Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache karafApache Karaf: Authorization bypass in JMX MBean lifecycle operationsCVE-2026-921428.8 High
- apache karafApache Karaf: config:install missing ACL entry allows privilege escalation to adminCVE-2026-910856.3 Medium
- apache karafApache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-createCVE-2026-910489.8 Critical
- apache karafApache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege EscalationCVE-2026-910129.8 Critical
- apache karafApache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)CVE-2026-910068.8 High
- apache karafApache Karaf: LDAP filter injection in JAAS LDAP login modulesCVE-2026-909797.3 High
- apache software foundation rollerApache Roller: Stored XSS in comment moderation via comment author URLCVE-2026-865076.1 Medium
- apache software foundation rollerApache Roller: WSSE digest authentication headers can be replayedCVE-2026-823797.7 High
- apache software foundation rollerApache Roller: CSRF protection bypass via self-generated salt validationCVE-2026-823808.1 High
- apache software foundation rollerApache Roller: Stored cross-site scripting in the authoring UICVE-2026-823815.4 Medium
- apache software foundation rollerApache Roller: Reflected cross-site scripting in the frontpage directory parameterCVE-2026-823826.1 Medium
- apache software foundation rollerApache Roller: Anonymous setup action allows frontpage configuration tamperingCVE-2026-823838.2 High
- apache software foundation rollerApache Roller: Unauthenticated deserialization in the XML-RPC endpointCVE-2026-82384Public exploit9.8 Critical
- apache software foundation rollerApache Roller: Server-side request forgery via entry trackback and enclosure URLsCVE-2026-823757.4 High
- apache software foundation rollerApache Roller: XML external entity processing in trackback response parserCVE-2026-823767.7 High
- apache software foundation rollerApache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlersCVE-2026-823779.9 Critical
- apache software foundation rollerApache Roller: OAuth authorization endpoint trusts request-supplied identityCVE-2026-823789.0 Critical
- apache software foundation rollerApache Roller: Weblog template include escapes the Velocity sandbox and reads classpath filesCVE-2026-823856.5 Medium
- apache software foundation rollerApache Roller: XML external entity processing in OPML bookmark importCVE-2026-823867.7 High
- apache software foundation rollerApache Roller: Cross-weblog resource tampering via unscoped authoring lookupsCVE-2026-823487.7 High
- apache software foundation rollerApache Roller: Stored cross-site scripting via uploaded media content typeCVE-2026-823875.4 Medium
- apache software foundation rollerApache Roller: Stored cross-site scripting through incoming Trackback linksCVE-2026-825466.1 Medium
- apache software foundation rollerApache Roller: Stored javascript: URI in HTML commentsCVE-2026-912046.1 Medium
- apache software foundation rollerApache Roller: Reflected XSS in the optional LDAP comment authenticatorCVE-2026-912066.1 Medium
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoderCVE-2026-925507.5 High
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoderCVE-2026-925607.5 High
- apache qpid broker-jApache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON renderingCVE-2026-925736.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingCVE-2026-925647.5 High
- apache qpid broker-jApache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10CVE-2026-926087.5 High
- apache qpid broker-jApache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationCVE-2026-926099.8 Critical
- apache software foundation airflow hashicorp providerApache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled keyCVE-2026-976366.5 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project OperationsCVE-2026-575908.1 High
- apache tomcat nativeApache Tomcat Native: Client certificate requirements can be down-gradedCVE-2026-86247Fix available7.4 High
- apache tomcat nativeApache Tomcat Native: Insecure OpenSSL options enabledCVE-2026-86246Fix available9.1 Critical
- apache tomcat nativeApache Tomcat Native: DoS via TLS handshakeCVE-2026-86243Fix available7.5 High
- apache sling security, apache software foundation sling security bundle +1 moreApache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidenceCVE-2026-942437.3 High
- apache sling security, apache software foundation sling security bundle +1 moreApache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resourceCVE-2026-942516.5 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanismsCVE-2026-919286.1 Medium
- apache software foundation dorisApache Doris: JDBC driver URL validation bypass leads to remote code executionCVE-2026-964436.5 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImplCVE-2026-918526.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Improper escaping in the XSS Webconsole pluginCVE-2026-919996.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Missing parser resource limitsCVE-2026-920016.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: XSS possible through XSSAPI.getValidHref()CVE-2026-731926.1 Medium
- apache software foundation dorisApache Doris: Improper Authentication Allows Unauthorized Access to FE Meta ServiceCVE-2026-313777.5 High
- apache software foundation buildstreamApache BuildStream: tar source extraction escapeCVE-2026-82331Fix available9.8 Critical
- apache software foundation calcite avaticaApache Calcite Avatica: Unrestricted class initialization when instantiating pluginsCVE-2026-704108.8 High
- apache software foundation tomcatApache Tomcat: WebSocket message smuggling with per-message-deflateCVE-2026-87022Fix available7.5 High
- apache software foundation tomcatApache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upCVE-2026-86350Public exploitFix available9.1 Critical
- apache software foundation tomcatApache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledCVE-2026-86248Fix available9.8 Critical
- apache software foundation tomcatApache Tomcat: WebSocket DoS due to lost asynchronous write timeoutCVE-2026-79677Fix available7.5 High
- Show moreLoading…