Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache minaApache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232CVE-2026-47065Fix available9.8 Critical
- apache http server, debian linux, red hat jboss core services for rhel 8 +19 more +21 moreApache HTTP Server: mod_http2 denial of serviceCVE-2026-49975Public exploitFix availableEPSS 33.0%7.5 High
- apache calciteApache Calcite: A user-controled model can load arbitrary classes, leading to code executionCVE-2026-46718Fix available6.5 Medium
- apache kafkaApache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE APICVE-2026-41115Fix available4.3 Medium
- apache fesod, apache software foundation fesod (incubating) +1 moreApache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRFCVE-2026-49328Fix available5.3 Medium
- apache solrApache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usersCVE-2026-44825Public exploitFix available8.1 High
- apache fluss, apache software foundation fluss (incubating) +1 moreApache Fluss Netty Frame Decoder Memory Exhaustion VulnerabilityCVE-2026-49361Fix available7.5 High
- apache airflowApache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandlerCVE-2026-40861Fix available6.5 Medium
- apache airflowApache Airflow: Open Redirect Bypass VulnerabilityCVE-2026-40961Fix available7.2 High
- apache airflowApache Airflow: DAG authorization bypass on /ui/structure/structure_dataCVE-2026-40963Fix available3.1 Low
- apache airflowApache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpointsCVE-2026-41014Fix available4.3 Medium
- apache airflowApache Airflow: No certificate validation on SMTP STARTTLS connectionsCVE-2026-49267Fix available5.9 Medium
- apache airflowApache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxyCVE-2026-41017Fix available5.9 Medium
- apache airflowApache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutationCVE-2026-41084Fix available7.5 High
- apache airflowApache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user patternCVE-2026-42252Fix available9.1 Critical
- apache airflowApache Airflow: Rendered template truncation bypasses nested sensitive-key maskingCVE-2026-42360Fix available6.5 Medium
- apache airflowApache Airflow: Variable masker depth-limit bypass returns cleartext nested secretsCVE-2026-42358Fix available6.5 Medium
- apache airflowApache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validatorCVE-2026-42359Fix available8.8 High
- apache airflowApache Airflow: Arbitrary import in custom deadline-reference deserializationCVE-2026-45360Fix available7.3 High
- apache airflowApache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log accessCVE-2026-45426Fix available3.1 Low
- apache airflowApache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filterCVE-2026-46764Fix available4.3 Medium
- apache airflowApache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout pathCVE-2026-48726Fix available6.5 Medium
- apache airflowApache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsCVE-2026-49298Fix available8.8 High
- apache activemq, activemq web +1 moreApache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message PropertiesCVE-2026-42253Fix available6.1 Medium
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnectorCVE-2026-42588Public exploitFix available8.1 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper BypassCVE-2026-45505Fix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removalCVE-2026-46605Fix available4.3 Medium
- apache activemqApache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by defaultCVE-2026-49157Fix available8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)CVE-2026-49270Fix available5.9 Medium
- apache directory ldap apiApache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostnameCVE-2026-35563Fix available8.8 High
- apache airflowApache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API ResponseCVE-2026-45192Fix available6.5 Medium
- apache mina sshdApache MINA SSHD: Path traversal in org.apache.sshd:sshd-gitCVE-2026-48827Fix available7.1 High
- apache artemis, apache software foundation activemq artemis stomp protocol, artemis stomp protocol +2 moreApache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permissionCVE-2026-40914Fix available4.3 Medium
- apache igniteApache Ignite: REST HTTP arbitrary file read vulnerabilityCVE-2025-48977Fix available8.5 High
- apache flink kubernetes operatorApache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes OperatorCVE-2026-40564Public exploit6.5 Medium
- apache shiroApache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flowCVE-2026-48589Fix available0.0 None
- apache shiro, apache software foundation shiro jakarta ee module +1 moreApache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)CVE-2026-44598Fix available5.1 Medium
- apache shiroApache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by defaultCVE-2026-43828Fix available5.9 Medium
- apache shiroApache Shiro: Session fixation: new session is not created after login by defaultCVE-2026-43827Fix available5.9 Medium
- apache syncopeApache Syncope: JexlContextBuilder Information DisclosureCVE-2026-42797Fix available4.9 Medium
- apache syncopeApache Syncope: Post-auth RCE via Groovy staticCVE-2026-42782Fix available7.2 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/tokenCVE-2026-46745Fix available5.3 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)CVE-2026-45361Fix available8.1 High
- apache echartsApache ECharts: XSS in Lines series tooltip renderingCVE-2026-45249Fix available6.1 Medium
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +4 more +6 moreApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)CVE-2026-44417Fix available7.5 High
- apache cxfApache CXF: XXE vulnerability in WS-Transfer functionalityCVE-2026-44618Fix available5.3 Medium
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +1 more +3 moreApache CXF: LDAP Injection vulnerability in XKMS LDAP RepositoryCVE-2026-44930Fix available9.8 Critical
- apache foryApache Fory: PyFory ReduceSerializer Incomplete Policy EnforcementCVE-2026-48207Fix available9.8 Critical
- apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +1 moreApache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsCVE-2026-27173Fix available8.7 High
- apache apache-airflow-providers-amazon, apache software foundation airflow amazon provider +1 moreApache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backendsCVE-2026-42526Fix available5.3 Medium
- Show moreLoading…