Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache kafka, apache software foundation kafka client +1 moreApache Kafka Client: Arbitrary file read and SSRF vulnerabilityCVE-2025-27817Public exploitFix availableEPSS 69.8%7.5 High
- apache kafkaApache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configurationCVE-2025-27819Fix available7.5 High
- apache kafkaApache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configurationCVE-2025-27818Fix available8.8 High
- apache inlongApache InLong: An arbitrary file read vulnerability for JDBCCVE-2025-27531Fix available9.8 Critical
- akka management, apache pekko management, lightbend akka management +2 moreApache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effectiveCVE-2025-46548Fix available6.5 Medium
- apache supersetApache Superset: Improper authorization bypass on row level security via SQL InjectionCVE-2025-48912Fix available7.1 High
- apache tomcatApache Tomcat: Security constraint bypass for CGI scriptsCVE-2025-46701Public exploitFix available7.3 High
- apache commons beanutils, apache software foundation commons beanutils 1.x, commons beanutils 2.x +2 moreApache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by defaultCVE-2025-48734Public exploitFix available8.8 High
- apache inlongApache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File ReadCVE-2025-27528Fix available9.1 Critical
- apache inlongApache InLong: JDBC Vulnerability For URLEncode and backspace bypassCVE-2025-27526Fix available6.5 Medium
- apache inlongApache InLong: JDBC Vulnerability during verification processingCVE-2025-27522Fix available6.5 Medium
- apache nuttx, apache software foundation nuttx rtos +1 moreApache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.CVE-2025-350039.8 Critical
- apache orcApache ORC: Potential Heap Buffer Overflow during C++ LZO DecompressionCVE-2025-474366.0 Medium
- apache iotdbApache IoTDB: Exposure of Sensitive Information in IoTDB OpenID AuthenticationCVE-2025-26864Fix available7.5 High
- apache iotdb, apache software foundation iotdb jdbc driver +1 moreApache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driverCVE-2025-26795Fix available7.5 High
- apache iotdbApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionCVE-2024-24780Fix available9.8 Critical
- apache supersetApache Superset: Incorrect authorization leading to resource ownership takeoverCVE-2025-27696Fix available5.3 Medium
- apache commons configurationApache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.xCVE-2025-46392Fix available6.5 Medium
- apache activemqApache ActiveMQ: Unchecked buffer length can cause excessive memory allocationCVE-2025-27533Public exploitFix available6.9 Medium
- apache parquet, apache software foundation parquet java +1 moreApache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadataCVE-2025-46762Fix available7.1 High
- apache http server, debian linux, red hat enterprise linux 10 +14 more +16 moreMod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabledCVE-2025-3891Fix available7.5 High
- apache tomcatApache Tomcat: Bypass of rules in Rewrite ValveCVE-2025-31651Public exploitFix available9.8 Critical
- apache httpclient, apache software foundation httpcomponents, netapp ontap tools +2 moreApache HttpComponents: PSL (Public Suffix List) validation bypassCVE-2025-27820Fix available7.5 High
- apache kvrocksApache Kvrocks: The server was crashed by the negative offsetCVE-2025-264137.5 High
- apache activemq nms openwire, apache software foundation activemq nms openwire client +1 moreApache ActiveMQ NMS OpenWire Client: deserialization allowlist bypassCVE-2025-29953Fix available9.8 Critical
- apache hertzbeatApache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config OssCVE-2024-567366.5 Medium
- apache rollerApache Roller: Insufficient Session Expiration on Password ChangeCVE-2025-248592.1 Low
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logCVE-2025-27391Fix available6.8 Medium
- apache poi, netapp active iq unified manager +1 moreApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesCVE-2025-31672Fix available5.3 Medium
- apache pulsar, apache software foundation pulsar io kafka connect adaptor, pulsar io kafka connector +2 moreApache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka ConnectorsCVE-2025-30677Fix available6.3 Medium
- apache tomcatApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameCVE-2025-31650Public exploitFix availableEPSS 61.3%7.5 High
- apache airflow common sql providerApache Airflow Common SQL Provider: Remote Code Execution via Sql InjectionCVE-2025-30473Fix available8.8 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smugglingCVE-2024-53868Fix available7.5 High
- apache ofbizApache OFBiz: Stored XSS VulnerabilityCVE-2025-30676EPSS 67.6%6.1 Medium
- apache camelApache Camel: Camel-Undertow Message Header Injection via Improper FilteringCVE-2025-30177Fix available6.5 Medium
- apache pinotApache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredCVE-2024-56325Fix availableEPSS 80.2%9.8 Critical
- apache answerApache Answer: Using externally referenced images can leak user privacy.CVE-2025-29868Fix available6.5 Medium
- apache parquet javaApache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadataCVE-2025-30065Public exploitFix availableEPSS 43.6%10.0 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permissionCVE-2025-27427Fix available2.3 Low
- apache kylinApache Kylin: The remote code execution via jdbc urlCVE-2025-30067Fix available7.2 High
- apache kylinApache Kylin: SSRF vulnerability in the diagnosis apiCVE-2024-48944Fix available6.5 Medium
- apache vclApache VCL: XSS vulnerability in User Lookup impacting user privilegesCVE-2024-536798.4 High
- apache vclApache VCL: SQL injection vulnerability in New Block Allocation formCVE-2024-536785.1 Medium
- apache commons vfsApache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENTCVE-2025-27553Fix available7.5 High
- apache commons vfsApache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error messageCVE-2025-30474Fix available5.0 Medium
- apache oozieApache Oozie: XSS in Oozie Web ConsoleCVE-2025-267965.4 Medium
- apache druidApache Druid: Server-Side Request Forgery and Cross-Site ScriptingCVE-2025-27888Fix available5.8 Medium
- apache seata, apache software foundation seata (incubating) +1 morecompression bomb attack in Apache Seata ServerCVE-2024-54016Fix available4.3 Medium
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata ServerCVE-2024-47552Fix available9.8 Critical
- apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +1 moreApache Airflow MySQL Provider: SQL injection in MySQL provider core functionCVE-2025-27018Fix available6.3 Medium
- Show moreLoading…