Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache jena fusekiApache Jena Fuseki: Web requests using SPARQL Update can escape file restrictionsCVE-2026-613727.5 High
- apache zeppelinPath traversal in NotebookRepo note and folder path compositionCVE-2026-446156.5 Medium
- apache httpclient, apache software foundation httpcomponents client +1 moreApache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoSCVE-2026-64607Fix available5.3 Medium
- apache kyuubiApache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliasesCVE-2026-623918.1 High
- apache tikaApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseCVE-2026-667566.9 Medium
- apache tikaApache Tika: Arbitrary Local File Read in ISArchiveParserCVE-2026-66755Fix available5.9 Medium
- apache supersetApache Superset: Regular Expression Denial of Service (ReDoS) in SQL ParserCVE-2026-23985Fix available5.3 Medium
- apache supersetApache Superset: Improper Authorization in Chart Update allowing Dashboard ModificationCVE-2026-23981Fix available5.3 Medium
- apache kyuubiApache Kyuubi: REST batch multipart upload path traversal allows controlled file writeCVE-2026-52680Public exploit9.8 Critical
- apache jspwikiApache JSPWiki: Markdown parser allows XSS injection in Markdown error processingCVE-2026-489106.5 Medium
- apache jspwikiApache JSPWiki: Pre-Authentication Arbitrary Wiki Markup RenderingCVE-2026-288147.5 High
- apache jspwikiApache JSPWiki: JSPWiki vulnerable to JSON hijackingCVE-2026-288138.8 High
- apache jspwikiApache JSPWiki: UserManager does not sanity-check user database at startupCVE-2026-288129.8 Critical
- apache jspwikiApache JSPWiki: Error Handling - Reveals Error DetailsCVE-2026-288117.5 High
- apache zeppelinApache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867CVE-2026-446176.5 Medium
- apache zeppelinApache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionCVE-2026-446166.5 Medium
- apache zeppelinApache Zeppelin: Cross-site request forgery in REST and WebSocket request handlingCVE-2026-44613Public exploit6.1 Medium
- apache atlasApache Atlas: Missing Authorization on Admin EndpointsCVE-2026-506228.8 High
- apache kyuubiApache Kyuubi: Unrestricted access via Kyuubi engine-ui proxyCVE-2026-239047.3 High
- apache traffic serverApache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeCVE-2026-651006.3 Medium
- apache traffic serverApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplificationCVE-2026-581898.2 High
- apache traffic serverApache Traffic Server: Memory-safety and limit-bypass errors across experimental pluginsCVE-2026-581888.4 High
- apache traffic serverApache Traffic Server: Multiplexer plugin chunk decoder enables a denial of serviceCVE-2026-581876.3 Medium
- apache traffic serverApache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responsesCVE-2026-581868.2 High
- apache traffic serverApache Traffic Server: Use-after-free in the intercept pluginCVE-2026-581858.2 High
- apache traffic serverApache Traffic Server: header_rewrite plugin cookie handling can corrupt memoryCVE-2026-581848.3 High
- apache traffic serverApache Traffic Server: prefetch plugin can crash on attacker-influenced inputCVE-2026-581838.2 High
- apache traffic serverApache Traffic Server: ts_lua plugin has initialization and resource-handling errorsCVE-2026-581828.2 High
- apache traffic serverApache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crashCVE-2026-581818.2 High
- apache traffic serverApache Traffic Server: txn_box plugin overflows the stack from attacker inputCVE-2026-581808.2 High
- apache traffic serverApache Traffic Server: regex_remap plugin overflows the stack from attacker inputCVE-2026-581799.2 Critical
- apache traffic serverApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgeryCVE-2026-581788.2 High
- apache traffic serverApache Traffic Server: Memory-safety and path-traversal errors in the Cripts frameworkCVE-2026-581778.3 High
- apache traffic serverApache Traffic Server: HostDB SRV handling leaks memoryCVE-2026-581758.2 High
- apache traffic serverApache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-freeCVE-2026-581648.3 High
- apache traffic serverApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the serverCVE-2026-581638.3 High
- apache traffic serverApache Traffic Server: Certifier plugin trusts client SNI when generating certificatesCVE-2026-581628.4 High
- apache traffic serverApache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the serverCVE-2026-581619.2 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)CVE-2026-59243Public exploit9.8 Critical
- apache traffic serverApache Traffic Server: Out-of-bounds reads while parsing DNS responsesCVE-2026-581606.3 Medium
- apache traffic serverApache Traffic Server: Listener and ACL handling allow access-control bypassCVE-2026-581597.0 High
- apache traffic serverApache Traffic Server: PROXY protocol parsing has port truncation and a stack overflowCVE-2026-581588.2 High
- apache traffic serverApache Traffic Server: Improper server-session reuse can expose data across client connectionsCVE-2026-581576.9 Medium
- apache traffic serverApache Traffic Server: URL and port parsing errors allow access-control bypassCVE-2026-581566.3 Medium
- apache traffic serverApache Traffic Server: Header-name length truncation enables header aliasing and request smugglingCVE-2026-581559.2 Critical
- apache traffic serverApache Traffic Server: Memory-safety errors in MIME and header parsingCVE-2026-581549.2 Critical
- apache traffic serverApache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verificationCVE-2026-653256.3 Medium
- apache traffic serverApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustionCVE-2026-653248.2 High
- apache traffic serverApache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafelyCVE-2026-581536.3 Medium
- apache traffic serverApache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memoryCVE-2026-581526.9 Medium
- Show moreLoading…