Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 moreApache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringCVE-2026-47323Public exploitFix availableEPSS 19.6%9.8 Critical
- apache tomcatApache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bindCVE-2026-55957Public exploitFix available7.3 High
- apache ofbizApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code ExecutionCVE-2026-465868.8 High
- apache ofbizApache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCECVE-2026-45434EPSS 21.3%9.8 Critical
- apache ofbizApache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System JobsCVE-2026-451876.5 Medium
- apache ofbizApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN ConstructionCVE-2026-419199.1 Critical
- apache ofbizApache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email servicesCVE-2026-350866.5 Medium
- apache ofbizApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template InjectionCVE-2026-319869.1 Critical
- apache ofbizApache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File AccessCVE-2026-319107.5 High
- apache ofbizApache OFBiz: Unauthenticated Shipment Label Image DisclosureCVE-2026-319097.5 High
- apache ofbizApache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog ParametersCVE-2026-319066.1 Medium
- apache ofbizApache OFBiz: Cross-Tenant Data Exposure via Program Export FeatureCVE-2026-313885.3 Medium
- apache ofbizApache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account ImpersonationCVE-2026-313875.3 Medium
- apache ofbizApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization BypassCVE-2026-313806.5 Medium
- apache ofbizApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog ManagerCVE-2026-313796.1 Medium
- apache ofbizApache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code ExecutionCVE-2026-313786.5 Medium
- apache ofbizApache OFBiz: Low-Privilege SSRF in Content ComponentCVE-2026-292267.3 High
- apache ofbizApache OFBiz: Low-Privilege SSTI Leading to RCE in the Content ComponentCVE-2026-292076.5 Medium
- apache ofbizApache OFBiz: Low-Privilege LFI in Content ComponentCVE-2026-292206.5 Medium
- apache flinkApache Flink: Remote code execution via SQL injection in code generationCVE-2026-35194Public exploitFix available8.1 High
- apache commons configurationApache Commons Configuration: StackOverflowError for YAML input with cyclesCVE-2026-45205Fix available5.3 Medium
- apache tomcatApache Tomcat: Security constraints not correctly appliedCVE-2026-43515Public exploitFix available9.1 Critical
- apache tomcatApache Tomcat: AJP secret compared in non-constant timeCVE-2026-43514Fix available3.7 Low
- apache tomcatApache Tomcat: LockOutRealm treats user names as case-sensitiveCVE-2026-43513Fix available7.5 High
- apache tomcatApache Tomcat: Digest authenticator will authenticate any unknown userCVE-2026-43512Public exploitFix available9.8 Critical
- apache tomcatApache Tomcat: HTTP/2 request headers not validatedCVE-2026-41293Public exploitFix available9.8 Critical
- apache tomcatApache Tomcat: WebSocket authentication header exposureCVE-2026-42498Fix available7.3 High
- apache tomcatApache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingCVE-2026-41284Fix available7.5 High
- apache apache-airflow-providers-elasticsearch, apache software foundation airflow providers elasticsearch +1 moreApache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URLCVE-2026-41018Fix available6.5 Medium
- apache apache-airflow-providers-opensearch, apache software foundation airflow providers opensearch +1 moreApache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URLCVE-2026-43826Fix available6.5 Medium
- apache nifiApache NiFi: Missing Execute Code Required Permission on TinkerpopClientServiceCVE-2026-39816Public exploitFix available7.5 High
- apache cloudstackApache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance AccessCVE-2026-251999.1 Critical
- apache cloudstackApache CloudStack: Unauthenticated Command Injection in Direct Download TemplatesCVE-2026-250778.8 High
- apache cloudstackApache CloudStack: Domain/account resources limits not honoredCVE-2025-692336.5 Medium
- apache cloudstackApache CloudStack: MinIO policy remains intact on bucket deletionCVE-2025-664678.0 High
- apache cloudstackApache CloudStack: Any user can attach a volume in their VMs from backups they should not have access toCVE-2025-661728.1 High
- apache cloudstackApache CloudStack: Any user can create a new VM from backups they should not have access toCVE-2025-661716.5 Medium
- apache cloudstackApache CloudStack: Any user can list backups that they should not have access toCVE-2025-661706.5 Medium
- apache wicketApache Wicket: possible session fixation using AuthenticatedWebSessionCVE-2026-40010Fix available9.1 Critical
- apache wicketApache Wicket: crafted strings can break out of the JavaScript sequenceCVE-2026-42509Fix available6.1 Medium
- apache wicketApache Wicket: crafted URLs can bypass PackageResourceGuardCVE-2026-43646Fix available7.5 High
- apache wicketApache Wicket: Possible malicious path traversal in FolderUploadsFileManagerCVE-2026-43975Fix available6.5 Medium
- apache thrift, red hat ai inference server, build of apache camel 3.33 for quarkus 3.33.2.sp1 +7 more +9 moreApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternCVE-2026-43868Fix available5.3 Medium
- apache thriftApache Thrift: Node.js web_server.js multi-vulnerabilityCVE-2026-43870Fix available7.3 High
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 moreApache Thrift: TSSLTransportFactory.java hostname verificationCVE-2026-43869Fix available7.3 High
- apache http serverApache HTTP Server: mod_md unrestricted OCSP responseCVE-2026-29168Fix available7.3 High
- apache http server, red hat jboss core services for rhel 8, jboss core services on rhel 7 +15 more +17 moreApache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()CVE-2026-28780Fix available9.8 Critical
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +4 more +6 moreApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorCVE-2026-40682Fix available9.1 Critical
- apache polarisApache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table namesCVE-2026-42810Fix available9.4 Critical
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +5 more +7 moreApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderCVE-2026-42027Fix available9.8 Critical
- Show moreLoading…