Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: Stored XSS on charts metadataCVE-2025-55672Fix available5.3 Medium
- apache supersetApache Superset: Metadata exposure in embedded chartsCVE-2025-55673Fix available5.3 Medium
- apache brpcApache bRPC: Redis Parser Remote Denial of ServiceCVE-2025-544727.5 High
- apache tomcatApache Tomcat: session fixation via rewrite valveCVE-2025-55668Public exploitFix available6.5 Medium
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: h2 DoS - Made You ResetCVE-2025-48989Fix available7.5 High
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerCVE-2025-53606Fix available9.8 Critical
- apache cxfApache CXF: Untrusted JMS configuration can lead to RCECVE-2025-48913Fix available9.8 Critical
- apache zeppelinApache Zeppelin: Command Injection via CSWSHCVE-2024-51775Fix available5.3 Medium
- apache zeppelinApache Zeppelin: XSS in the Helium moduleCVE-2024-41177Fix available6.1 Medium
- apache zeppelinApache Zeppelin: Arbitrary file read by adding malicious JDBC connection stringCVE-2024-52279Fix available5.3 Medium
- apache jspwikiApache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image pluginCVE-2025-24854Fix available6.1 Medium
- apache jspwikiApache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processingCVE-2025-24853Fix available7.5 High
- apache struts extrasApache Struts Extras: Improper Output Neutralization for LogsCVE-2025-546566.5 Medium
- apache http serverApache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64CVE-2025-54090Fix available6.3 Medium
- apache jenaApache Jena: Configuration files uploaded by administrative users are not check properlyCVE-2025-50151Fix available8.8 High
- apache jenaApache Jena: Administrative users can create files outside the server directory space via the admin UICVE-2025-49656Fix available7.5 High
- apache cxfApache CXF: Denial of Service and sensitive data exposure in logsCVE-2025-48795Fix available5.6 Medium
- apache jackrabbitApache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsCVE-2025-53689Fix available8.8 High
- apache zeppelinApache Zeppelin: raft directory listing and file readCVE-2024-41169Fix available7.5 High
- apache commons langApache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputsCVE-2025-48924Public exploitFix available5.3 Medium
- apache tomcatApache Tomcat: DoS via excessive h2 streams at connection startCVE-2025-53506Fix available7.5 High
- apache tomcatApache Tomcat: DoS via integer overflow in multipart file uploadCVE-2025-52520Fix available7.5 High
- apache tomcatApache Tomcat: APR/Native Connector crash leading to DoSCVE-2025-52434Fix available7.5 High
- apache http serverApache HTTP Server: HTTP/2 DoS by Memory IncreaseCVE-2025-53020Public exploitFix available7.5 High
- apache http serverApache HTTP Server: mod_ssl TLS upgrade attackCVE-2025-49812Public exploitFix available7.4 High
- apache http serverApache HTTP Server: mod_proxy_http2 denial of serviceCVE-2025-49630Fix available7.5 High
- apache http serverApache HTTP Server: mod_ssl access control bypass with session resumptionCVE-2025-23048Public exploitFix available9.1 Critical
- apache http serverApache HTTP Server: SSRF on Windows due to UNC pathsCVE-2024-43394Fix available7.5 High
- apache http serverApache HTTP Server: mod_ssl error log variable escapingCVE-2024-47252Fix available7.5 High
- apache http serverApache HTTP Server: SSRF with mod_headers setting Content-Type headerCVE-2024-43204Fix available7.5 High
- apache http serverApache HTTP Server: HTTP response splittingCVE-2024-42516Fix available7.5 High
- apache apisix, apache software foundation apisix java plugin runner +1 moreApache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privilegesCVE-2025-27446Fix available7.8 High
- apache guacamoleApache Guacamole: Improper input validation of console codesCVE-2024-35164Fix available6.8 Medium
- apache apisixApache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connectCVE-2025-46647Fix available5.3 Medium
- apache seata, apache software foundation seata (incubating) +1 moreApache Seata (incubating): Deserialization of untrusted Data in Apache Seata ServerCVE-2025-32897Fix available9.8 Critical
- apache software foundation airflow providers snowflake, apache apache-airflow-providers-snowflake +1 moreApache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorCVE-2025-50213Fix available9.8 Critical
- apache seatunnelApache SeaTunnel: Unauthenticated insecure accessCVE-2025-32896Fix available6.5 Medium
- apache traffic serverApache Traffic Server: Client IP address from PROXY protocol is not used for ACLCVE-2025-31698Fix available7.5 High
- apache traffic serverApache Traffic Server: Remote DoS via memory exhaustion in ESI PluginCVE-2025-49763Fix available7.5 High
- apache commons fileuploadApache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersCVE-2025-48976Public exploitFix availableEPSS 34.0%7.5 High
- apache tomcatApache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for WindowsCVE-2025-49124Fix available8.4 High
- apache tomcatApache Tomcat: Security constraint bypass for pre/post-resourcesCVE-2025-49125Public exploitFix available7.5 High
- apache tomcatApache Tomcat: FileUpload large number of parts with headers DoSCVE-2025-48988Public exploitFix availableEPSS 31.5%7.5 High
- apache nuttx, apache software foundation nuttx rtos +1 moreApache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.CVE-2025-478699.8 Critical
- apache nuttx, apache software foundation nuttx rtos: tools/bdf-converter. +1 moreApache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.CVE-2025-478689.8 Critical
- apache cloudstackApache CloudStack: Unauthorised template/ISO list access to the domain/resource adminsCVE-2025-306754.7 Medium
- apache cloudstackApache CloudStack: Unauthorised access to dedicated resources in Quota pluginCVE-2025-228292.3 Low
- apache cloudstackApache CloudStack: CKS cluster in project exposes user API keysCVE-2025-265218.1 High
- apache cloudstackApache CloudStack: Insecure access of user's API/Secret Keys in the same domainCVE-2025-478498.8 High
- apache cloudstackApache CloudStack: Domain Admin can reset Admin password in Root DomainCVE-2025-477138.8 High
- Show moreLoading…