Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache ofbizApache OFBiz: Critical Remote Command Execution via Unrestricted File UploadCVE-2025-591187.3 High
- apache openofficeApache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variablesCVE-2025-644075.3 Medium
- apache openofficeApache OpenOffice: Possible memory corruption during CSV importCVE-2025-644064.3 Medium
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via DDE functionCVE-2025-644057.5 High
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via background and bullet imagesCVE-2025-644047.5 High
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via "external data sources" in CalcCVE-2025-644038.1 High
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via OLE objectsCVE-2025-644026.5 Medium
- apache openofficeApache OpenOffice: Remote documents loaded without prompt via IFrameCVE-2025-644017.5 High
- apache doris mcp server, apache software foundation doris-mcp-server +1 moreApache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP ServerCVE-2025-58337Fix available5.4 Medium
- apache apisixApache APISIX: basic-auth logs plaintext credentials at info levelCVE-2025-62232Fix available7.5 High
- apache airflowApache Airflow: Command injection in "example_dag_decorator"CVE-2025-54941Fix available4.6 Medium
- apache airflowApache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in APICVE-2025-62402Fix available5.4 Medium
- apache airflowApache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)CVE-2025-62503Fix available4.6 Medium
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoSCVE-2025-61795Fix available5.3 Medium
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabledCVE-2025-55752Public exploitFix availableEPSS 64.4%7.5 High
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: console manipulation via escape sequences in log messagesCVE-2025-55754Fix availableEPSS 10.3%9.6 Critical
- apache tika, apache software foundation tika core, tika parsers +1 more +3 moreApache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affectedCVE-2025-66516Public exploitFix availableEPSS 89.0%8.4 High
- apache activemq-artemis, red hat amq broker 7, rhel-9 based middleware containers +2 moreAmq: privilege escalation via excessive /etc/passwd permissionsCVE-2025-587126.4 Medium
- apache syncopeApache Syncope: Remote Code Execution by delegated administratorsCVE-2025-57738Fix availableEPSS 24.2%7.2 High
- apache geodeApache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target systemCVE-2025-47410Fix available8.8 High
- apache traffic controlApache Traffic Control: ReDoS issue in Traffic Router configurationCVE-2025-615817.5 High
- apache activemq nms amqp, apache software foundation activemq nms amqp client +1 moreApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataCVE-2025-54539Fix available9.8 Critical
- apache sparkApache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacksCVE-2025-55039Fix available6.5 Medium
- apache geodeApache Geode: Reflected XSSCVE-2024-44088Fix available6.1 Medium
- apache streamparkApache StreamPark: Authenticated users can trigger remote command executionCVE-2025-300017.3 High
- apache flink cdcApache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiersCVE-2025-62228Fix available5.1 Medium
- apache kylinApache Kylin: Server-Side Request ForgeryCVE-2025-61735Fix available7.3 High
- apache kylinApache Kylin: Authentication bypassCVE-2025-61733Fix available7.5 High
- apache kylinApache Kylin: improper restriction of file readCVE-2025-61734Fix availableEPSS 28.8%7.5 High
- apache foryApache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyforyCVE-2025-61622Fix availableEPSS 49.0%9.8 Critical
- apache airflowApache Airflow: Connection sensitive details exposed to users with READ permissionsCVE-2025-54831Fix available6.5 Medium
- apache zookeeperApache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore CommandsCVE-2025-58457Fix available4.3 Medium
- apache iotdbApache IoTDB: DoS VulnerabilityCVE-2025-48392Fix available7.5 High
- apache iotdbApache IoTDB: Deserialization of untrusted DataCVE-2025-48459Fix available5.3 Medium
- apache foryApache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large DataCVE-2025-59328Fix available6.5 Medium
- apache hertzbeat, apache software foundation hertzbeat (incubating) +1 moreApache HertzBeat (incubating): Jmx JNDI injection vulnerabilityCVE-2025-482088.8 High
- apache hertzbeat, apache software foundation hertzbeat (incubating) +1 moreApache HertzBeat (incubating): RCE by parse http sitemap xml responseCVE-2025-244048.8 High
- apache jackrabbit, apache software foundation jackrabbit core, jackrabbit jcr commons +2 moreApache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactoryCVE-2025-58782Fix available6.5 Medium
- apache dolphinschedulerApache DolphinScheduler Incorrect Default Permissions VulnerabilityCVE-2024-43166Fix available9.8 Critical
- apache dolphinschedulerApache DolphinScheduler: Alert Script AttackCVE-2024-43115Fix available8.8 High
- apache cassandraApache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)CVE-2025-26467Fix available8.8 High
- apache log4cxxApache Log4cxx: Improper HTML escaping in HTMLLayoutCVE-2025-54812Fix available2.1 Low
- apache log4cxxApache Log4cxx: Improper escaping with JSONLayoutCVE-2025-54813Fix available6.3 Medium
- apache streamparkApache StreamPark: SQL injection vulnerabilityCVE-2024-489887.6 High
- apache tika, apache software foundation tika pdf parser module +1 moreApache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFACVE-2025-54988Public exploitFix availableEPSS 36.3%8.4 High
- apache eventmesh, apache software foundation eventmesh runtime +1 moreApache EventMesh Runtime: SSRFCVE-2024-399546.3 Medium
- apache commons ognlApache Commons OGNL: Expression Injection leading to RCECVE-2025-53192Fix available8.8 High
- apache ofbizApache OFBiz: RCE Vulnerability in scrum pluginCVE-2025-54466EPSS 28.8%9.8 Critical
- apache supersetApache Superset: Incorrect datasource authorization on REST APICVE-2025-55675Fix available5.3 Medium
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsCVE-2025-55674Fix available5.3 Medium
- Show moreLoading…