Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache cxfApache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProviderCVE-2026-578188.1 High
- apache cxfApache CXF: OAuth2 Dynamic Client Registration Scope Self-EscalationCVE-2026-614669.1 Critical
- apache cxfApache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parametersCVE-2026-63687Fix available9.1 Critical
- apache cxfApache CXF: Self-issued ID token claims validation skippedCVE-2026-655839.1 Critical
- apache cxfApache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replayCVE-2026-68079Fix available9.8 Critical
- apache cxfApache CXF: Revocation bypass in DefaultEncryptingOAuthDataProviderCVE-2026-684817.5 High
- apache cxfApache CXF: XXE via WSDL/XSD import parsingCVE-2026-654327.5 High
- apache cxfApache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flowCVE-2026-578178.1 High
- apache cxfApache CXF: Unsafe deserialization of inbound JMS ObjectMessageCVE-2026-66909Fix available9.8 Critical
- apache cxfApache CXF: Denial of service via message header attachmentsCVE-2026-649587.5 High
- apache cxfApache CXF: No default restriction on the amount of form parameters per messageCVE-2026-578197.5 High
- apache cxfApache CXF: Denial of Service attack via large attachmentsCVE-2026-542257.5 High
- apache polarisApache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validationCVE-2026-64640Public exploitFix available5.3 Medium
- apache answerApache Answer: Residual Administrative API Key Access After Role or Account RevocationCVE-2026-600539.1 Critical
- apache answerApache Answer: Unauthorized disclosure of deleted or pending answer contentCVE-2026-600237.5 High
- apache answerApache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisionsCVE-2026-507496.5 Medium
- apache answerApache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URLCVE-2026-489126.5 Medium
- apache answerApache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation FlowCVE-2026-489117.5 High
- apache answerApache Answer: Denial of service via crafted Accept-Language header parsingCVE-2026-488347.5 High
- apache lucyApache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed inputCVE-2026-614869.8 Critical
- apache lucyApache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoSCVE-2026-614849.8 Critical
- apache lucyApache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoSCVE-2026-614837.5 High
- apache qpid broker-jApache Qpid Broker-J: Unbounded echo flow responses can lead to denial of serviceCVE-2026-680806.5 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-675927.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-675556.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-680786.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming deliveryCVE-2026-662776.5 Medium
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of serviceCVE-2026-675546.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unbounded disposition range handling can lead to denial of serviceCVE-2026-680776.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Unbounded disposition range handling can lead to denial of serviceCVE-2026-662766.5 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Incoming session flow control window can be exceededCVE-2026-675916.5 Medium
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Incoming session flow control window can be exceededCVE-2026-675536.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Incoming session flow control window can be exceededCVE-2026-680756.5 Medium
- apache qpid proton-jApache Qpid Proton-J: Incoming session flow control window can be exceededCVE-2026-662756.5 Medium
- apache qpid protonj2Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflowCVE-2026-675907.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflowCVE-2026-675527.5 High
- apache qpid broker-jApache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflowCVE-2026-680737.5 High
- apache qpid proton-jApache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflowCVE-2026-66274Fix available7.5 High
- apache qpid protonj2Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-675897.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-675517.5 High
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-680607.5 High
- apache qpid proton-jApache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authenticationCVE-2026-662737.5 High
- apache qpid protonj2Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-675887.5 High
- apache qpid proton-dotnet, apache software foundation qpid proton dotnet +1 moreApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-674657.5 High
- apache qpid broker-jApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-680747.5 High
- apache qpid proton-jApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionCVE-2026-662577.5 High
- apache nifiApache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsCVE-2026-68981Fix available8.8 High
- apache nifiApache NiFi: Authorization Bypass for Parameter Context Asset DeletionCVE-2026-68980Fix available2.3 Low
- apache nifiApache NiFi: Incorrect Authorization for Parameter Context Validation RequestsCVE-2026-62354Fix available7.7 High
- apache nifiApache NiFi: Missing Authorization for Components Referenced by Parameter Context UpdatesCVE-2026-68979Fix available5.9 Medium
- Show moreLoading…