Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache nifiApache NiFi: Potential Insertion of MongoDB Password in Provenance RecordCVE-2025-27017Fix available6.9 Medium
- apache felix http webconsole pluginApache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole PluginCVE-2025-27867Fix available5.6 Medium
- apache camelApache Camel: Camel Message Header Injection through request parametersCVE-2025-29891Fix availableEPSS 76.1%4.8 Medium
- apache tomcat, debian linux, netapp bootstrap os +2 moreApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTCVE-2025-24813In KEVPublic exploitFix availableEPSS 99.9%9.8 Critical
- apache ofbizApache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCECVE-2025-26865Public exploit3.5 Low
- apache camelApache Camel: Camel Message Header Injection via Improper FilteringCVE-2025-27636Public exploitFix availableEPSS 97.1%5.6 Medium
- apache traffic serverApache Traffic Server: Request smuggling via pipelining after a chunked message bodyCVE-2024-38311Fix available6.3 Medium
- apache traffic serverApache Traffic Server: Intercept plugins are not access controlledCVE-2024-56195Fix available6.3 Medium
- apache traffic serverApache Traffic Server: ACL is not fully compatible with older versionsCVE-2024-561966.3 Medium
- apache traffic serverApache Traffic Server: Expect header field can unreasonably retain resourceCVE-2024-56202Fix available4.3 Medium
- apache rangerApache Ranger: Improper Neutralization of Formula Elements in a CSV FileCVE-2024-55532Fix available9.8 Critical
- apache streampipesApache StreamPipes: Resources Permission EscalationCVE-2024-24778Fix available6.5 Medium
- apache eventmeshApache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code executionCVE-2024-56180Fix available9.8 Critical
- apache igniteApache Ignite: Possible RCE when deserializing incoming messages by the server nodeCVE-2024-52577Fix available9.5 Critical
- apache atlasApache Atlas: An authenticated user can perform XSS and potentially impersonate another userCVE-2024-46910Fix available7.1 High
- apache fineractApache Fineract: SQL injection vulnerabilities in offices API endpointCVE-2024-328389.4 Critical
- apache felix webconsoleApache Felix Webconsole: XSS in services consoleCVE-2025-25247Fix available6.1 Medium
- apache kvrocksApache Kvrocks: Cross-Protocol Scripting VulnerabilityCVE-2025-250696.5 Medium
- apache shardingsphere elasticjob-uiApache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCCVE-2022-317648.5 High
- apache james serverApache James: denial of service through the use of IMAP literalsCVE-2024-37358Fix available8.6 High
- apache james serverApache James: denial of service through JMAP HTML to text conversionCVE-2024-45626Fix available6.5 Medium
- apache dorisApache Doris: allows admin users to read arbitrary files through the REST APICVE-2024-480195.4 Medium
- apache cassandraApache Cassandra: unrestricted deserialization of JMX authentication credentialsCVE-2024-27137Fix available5.3 Medium
- apache cassandraApache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regionsCVE-2025-24860Fix available5.4 Medium
- apache cassandraApache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actionsCVE-2025-23015Fix available8.8 High
- apache hiveApache Hive: Credentials file created with non restrictive permissionsCVE-2024-29869Fix available5.5 Medium
- apache hiveApache Hive: Timing Attack Against Signature in LLAP utilCVE-2024-23953Fix available6.5 Medium
- apache cocoonApache Cocoon: continuations may not be privateCVE-2025-247837.5 High
- apache solrApache Solr: Core-creation with "trusted" configset can use arbitrary untrusted filesCVE-2025-24814Fix available5.5 Medium
- apache solrApache Solr: Configset upload on Windows allows arbitrary path write-accessCVE-2024-52012Fix availableEPSS 47.1%5.4 Medium
- apache wicketApache Wicket: An attacker can intentionally trigger a memory leakCVE-2024-53299Fix available6.5 Medium
- apache rangerApache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhostCVE-2024-45479Fix available9.1 Critical
- apache rangerApache Ranger: Stored XSS in Edit Service page - Add logic to validate user inputCVE-2024-45478Fix available4.8 Medium
- apache ambariApache Ambari: Remote Code Injection in Ambari Metrics and AMS AlertsCVE-2024-519418.8 High
- apache ambariApache Ambari: Code Injection Vulnerability in Ambari Alert DefinitionCVE-2025-231968.8 High
- apache ambariApache Ambari: XML External Entity (XXE) Vulnerability in Ambari/OozieCVE-2025-231957.5 High
- apache cxfApache CXF: Denial of Service vulnerability with temporary filesCVE-2025-23184Fix available5.9 Medium
- apache linkis, apache software foundation linkis metadata query service jdbc +1 moreApache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerabilityCVE-2024-45627Fix available5.9 Medium
- apache cloudstackApache CloudStack: Unauthorised access to annotationsCVE-2025-22828Public exploit4.3 Medium
- apache software foundation airflow fab provider, apache apache-airflow-providers-fab +1 moreApache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliCVE-2024-45033Fix available8.1 High
- apache openmeetingsApache OpenMeetings: Deserialisation of untrusted data in cluster modeCVE-2024-54676Fix availableEPSS 68.8%9.8 Critical
- apache nifiApache NiFi: Missing Complete Authorization for Parameter and Service ReferencesCVE-2024-56512Public exploitFix available2.1 Low
- apache minaApache MINA: MINA applications using unbounded deserialization may allow RCECVE-2024-52046Fix availableEPSS 24.6%10.0 Critical
- apache hugegraph, apache software foundation hugegraph-server +1 moreApache HugeGraph-Server: Fixed JWT Token(Secret)CVE-2024-43441Fix availableEPSS 73.1%9.8 Critical
- apache traffic controlApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsCVE-2024-45387Fix availableEPSS 66.1%9.9 Critical
- apache hive, spark +1 moreApache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification failsCVE-2024-23945Fix available5.9 Medium
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteCVE-2024-56337Fix available9.8 Critical
- apache kafkaApache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryptionCVE-2024-56128Fix available5.3 Medium
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: DoS in examples web applicationCVE-2024-54677Fix available5.3 Medium
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilationCVE-2024-50379Public exploitFix availableEPSS 31.8%9.8 Critical
- Show moreLoading…