Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache dolphinschedulerApache dolphinscheduler sensitive information disclosureCVE-2023-48796Fix available7.5 High
- apache stormApache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary filesCVE-2023-43123Fix available5.5 Medium
- apache submarineApache Submarine: SQL injection from unauthorized loginCVE-2023-37924Fix available9.8 Critical
- apache derbyApache Derby: LDAP injection vulnerability in authenticatorCVE-2022-46337Fix available9.8 Critical
- apache submarineApache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserializationCVE-2023-46302Fix available9.8 Critical
- apache hadoopPrivilege escalation in Apache Hadoop Yarn container-executor binary on Linux systemsCVE-2023-26031Fix available7.5 High
- apache airflowApache Airflow: Permission verification bypass allows viewing dagruns of other dagsCVE-2023-42781Fix available6.5 Medium
- apache airflowApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)CVE-2023-47037Fix available4.3 Medium
- apache pyarrowPyArrow, PyArrow: Arbitrary code execution when loading a malicious data fileCVE-2023-47248Public exploitFix availableEPSS 13.2%9.8 Critical
- apache software foundation uima java sdk core, uima java sdk cpe, uima java sdk tools +2 more +4 moreApache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formatsCVE-2023-39913Fix available8.8 High
- apache ofbizApache OFBiz: Execution of Solr plugin queries without authenticationCVE-2023-468195.3 Medium
- apache alluraApache Allura: sensitive information exposure via importCVE-2023-468514.9 Medium
- apache airflow, airflow celery provider +1 moreApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendCVE-2023-46215Fix available7.5 High
- apache activemq, activemq legacy openwire module, debian linux +3 more +5 moreApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackCVE-2023-46604In KEVPublic exploitFix availableEPSS 100.0%10.0 Critical
- apache airflowApache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setCVE-2023-46288Fix available4.3 Medium
- apache http serverApache HTTP Server: DoS in HTTP/2 with initial windows size 0CVE-2023-43622Public exploitFix availableEPSS 68.8%7.5 High
- apache http server, debian linux, fedoraproject fedora +2 moreApache HTTP Server: mod_macro buffer over-readCVE-2023-31122Fix available7.5 High
- apache software foundation santuario, apache santuario xml security for java +1 moreApache Santuario: Private Key disclosure in debug-log outputCVE-2023-44483Fix available6.5 Medium
- apache http server, debian linux, fedoraproject fedora +2 moreApache HTTP Server: HTTP/2 stream memory not reclaimed right away on RSTCVE-2023-45802Public exploitFix available5.9 Medium
- apache inlongApache inlong has an Arbitrary File Read VulnerabilityCVE-2023-46227Fix available7.5 High
- apache shenyuServer-Side Request Forgery in Apache ShenYuCVE-2023-25753Fix available6.5 Medium
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: Malformed http/2 frames can cause an abortCVE-2023-39456Fix availableEPSS 58.3%7.5 High
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-41752Fix available7.5 High
- apache inlongApache InLong: General user Unauthorized access User ManagementCVE-2023-43666Fix available6.5 Medium
- apache inlongApache InLong: Log Injection in Global functionsCVE-2023-43667Fix available7.5 High
- apache inlongApache InLong: Jdbc Connection Security Bypass in InLongCVE-2023-43668Fix available9.8 Critical
- apache brpcApache bRPC: The builtin service rpcz page has an XSS attack vulnerabilityCVE-2023-457576.1 Medium
- apache airflowApache Airflow: Bypass permission verification to view task instances of other dagsCVE-2023-42663Fix available6.5 Medium
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-42792Fix available6.5 Medium
- apache airflowApache Airflow: Configuration information leakage vulnerabilityCVE-2023-45348Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability in the "List dag warnings" featureCVE-2023-42780Fix available6.5 Medium
- apache zookeeper, debian linux +1 moreApache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationCVE-2023-44981Fix available9.1 Critical
- hcl software bigfix platform, apache xerces-c\+\+, fedoraproject fedora +2 moreHCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3CVE-2023-37536Fix available8.2 High
- apache tomcatApache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsCVE-2023-42794Fix available5.9 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Trailer header parsing too lenientCVE-2023-45648Fix available5.3 Medium
- apache tomcat, accumulo, debian linux +2 moreApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsCVE-2023-42795Fix available5.3 Medium
- apache avro, apache software foundation avro java sdk +1 moreApache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKCVE-2023-39410Fix available7.5 High
- apache flink stateful functionsApache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF SequencesCVE-2023-418346.1 Medium
- apache airflow hdfs providerApache HDFS Provider error message suggested installation of incorrect pip packageCVE-2023-41267Fix available7.8 High
- apache commons compressApache Commons Compress: Denial of service via CPU consumption for malformed TAR fileCVE-2023-42503Fix available5.5 Medium
- apache tomcat connectorsApache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped requestCVE-2023-41081Fix available7.5 High
- apache airflowApache Airflow: Secrets can be unmasked in the "Rendered Template"CVE-2023-40712Fix available6.5 Medium
- apache airflowApache Airflow Dag Runs Broken Access Control VulnerabilityCVE-2023-40611Fix available4.3 Medium
- apache supersetApache Superset: SQL parser edge case bypasses data access authorizationCVE-2023-32672Fix available4.3 Medium
- apache supersetApache Superset: Metadata db write access can lead to remote code executionCVE-2023-37941Public exploitFix availableEPSS 35.5%6.6 Medium
- apache supersetApache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsCVE-2023-39265Public exploitFix availableEPSS 86.0%3.8 Low
- apache supersetApache Superset: Stack traces enabled by defaultCVE-2023-39264Fix available4.3 Medium
- apache supersetApache Superset: Improper data permission validation on Jinja templated queriesCVE-2023-27523Fix available5.0 Medium
- apache supersetApache Superset: Improper API permission for low privilege users allows for SSRFCVE-2023-36388Fix available4.3 Medium
- apache supersetApache Superset: Improper Authorization check on import chartsCVE-2023-27526Fix available4.3 Medium
- Show moreLoading…