Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache camelApache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-101259Public exploit5.3 Medium
- apache software foundation abderaApache Abdera: XML external entity expansion in Atom document parsingCVE-2026-1135828.7 High
- apache software foundation datasketchesApache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketchCVE-2026-1036345.3 Medium
- apache software foundation traffic serverApache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked responseCVE-2026-1123818.2 High
- apache software foundation traffic serverApache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeoutCVE-2026-1118176.9 Medium
- apache software foundation traffic serverApache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentialsCVE-2026-1118127.0 High
- apache software foundation traffic serverApache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authenticationCVE-2026-1118119.4 Critical
- apache software foundation traffic serverApache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smugglingCVE-2026-1118096.9 Medium
- apache software foundation traffic serverApache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of serviceCVE-2026-1118108.7 High
- apache software foundation traffic serverApache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcementCVE-2026-1118157.8 High
- apache software foundation traffic serverApache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the originCVE-2026-1118147.8 High
- apache software foundation traffic serverApache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustionCVE-2026-1118087.7 High
- apache software foundation traffic serverApache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustionCVE-2026-1118057.7 High
- apache software foundation traffic serverApache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outCVE-2026-1118169.2 Critical
- apache software foundation traffic serverApache Traffic Server: An unread Expect: 100-continue request body is framed as a new requestCVE-2025-557027.0 High
- apache software foundation traffic serverApache Traffic Server: Origin connection still owed a request body is reused, enabling request smugglingCVE-2025-316999.1 Critical
- apache software foundation traffic serverApache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDsCVE-2026-1118048.8 High
- apache software foundation traffic serverApache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationCVE-2026-11181310.0 Critical
- apache software foundation pulsarApache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package StorageCVE-2026-1059457.7 High
- apache software foundation pulsar managerApache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeCVE-2026-10594410.0 Critical
- apache software foundation pulsarApache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalationCVE-2026-1059427.7 High
- apache software foundation pulsarApache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-allCVE-2026-1059382.3 Low
- apache software foundation pulsarApache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataCVE-2026-1059378.7 High
- apache software foundation pulsarApache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpointCVE-2026-1059365.3 Medium
- apache software foundation pulsarApache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permissionCVE-2026-1059354.9 Medium
- apache software foundation pulsarApache Pulsar: Missing tenant admin authorization check when truncating a partitioned topicCVE-2026-1059347.2 High
- apache software foundation pulsarApache Pulsar: Namespace encryption requirement not enforced after a failure during topic initializationCVE-2026-1059332.3 Low
- apache software foundation pulsarApache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpointsCVE-2026-1059322.3 Low
- apache software foundation pulsarApache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenantsCVE-2026-1059312.3 Low
- apache software foundation pulsarApache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package DownloadCVE-2026-1059306.0 Medium
- apache software foundation pulsarApache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permissionCVE-2026-1059272.3 Low
- apache software foundation pulsarApache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema CommandsCVE-2026-1059265.3 Medium
- apache software foundation pulsarApache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleCVE-2026-1058699.2 Critical
- apache software foundation brpcApache bRPC: Null pointer dereference in MySQL reply parser leading to client crashCVE-2026-904846.5 Medium
- apache software foundation brpcApache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsingCVE-2026-878494.3 Medium
- apache software foundation brpcApache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authCVE-2026-862499.1 Critical
- apache software foundation brpcApache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprofCVE-2026-861477.5 High
- apache software foundation brpcApache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header ParsingCVE-2026-861467.5 High
- apache software foundation brpcApache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configurationCVE-2026-847487.5 High
- apache software foundation brpcApache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path SegmentsCVE-2026-847477.5 High
- apache software foundation brpcApache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort MessageCVE-2026-847275.4 Medium
- apache software foundation brpcApache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of ServiceCVE-2026-829535.3 Medium
- apache software foundation brpcApache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of ServiceCVE-2026-829427.5 High
- apache software foundation brpcApache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of ServiceCVE-2026-824257.5 High
- apache software foundation brpcApache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift clientCVE-2026-822317.5 High
- apache software foundation brpcApache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb ParserCVE-2026-822307.5 High
- apache software foundation brpcApache bRPC: Remote denial of service (crash) via malformed stream feedback framesCVE-2026-822107.5 High
- apache software foundation brpcApache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC RequestCVE-2026-817557.5 High
- apache software foundation brpcApache bRPC: Unbounded Memory Accumulation in Stream Message ReassemblyCVE-2026-804637.5 High
- apache software foundation brpcApache bRPC: Out-of-bounds Read in Multi-stream RPC Response HandlingCVE-2026-797047.5 High
- Show moreLoading…