Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache zookeeperApache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znodeCVE-2026-79993Fix available7.5 High
- apache zookeeperApache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeCVE-2026-59969Fix available7.5 High
- apache zookeeperApache ZooKeeper: Information disclosure via SetWatches reconnect replayCVE-2026-59739Fix available7.5 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedCVE-2026-864668.1 High
- apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 moreApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTCVE-2026-761879.8 Critical
- apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 moreApache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identityCVE-2026-761869.1 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessCVE-2026-823107.2 High
- apache apache-airflow-providers-apache-kafka, apache software foundation airflow apache kafka provider +1 moreApache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationCVE-2026-86792Fix available8.8 High
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsCVE-2026-864629.1 Critical
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseCVE-2026-823119.8 Critical
- apache apache-airflow-providers-akeyless, apache software foundation airflow akeyless provider +1 moreApache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled keyCVE-2026-864656.5 Medium
- apache opennlpApache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsCVE-2026-82617Fix available10.0 Critical
- apache opennlpApache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializerCVE-2026-672117.5 High
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespaceCVE-2026-803548.1 High
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Tenant repositories reach Maven execution inside operator podCVE-2026-803519.8 Critical
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objectsCVE-2026-803529.8 Critical
- apache freemarkerApache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacksCVE-2026-84939Fix available9.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue CreationCVE-2026-49362Fix available7.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology SubscriptionCVE-2026-493637.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered PeersCVE-2026-493649.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of serviceCVE-2026-578226.5 Medium
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentCVE-2026-57967Public exploit9.8 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionCVE-2026-675939.1 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of serviceCVE-2026-758806.5 Medium
- apache activemq, activemq all, activemq broker +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdCVE-2026-74761Fix available7.5 High
- apache parquet, apache software foundation parquet hadoop +1 moreApache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validationCVE-2026-733348.1 High
- apache nutchApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)CVE-2026-418719.8 Critical
- apache nutchApache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)CVE-2026-418699.1 Critical
- apache nutchApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)CVE-2026-418708.8 High
- apache impalaApache Impala: RCE via External Data Source Class LoadingCVE-2026-651818.1 High
- apache impalaApache Impala: Secrets Exfiltration via SSRFCVE-2026-578668.8 High
- apache impalaApache Impala: SAML authentication bypass via forged bearer tokenCVE-2026-562079.8 Critical
- apache impalaApache Impala: Avro Schema URL Server-Side Request ForgeryCVE-2026-540485.3 Medium
- apache apache-airflow-providers-fab, apache software foundation airflow fab provider +1 moreApache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypassCVE-2026-751569.1 Critical
- apache antApache Ant: Path traversal in ftp and scp tasks allows arbitrary file writeCVE-2026-78254Fix available7.4 High
- apache sparkApache Spark: XSS Vulnerability in Spark Web 3.5.4CVE-2026-32773Fix available6.1 Medium
- apache wicketApache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValueCVE-2026-769866.1 Medium
- apache wicketApache Wicket: XSS in Palette via getAdditionalAttributesCVE-2026-769855.1 Medium
- apache wicketApache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabelCVE-2026-769835.1 Medium
- apache wicketApache Wicket: XSS in MetaDataHeaderItem via addTagAttributeCVE-2026-769845.1 Medium
- apache wicketApache Wicket: XSS in Button via its model objectCVE-2026-769825.1 Medium
- apache wicketApache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabelCVE-2026-758025.1 Medium
- apache wicketApache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListenerCVE-2026-713784.6 Medium
- apache wicketApache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedCVE-2026-712577.5 High
- apache wicketApache Wicket: Path traversal in resource style/variation/localeCVE-2026-704495.3 Medium
- apache shiroApache Shiro: Server-side POST request may be steered to an alternate hostCVE-2026-583015.9 Medium
- apache apisixApache APISIX: Cross-user response poisoning in serverless pluginsCVE-2026-74848Fix available7.0 High
- apache apisixApache APISIX: Unauthenticated CPU-exhaustion DoSCVE-2026-75005Fix available8.7 High
- apache apisixApache APISIX: ldap-auth plugin cross-subtree identity impersonationCVE-2026-75020Fix available7.0 High
- apache apisixApache APISIX: attach-consumer-label does not strip client-supplied consumer-label headersCVE-2026-63041Fix available5.3 Medium
- Show moreLoading…