Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache http serverApache HTTP Server: mod_proxy_html: crash in dump_contentCVE-2026-56449Fix available7.5 High
- apache http serverApache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}CVE-2026-56154Fix available9.8 Critical
- apache http serverApache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_charCVE-2026-56153Fix available7.5 High
- apache http serverApache HTTP Server: mod_auth_digest reauthentication attackCVE-2026-48005Fix available7.5 High
- apache http serverApache HTTP Server: mod_session: Session cookie not removed during internal redirectCVE-2026-47360Fix available7.5 High
- apache http serverApache HTTP Server: mod_heartmonitor denial of serviceCVE-2026-46729Fix available7.5 High
- apache http serverApache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directoriesCVE-2026-42356Fix available3.7 Low
- apache http serverApache HTTP Server: mod_dav shared lock overflowCVE-2026-42528Fix available4.3 Medium
- apache software foundation apisixApache APISIX: Openid-connect introspection validation issueCVE-2026-94276Fix available5.1 Medium
- apache software foundation apisixApache APISIX: Servlet-style normalization creates a route/upstream authorization mismatchCVE-2026-94269Fix available6.3 Medium
- apache software foundation apisixApache APISIX: Batch response aggregation can exhaust worker memoryCVE-2026-94250Fix available8.2 High
- apache software foundation apisixApache APISIX: session fixation issue in feishu-auth and dingtalk-auth pluginCVE-2026-94220Fix available2.1 Low
- apache software foundation apisixApache APISIX: unauthenticated impersonation issue in saml-authCVE-2026-94212Fix available6.4 Medium
- apache software foundation apisixApache APISIX: cross-request permission pollution via static permission list mutationCVE-2026-82806Fix available5.3 Medium
- apache software foundation apisixApache APISIX: data-mask may fail to redact request headers in logger outputCVE-2026-78242Fix available5.7 Medium
- apache software foundation camel quarkusApache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardeningCVE-2026-88789Public exploit8.6 High
- apache wss4jApache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensionsCVE-2026-956167.5 High
- apache wss4jApache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceCVE-2026-928994.8 Medium
- apache wss4jApache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceCVE-2026-92121Fix available7.5 High
- apache wss4jApache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionCVE-2026-892389.1 Critical
- apache wss4jApache WSS4J: SAML Sender-Vouches Authentication BypassCVE-2026-889209.8 Critical
- apache wss4jApache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.CVE-2026-878309.1 Critical
- apache wss4jApache WSS4J: Insufficient Validation of Derived-Key ParametersCVE-2026-85532Fix available7.5 High
- apache software foundation mina sshdApache MINA SSHD: Asynchronous authentication can bypass signature verificationCVE-2026-77185Fix available9.1 Critical
- apache software foundation mina sshdApache MINA SSHD: Repeated-publickey policy bypass on serverCVE-2026-93994Fix available8.1 High
- apache software foundation mina sshdApache MINA SSHD: LDAP injection in sshd-ldapCVE-2026-94053Fix available9.1 Critical
- apache software foundation mina sshdApache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the serverCVE-2026-93995Fix available6.5 Medium
- apache software foundation mina sshdApache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line readCVE-2026-93996Fix available6.5 Medium
- apache software foundation mina sshdApache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesCVE-2026-94002Fix available7.5 High
- apache software foundation mina sshdApache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extensionCVE-2026-94029Fix available6.5 Medium
- apache software foundation mina sshdApache MINA SSHD: LDAP password authentication ineffectiveCVE-2026-94052Fix available9.1 Critical
- apache software foundation plc4xApache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themCVE-2026-1025118.5 High
- apache software foundation plc4xApache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsCVE-2026-1025108.7 High
- apache software foundation plc4xApache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserCVE-2026-1025098.7 High
- apache software foundation plc4xApache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeCVE-2026-1025089.2 Critical
- apache software foundation polarisApache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentialsCVE-2026-973958.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpointsCVE-2026-718974.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow DefinitionsCVE-2026-718984.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information DisclosureCVE-2026-718996.5 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded PathsCVE-2026-782145.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow ExecutionCVE-2026-815694.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Command Injection in the Alert Script PluginCVE-2026-828048.8 High
- apache dolphinschedulerApache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasourceCVE-2026-660836.5 Medium
- apache xmlschemaApache XMLSchema: Denial of service through cyclic schema definitions in the schema walkerCVE-2026-1024977.5 High
- apache xmlschemaApache XMLSchema: Denial of service through deeply nested schema structuresCVE-2026-1024967.5 High
- apache xmlschemaApache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includesCVE-2026-1024957.5 High
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example DagCVE-2026-868436.3 Medium
- apache apache-airflow-providers-snowflake, apache software foundation airflow snowflake provider +1 moreApache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domainCVE-2026-81930Fix available6.3 Medium
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logsCVE-2026-818626.5 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: Google Drive query injection via unescaped file and folder namesCVE-2026-81914Fix available4.3 Medium
- Show moreLoading…