Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache software foundation kylinApache Kylin: unauthenticated broadcast API and polymorphic deserializationCVE-2026-1087719.8 Critical
- apache software foundation kylinApache Kylin: missing JDBC-config authorizationCVE-2026-1087666.5 Medium
- apache software foundation kylinApache Kylin: job-driver UI proxy SSRFCVE-2026-1087646.5 Medium
- apache software foundation kylinApache Kylin: delete metadata backup path-confinement bypassCVE-2026-1087627.3 High
- apache software foundation kylinApache Kylin: spark job OS command injectionCVE-2026-1087438.8 High
- apache software foundation kylinApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)CVE-2026-1087099.8 Critical
- apache software foundation kylinApache Kylin: Broken Access Control in QuerySQLBlacklistControllerCVE-2026-690807.5 High
- apache software foundation kylinApache Kylin: JobController allows unauthorized cross-project manipulationCVE-2026-690777.5 High
- apache software foundation kylinApache Kylin: Unauthorized cross-project job discardCVE-2026-690767.5 High
- apache software foundation kylinApache Kylin: Unauthenticated Metastore CleanupCVE-2026-685739.8 Critical
- apache software foundation kylinApache Kylin: Unauthorized SQL execution to Spark SQL envCVE-2026-685727.5 High
- apache software foundation kylinApache Kylin: JDBC URL Whitelist Verification BypassCVE-2026-685718.8 High
- apache software foundation kylinApache Kylin: Missing authentication on certain cache API endpointsCVE-2026-649599.8 Critical
- apache software foundation kylinApache Kylin: Redis unsafe Java deserializationCVE-2026-646109.8 Critical
- apache software foundation kylinApache Kylin: Missing authorization and path-confinement on system meta dumpCVE-2026-636199.1 Critical
- apache software foundation kylinApache Kylin: Low-Privilege Config ExposureCVE-2026-636187.5 High
- apache software foundation airflow sftp providerApache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultCVE-2026-941354.3 Medium
- apache software foundation airflow keycloak providerApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenCVE-2026-968065.8 Medium
- apache software foundation airflow sftp provider, airflow ssh provider +1 moreApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by defaultCVE-2026-94134Public exploit9.1 Critical
- apache software foundation airflow keycloak providerApache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log readCVE-2026-922286.5 Medium
- apache software foundation fesod (incubating)Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebindingCVE-2026-1074609.1 Critical
- apache software foundation alluraApache Allura: Oauth1 Replay AttackCVE-2026-921209.1 Critical
- apache software foundation alluraApache Allura: REST API Mass AssignmentCVE-2026-921199.1 Critical
- apache software foundation alluraApache Allura: OAuth1 missing callback validationCVE-2026-921169.1 Critical
- apache software foundation skywalking banyandbApache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxyCVE-2026-854999.1 Critical
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketchCVE-2026-1036367.5 High
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketchCVE-2026-1036359.1 Critical
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketchCVE-2026-1035139.8 Critical
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketchCVE-2026-1035019.8 Critical
- apache software foundation camel karavanApache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yamlCVE-2026-1034138.8 High
- apache software foundation camel karavanApache Camel Karavan: project file name path traversal when committing a project to GitCVE-2026-1034128.8 High
- apache cxfApache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limitsCVE-2026-1080397.5 High
- apache cxfApache CXF: The Netty HTTP client transport does not perform TLS hostname verification.CVE-2026-1079389.1 Critical
- apache cxfApache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.CVE-2026-1079377.5 High
- apache cxfApache CXF: XML Signature wrapping in JAX-RS XML SecurityCVE-2026-1002277.5 High
- apache cxfApache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requestsCVE-2026-977917.5 High
- apache cxfApache CXF: Authentication bypass via weak cache keys for validated STS tokensCVE-2026-974689.1 Critical
- apache cxfApache CXF: FIQL Query Parser Denial of ServiceCVE-2026-864637.5 High
- apache cxfApache CXF: OIDC RP Open RedirectCVE-2026-796506.1 Medium
- apache cxfApache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)CVE-2026-783847.5 High
- apache cxfApache CXF: JPA authorization-code consume is non-atomicCVE-2026-731798.1 High
- apache cxfApache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilterCVE-2026-71575Fix available9.1 Critical
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account InformationCVE-2026-718966.5 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes CredentialsCVE-2026-718957.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and PasswordsCVE-2026-711837.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint EndpointCVE-2026-660878.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream EndpointCVE-2026-660848.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）CVE-2026-660826.5 Medium
- apache software foundation geodeApache Geode: Management REST API: Insertion of Sensitive Information into Log FileCVE-2026-1033717.5 High
- apache jackrabbitApache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodiesCVE-2026-924156.9 Medium
- Show moreLoading…