Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache tomcatApache Tomcat: Principal lookup can fail open in some casesCVE-2026-68569Fix available8.1 High
- apache hiveApache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL pathsCVE-2026-498459.8 Critical
- apache hiveApache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.urlCVE-2026-559769.1 Critical
- apache hiveApache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive userCVE-2026-535617.4 High
- apache dolphinschedulerApache DolphinScheduler: General user can mint admin access tokens via /access-tokensCVE-2026-490508.8 High
- apache alluraApache Allura: Unauthenticated REST disclosureCVE-2026-750995.3 Medium
- apache camelApache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routesCVE-2026-78329Public exploitFix available9.8 Critical
- apache camelApache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injectionCVE-2026-71300Public exploitFix available9.8 Critical
- apache camelApache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategyCVE-2026-63621Public exploitFix available5.3 Medium
- apache camelApache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by…CVE-2026-66908Public exploitFix available7.5 High
- apache camelApache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the resultCVE-2026-66907Public exploitFix available7.5 High
- apache camelApache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDirCVE-2026-66906Public exploitFix available9.1 Critical
- apache camelApache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDirCVE-2026-60093Public exploitFix available5.5 Medium
- apache camelApache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabledCVE-2026-59230Public exploitFix available6.5 Medium
- apache cloudstackApache CloudStack: DoS caused by database connections leakCVE-2026-596546.8 Medium
- apache inlongApache InLong: Agent Installer — Command Injection to RCE via Default CredentialsCVE-2026-630468.8 High
- apache cloudstackApache CloudStack: OS Command Injection due to unsanitized mount commandCVE-2026-473598.8 High
- apache cloudstackApache CloudStack: RCE and SSRF in direct download, metalink and NFS templatesCVE-2026-501128.8 High
- apache cloudstackApache CloudStack: Improper access control in Userdata reference APIsCVE-2026-502227.5 High
- apache cloudstackApache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook moduleCVE-2026-590859.1 Critical
- apache cloudstackApache CloudStack: Unauthenticated OAuth provider client-secret disclosureCVE-2026-596557.5 High
- apache cloudstackApache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJobCVE-2026-596577.5 High
- apache cloudstackApache CloudStack: LDAP provider configuration disclosureCVE-2026-597807.5 High
- apache cloudstackApache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable FlowCVE-2026-597998.8 High
- apache cloudstackApache CloudStack: OAuth2 Token Cross-Request LeakCVE-2026-613977.5 High
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UICVE-2026-613989.1 Critical
- apache cloudstackApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UICVE-2026-613994.8 Medium
- apache cloudstackApache CloudStack: Get and Run Diagnostics Command InjectionCVE-2026-614008.8 High
- apache cloudstackApache CloudStack: Authenticated pre-validation SSRF in registerTemplateCVE-2026-614224.3 Medium
- apache cloudstackApache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulationCVE-2026-624409.1 Critical
- apache cloudstackApache CloudStack: Webhook Deliveries Incorrect AccessCVE-2026-656134.3 Medium
- apache cloudstackApache CloudStack: Authorization issue with listHostTags for domain adminsCVE-2026-667212.7 Low
- apache cloudstackApache CloudStack: ProjectRole & ProjectRolePermission authorization issueCVE-2026-667227.2 High
- apache cloudstackApache CloudStack: Unauthorised comment creation and disclosureCVE-2026-667975.4 Medium
- apache cloudstackApache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdPCVE-2026-687458.1 High
- apache inlongApache InLong: Authenticated SSRF via POST /api/node/testConnectionCVE-2026-630445.4 Medium
- apache inlongApache InLong: Agent path traversal via unvalidated file source pathCVE-2026-630437.5 High
- apache inlongApache InLong: Missing authorization on DataNode management endpointsCVE-2026-630428.1 High
- apache inlongApache InLong: Missing authorization in StreamSource forceDeleteCVE-2026-630408.1 High
- apache inlongApache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleServiceCVE-2026-63039Public exploit9.8 Critical
- apache inlongApache InLong: SQL Injection via String Concatenation Vulnerability ReportCVE-2026-630389.8 Critical
- apache inlongApache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpointCVE-2026-630379.8 Critical
- apache inlongApache InLong: Ordinary users can create new packagesCVE-2026-630165.3 Medium
- apache inlongApache InLong: Non-template responsible persons can view template informationCVE-2026-630154.3 Medium
- apache tomcatApache Tomcat: Authenticated WebSocket session survives end of HTTP sessionCVE-2026-73180Fix available6.8 Medium
- apache tomcatApache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is resetCVE-2026-68763Fix available7.5 High
- apache tomcatApache Tomcat: Redirect after FORM auth may bypass method specific constraintsCVE-2026-68525Fix available9.1 Critical
- apache tomcatApache Tomcat: Servlet role references can bypass declarative role constraintsCVE-2026-66422Fix available8.1 High
- apache tomcatApache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access controlCVE-2026-65927Fix available7.5 High
- apache tomcatApache Tomcat: Limited replay attack possible with DIGEST authenticationCVE-2026-65905Fix available9.8 Critical
- Show moreLoading…