Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache ofbizApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number ModificationCVE-2026-1142356.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List ModificationCVE-2026-1142716.5 Medium
- apache ofbizApache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content DisclosureCVE-2026-1142726.5 Medium
- apache ofbizApache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local AccountsCVE-2026-1142776.5 Medium
- apache software foundation sling engineApache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglingCVE-2026-1038667.5 High
- apache software foundation sling engineApache Sling Engine: Request-derived values reach log sinks without CR/LF neutralizationCVE-2026-1038647.5 High
- apache software foundation sling engineApache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper pathsCVE-2026-1038635.4 Medium
- apache software foundation juneauApache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryCVE-2026-12148910.0 Critical
- apache software foundation juneauApache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeCVE-2026-9667710.0 Critical
- apache software foundation juneauApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataCVE-2026-7311710.0 Critical
- apache software foundation juneauApache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsCVE-2026-7311610.0 Critical
- apache software foundation juneauApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsCVE-2026-7310110.0 Critical
- apache software foundation juneauApache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsCVE-2026-7310010.0 Critical
- apache software foundation juneauApache Juneau: Cross-site request forgery via default-enabled content query-parameter body overrideCVE-2026-7309910.0 Critical
- apache software foundation juneauApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingCVE-2026-7309810.0 Critical
- apache software foundation juneauApache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingCVE-2026-730958.7 High
- apache openofficeApache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruptionCVE-2026-592675.8 Medium
- apache openofficeApache OpenOffice: Local file inclusion via GStreamer pluginCVE-2026-906325.5 Medium
- apache openofficeApache OpenOffice: Out-of-bounds write when importing encrypted PDF filesCVE-2026-906347.3 High
- apache openofficeApache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variablesCVE-2026-906313.3 Low
- apache openofficeApache OpenOffice: Out of bounds memory access during WMF importCVE-2026-906297.3 High
- apache openofficeApache OpenOffice: Stack overflow in CFF hint handlingCVE-2026-906287.3 High
- apache openofficeApache OpenOffice: Local file inclusion via SQL provider and flat file database referencesCVE-2026-906275.5 Medium
- apache openofficeApache OpenOffice: Out-of-bounds write when importing encrypted PDF filesCVE-2026-906267.3 High
- apache openofficeApache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution VulnerabilityCVE-2026-906247.3 High
- apache openofficeApache OpenOffice: Heap out-of-bounds write in WW8 PLCF readerCVE-2026-592687.3 High
- apache openofficeApache OpenOffice: Uncontrolled search path element vulnerability in Windows installerCVE-2026-592647.8 High
- apache openofficeApache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.CVE-2026-592631.9 Low
- apache software foundation zookeeperApache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handlingCVE-2026-100302Fix available7.1 High
- apache software foundation zookeeperApache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverableCVE-2026-115448Fix available8.7 High
- apache software foundation zookeeperApache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply threadCVE-2026-100300Fix available8.7 High
- apache software foundation zookeeperApache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization IDCVE-2026-100252Fix available8.6 High
- apache software foundation zookeeperApache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocationCVE-2026-100235Fix available6.0 Medium
- apache software foundation activemqApache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injectionCVE-2026-1085006.5 Medium
- apache software foundation activemq nms openwire client libraryApache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)CVE-2026-1035827.5 High
- apache software foundation activemq broker, activemq +1 moreApache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connectionCVE-2026-1089466.5 Medium
- apache software foundation activemq, activemq runtime config +1 moreApache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocationCVE-2026-1118228.1 High
- apache software foundation activemq, activemq kahadb +1 moreApache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journalCVE-2026-1118217.5 High
- apache software foundation activemq broker, activemq +1 moreApache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOMCVE-2026-1089496.5 Medium
- apache software foundation hertzbeatApache HertzBeat: incomplete XPath expression validation in aliasFieldsCVE-2026-1144426.5 Medium
- apache software foundation oozieApache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownershipCVE-2026-1196416.5 Medium
- apache jcloudsApache JClouds: XML External Entity (XXE) in provider-response parsingCVE-2026-1197247.5 High
- apache software foundation syncopeApache Syncope: SQL injection via unsanitized opEvent in Audit Events searchCVE-2026-1143649.8 Critical
- apache software foundation syncopeApache Syncope: RCE via ProcessGroovyMethodsSandbox bypassCVE-2026-1136879.8 Critical
- apache software foundation syncopeApache Syncope: Delegated administration boundaries can be bypassed for Realm updateCVE-2026-1135119.1 Critical
- apache software foundation syncopeApache Syncope: AuthProfile value escalation via self-service updateCVE-2026-1105358.8 High
- apache software foundation syncopeApache Syncope: Remote Code Execution via Flowable JUEL expressionCVE-2026-1090839.8 Critical
- apache software foundation arrow rustApache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds readsCVE-2026-111959Fix available9.1 Critical
- apache software foundation wicketApache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupCVE-2026-1110897.6 High
- apache software foundation wicketApache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupCVE-2026-958637.6 High
- Show moreLoading…