Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache software foundation wicketApache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesCVE-2026-877182.3 Low
- apache software foundation wicketApache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagCVE-2026-842317.4 High
- apache software foundation wicketApache Wicket: A component's markup is served as a package resource when its class name contains an underscoreCVE-2026-841776.3 Medium
- apache software foundation wicketApache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderCVE-2026-841726.3 Medium
- apache software foundation wicketApache Wicket: Configured upload limits are not enforced by the standalone file upload resourceCVE-2026-841708.3 High
- apache software foundation wicketApache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesCVE-2026-835948.3 High
- apache software foundation wicketApache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalCVE-2026-835597.4 High
- apache software foundation wicketApache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataCVE-2026-835397.4 High
- apache software foundation wicketApache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameCVE-2026-829567.6 High
- apache software foundation wicketApache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inCVE-2026-828982.1 Low
- apache software foundation wicketApache Wicket: The session id is renewed only on the first sign in, not on re-authenticationCVE-2026-828407.2 High
- apache software foundation wicketApache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentCVE-2026-827056.3 Medium
- apache software foundation wicketApache Wicket: A listener is invoked on a page instance the request itself created and never configuredCVE-2026-827046.9 Medium
- apache software foundation wicketApache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationCVE-2026-825592.3 Low
- apache software foundation wicketApache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeCVE-2026-825582.3 Low
- apache software foundation wicketApache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionCVE-2026-825576.9 Medium
- apache software foundation wicketApache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceCVE-2026-821156.3 Medium
- apache software foundation thriftApache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by defaultCVE-2026-120135Fix available8.2 High
- apache software foundation minaApache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoderCVE-2026-1186369.8 Critical
- apache software foundation pinotApache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()CVE-2026-733226.5 Medium
- apache fineractApache Fineract: SQL injection vulnerability in Search APICVE-2026-646189.8 Critical
- apache fineractApache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpointsCVE-2026-658748.8 High
- apache software foundation camelApache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host NameCVE-2026-71569Public exploit4.8 Medium
- apache software foundation qpid proton cApache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow readCVE-2026-1159427.5 High
- apache software foundation qpid proton cApache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL framesCVE-2026-1142309.8 Critical
- apache software foundation qpid proton cApache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crashCVE-2026-1050429.8 Critical
- apache software foundation qpid proton cApache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.CVE-2026-1050319.1 Critical
- apache software foundation kafkaApache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesCVE-2026-1143496.5 Medium
- apache software foundation kafkaApache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsCVE-2026-1123756.5 Medium
- apache software foundation kafkaApache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpointCVE-2026-1165938.1 High
- apache software foundation kafkaApache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST ExtensionsCVE-2026-1156448.8 High
- apache software foundation kafkaApache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationCVE-2026-1115517.5 High
- apache software foundation kafkaApache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationCVE-2026-1114969.1 Critical
- apache software foundation kafkaApache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsingCVE-2026-1111159.1 Critical
- apache software foundation kafkaApache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersCVE-2026-1111089.1 Critical
- apache software foundation kafkaApache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of serviceCVE-2026-1110736.5 Medium
- apache software foundation kafkaApache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredCVE-2026-1109859.1 Critical
- apache software foundation kafkaApache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultCVE-2026-1109525.9 Medium
- apache software foundation kafkaApache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.CVE-2026-835256.5 Medium
- apache software foundation airflow ssh providerApache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote hostCVE-2026-1114228.8 High
- apache software foundation vysperApache Vysper: Authorization bypassCVE-2026-1157488.8 High
- apache software foundation vysperApache Vysper: Unbounded allocationCVE-2026-1157217.5 High
- apache software foundation camelApache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity…CVE-2026-90885Public exploit7.5 High
- apache software foundation camelApache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheCVE-2026-94386Public exploit4.8 Medium
- apache software foundation sisApache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 filesCVE-2026-1107485.5 Medium
- apache software foundation sisApache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature storeCVE-2026-1107335.4 Medium
- apache camelApache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)CVE-2026-95628Public exploit5.4 Medium
- apache camelApache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary DirectoryCVE-2026-95629Public exploit5.4 Medium
- apache camelApache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryCVE-2026-95663Public exploit4.8 Medium
- apache camelApache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsCVE-2026-95664Public exploit5.4 Medium
- Show moreLoading…