcherApache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the TenantCVE-2026-824307.8 High
- apache software foundation storm clientApache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.usersCVE-2026-824319.8 Critical
- apache software foundation storm nimbus, storm ui +1 moreApache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UICVE-2026-824336.5 Medium
- apache software foundation storm nimbusApache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration OverridesCVE-2026-824328.1 High
- apache software foundation storm client, storm nimbus +1 moreApache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to LogsCVE-2026-8243410.0 Critical
- apache software foundation storm workerApache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderCVE-2026-824359.8 Critical
- apache software foundation storm logviewerApache Storm Logviewer: Log Access Controls Not Enforced by LogviewerCVE-2026-824374.3 Medium
- Show moreLoading…