Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache traffic serverApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the serverCVE-2026-581518.7 High
- apache traffic serverApache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smugglingCVE-2026-581507.8 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smugglingCVE-2026-578347.0 High
- apache traffic serverApache Traffic Server: Buffer overflow via Host field that has a long string valueCVE-2026-339308.2 High
- apache traffic serverApache Traffic Server: Request smuggling via chunked extension quoted-string parsingCVE-2026-240336.9 Medium
- apache traffic serverApache Traffic Server: Untrusted @ headers can spoof ATS internal metadataCVE-2026-33267Public exploit7.7 High
- apache traffic serverApache Traffic Server: Regex mappings match with malicious domain namesCVE-2026-220686.9 Medium
- apache traffic serverApache Traffic Server: SNI to Host header matching policy is not properly enforcedCVE-2026-419207.0 High
- apache tomcatApache Tomcat: DoS via WebSocket chat exampleCVE-2026-66299Fix available5.3 Medium
- apache software foundation axis2/java, apache axis2\/java +1 moreApache Axis2/Java: deserialization of untrusted DataCVE-2026-667139.8 Critical
- apache activemq, activemq all, activemq amqp +2 moreApache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoSCVE-2026-59878Fix available7.5 High
- apache activemq, activemq all, activemq broker +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinationsCVE-2026-61487Fix available6.5 Medium
- apache wicketApache Wicket: leaked and missing CSP headersCVE-2026-663916.5 Medium
- apache wicketApache Wicket: crafted Link URL strings can break out of the JavaScript sequenceCVE-2026-663906.1 Medium
- apache thriftApache Thrift: Python TSSLSocket Hostname Matcher ImportCVE-2026-66053Fix available5.9 Medium
- apache thriftApache Thrift: C++ THeaderTransport::readString() info-header length bounds bypassCVE-2026-58662Fix available8.7 High
- apache thriftApache Thrift: Rust binary protocol non-strict path missing string size limitCVE-2026-58389Fix available8.7 High
- apache thriftApache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes pathCVE-2026-58023Fix available6.9 Medium
- apache thriftApache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()CVE-2026-55971Fix available9.3 Critical
- apache thriftApache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()CVE-2026-55970Fix available6.9 Medium
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()CVE-2026-55969Fix available8.7 High
- apache thriftApache Thrift: Node.js quadratic-time DoS in server receive transportsCVE-2026-55968Fix available8.7 High
- apache thriftApache Thrift: Ruby THeaderTransport ZLIB Decompression BombCVE-2026-49158Fix available7.5 High
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitCVE-2026-48586Fix available8.7 High
- apache thriftApache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard BypassCVE-2026-48145Fix available8.2 High
- apache thriftApache Thrift: c_glib TLS Client Missing Hostname VerificationCVE-2026-48144Fix available9.1 Critical
- apache thriftApache Thrift: Unbounded Read Leading to Denial of ServiceCVE-2026-45112Fix available6.9 Medium
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limitCVE-2026-43871Fix available8.7 High
- apache thriftApache Thrift: Unbounded Zlib Decompression in Python THeaderTransportCVE-2026-41608Fix available7.5 High
- apache hbaseApache HBase: Missing scanner instance owner check in thrift delegation serviceCVE-2026-493266.5 Medium
- apache nimbleApache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failureCVE-2026-464525.3 Medium
- apache nimbleApache NimBLE: NULL pointer dereference vulnerability in SMP LTK requestCVE-2026-458167.5 High
- apache nimbleApache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handlerCVE-2026-458157.5 High
- apache nimbleApache NimBLE: Incorrect data validation in BASS add/modify source operationCVE-2026-458138.8 High
- apache nimbleApache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report HandlerCVE-2026-458126.5 Medium
- apache nimbleApache NimBLE: Buffer overflow in socket HCI transportCVE-2026-458117.5 High
- apache neethiApache Neethi: Remote PolicyReference fetch lacks resource boundsCVE-2026-661447.5 High
- apache neethiApache Neethi: Missing global alternative-output budget across policy computation pathsCVE-2026-661437.5 High
- apache neethiApache Neethi: Uncontrolled recursion in policy processingCVE-2026-661427.5 High
- apache opennlpApache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XMLCVE-2026-63317Fix available5.6 Medium
- apache foryApache Fory: Rust MetaString heap use-after-freeCVE-2026-600807.3 High
- apache foryApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interfaceCVE-2026-646069.8 Critical
- apache foryApache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserializationCVE-2026-646099.1 Critical
- apache foryApache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip pathsCVE-2026-646089.8 Critical
- apache mina sshdApache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on WindowsCVE-2026-566237.1 High
- apache mina sshdApache MINA SSHD: SSH certificate options lack validationsCVE-2026-56624Fix available7.3 High
- apache mina sshdApache MINA SSHD: Remote execution of JGit commands can write files on the serverCVE-2026-58624Fix available5.4 Medium
- apache mina sshdApache MINA SSHD: Path traversal in SCP file receptionCVE-2026-56452Fix available7.5 High
- apache syncopeApache Syncope: Low-privileged authenticated SSRF in Connectors and Resources checkCVE-2026-624188.1 High
- apache syncopeApache Syncope: User self-service privilege escalationCVE-2026-62183Public exploit9.8 Critical
- Show moreLoading…