Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache software foundation brpcApache bRPC: Missing Authentication for Streaming RPC FramesCVE-2026-783349.1 Critical
- apache software foundation brpcApache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared SizesCVE-2026-780667.5 High
- apache software foundation brpcApache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive PathCVE-2026-780587.5 High
- apache software foundation brpcApache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK DecoderCVE-2026-780487.5 High
- apache software foundation brpcApache bRPC: Heap Use-After-Free in RTMP Abort Message HandlingCVE-2026-747587.5 High
- apache software foundation brpcApache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item CountCVE-2026-747577.5 High
- apache software foundation brpcApache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of ServiceCVE-2026-747557.5 High
- apache software foundation brpcApache bRPC: TLS Client Accepts Certificates for Mismatched Peer NamesCVE-2026-663925.9 Medium
- apache software foundation brpcApache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char PlatformsCVE-2026-619167.5 High
- apache software foundation brpcApache bRPC: Memory Exhaustion Through Inconsistent Message Body LimitsCVE-2026-619027.5 High
- apache software foundation brpcApache bRPC: Denial of Service via Unbounded Redis Inline Command AllocationCVE-2026-580647.5 High
- apache software foundation brpcApache bRPC: Out-of-Bounds Write in Redis Command ParserCVE-2026-563889.1 Critical
- apache software foundation brpcApache bRPC: Remote Memory Exhaustion in RTMP AMF ParserCVE-2026-563877.5 High
- apache software foundation brpcApache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame ParserCVE-2026-563867.5 High
- apache software foundation brpcApache bRPC: Stack Exhaustion via Unbounded Recursion in AMF ParserCVE-2026-544277.5 High
- apache software foundation brpcApache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply ParserCVE-2026-544267.5 High
- apache software foundation brpcApache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update DecodingCVE-2026-544257.5 High
- apache software foundation brpcApache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsCVE-2026-488309.1 Critical
- apache software foundation iotdbApache IoTDB: Legacy Pipe Privilege EscalationCVE-2026-592298.8 High
- apache software foundation iotdbApache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPCCVE-2026-595629.8 Critical
- apache software foundation iotdb jdbc driverApache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC DriverCVE-2026-411147.5 High
- apache software foundation iotdbApache IoTDB: Auth Bypass in pipeTransfer() interfaceCVE-2026-586639.8 Critical
- apache software foundation couchdbApache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLsCVE-2026-107755Fix available6.0 Medium
- apache software foundation couchdbApache CouchDB: Auth bypass in prefixed _users and _replicator databasesCVE-2026-90800Fix available8.1 High
- apache software foundation couchdbApache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence valuesCVE-2026-90799Fix available1.3 Low
- apache software foundation couchdbApache CouchDB: Replicator follows redirects indefinitelyCVE-2026-90798Fix available0.6 Low
- apache software foundation couchdbApache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionCVE-2026-90797Fix available7.7 High
- apache software foundation couchdbApache CouchDB: Admin credentials leading to code execution as operating system userCVE-2026-86471Fix available9.3 Critical
- apache software foundation tomcatApache Tomcat: AJP response mix-upCVE-2026-103119Fix available9.1 Critical
- apache software foundation tomcatApache Tomcat: HTTP/2 request/response mix-up after error during async processingCVE-2026-101356Fix available9.1 Critical
- apache software foundation tomcatApache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsCVE-2026-101296Fix available9.1 Critical
- apache software foundation tomcatApache Tomcat: Possible TLS 1.3 connection failuresCVE-2026-93446Fix available7.5 High
- apache software foundation tomcatApache Tomcat: HTTP/2 trailer header cross-contaminationCVE-2026-88041Fix available7.5 High
- apache software foundation tomcatApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorCVE-2026-80353Fix available8.1 High
- apache software foundation tomcatApache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)CVE-2026-74049Fix available6.1 Medium
- apache software foundation tomcatApache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-upCVE-2026-74048Fix available6.5 Medium
- apache software foundation cocoonApache Cocoon: Unauthenticated access to diagnostic interfacesCVE-2026-1080897.5 High
- apache software foundation cocoonApache Cocoon: Cross-user cache poisoningCVE-2026-1080887.5 High
- apache software foundation cocoonApache Cocoon: SQL InjectionCVE-2026-1080878.8 High
- apache software foundation cocoonApache Cocoon: XEE could lead to SSRF and information disclosureCVE-2026-1080867.5 High
- apache software foundation arrow c++, pyarrow +1 moreApache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validationCVE-2026-922878.1 High
- apache software foundation airflow amazon providerApache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's accountCVE-2026-864678.8 High
- apache camelApache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code ExecutionCVE-2026-88900Public exploit8.8 High
- apache software foundation camelApache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is PresentCVE-2026-91858Public exploit6.5 Medium
- apache software foundation camelApache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by defaultCVE-2026-88901Public exploit8.2 High
- apache camelApache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token CacheCVE-2026-85317Public exploit4.8 Medium
- apache camelApache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path MatchingCVE-2026-85316Public exploit4.8 Medium
- apache camelApache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-85315Public exploit5.3 Medium
- apache camelApache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)CVE-2026-85314Public exploit6.5 Medium
- apache camelApache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetCVE-2026-85313Public exploit4.3 Medium
- Show moreLoading…