Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache wss4jApache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceCVE-2026-92121Fix available7.5 High
- apache wss4jApache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionCVE-2026-892389.1 Critical
- apache wss4jApache WSS4J: SAML Sender-Vouches Authentication BypassCVE-2026-889209.8 Critical
- apache wss4jApache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.CVE-2026-878309.1 Critical
- apache wss4jApache WSS4J: Insufficient Validation of Derived-Key ParametersCVE-2026-85532Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasourceCVE-2026-660836.5 Medium
- apache xmlschemaApache XMLSchema: Denial of service through cyclic schema definitions in the schema walkerCVE-2026-1024977.5 High
- apache xmlschemaApache XMLSchema: Denial of service through deeply nested schema structuresCVE-2026-1024967.5 High
- apache xmlschemaApache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includesCVE-2026-1024957.5 High
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example DagCVE-2026-868436.3 Medium
- apache apache-airflow-providers-snowflake, apache software foundation airflow snowflake provider +1 moreApache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domainCVE-2026-81930Fix available6.3 Medium
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logsCVE-2026-818626.5 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: Google Drive query injection via unescaped file and folder namesCVE-2026-81914Fix available4.3 Medium
- apache karafApache Karaf: Authorization bypass in JMX MBean lifecycle operationsCVE-2026-921428.8 High
- apache karafApache Karaf: config:install missing ACL entry allows privilege escalation to adminCVE-2026-910856.3 Medium
- apache karafApache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-createCVE-2026-910489.8 Critical
- apache karafApache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege EscalationCVE-2026-910129.8 Critical
- apache karafApache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)CVE-2026-910068.8 High
- apache karafApache Karaf: LDAP filter injection in JAAS LDAP login modulesCVE-2026-909797.3 High
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoderCVE-2026-925507.5 High
- apache qpid broker-jApache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoderCVE-2026-925607.5 High
- apache qpid broker-jApache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON renderingCVE-2026-925736.5 Medium
- apache qpid broker-jApache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingCVE-2026-925647.5 High
- apache qpid broker-jApache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10CVE-2026-926087.5 High
- apache qpid broker-jApache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationCVE-2026-926099.8 Critical
- apache tomcat nativeApache Tomcat Native: Client certificate requirements can be down-gradedCVE-2026-86247Fix available7.4 High
- apache tomcat nativeApache Tomcat Native: Insecure OpenSSL options enabledCVE-2026-86246Fix available9.1 Critical
- apache tomcat nativeApache Tomcat Native: DoS via TLS handshakeCVE-2026-86243Fix available7.5 High
- apache sling security, apache software foundation sling security bundle +1 moreApache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidenceCVE-2026-942437.3 High
- apache sling security, apache software foundation sling security bundle +1 moreApache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resourceCVE-2026-942516.5 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanismsCVE-2026-919286.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImplCVE-2026-918526.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Improper escaping in the XSS Webconsole pluginCVE-2026-919996.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: Missing parser resource limitsCVE-2026-920016.1 Medium
- apache software foundation sling xss, apache sling xss protection api +1 moreApache Sling XSS: XSS possible through XSSAPI.getValidHref()CVE-2026-731926.1 Medium
- apache airflowApache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryCVE-2026-86473Fix available9.1 Critical
- apache airflowApache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filterCVE-2026-75158Fix available4.3 Medium
- apache airflowApache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixationCVE-2026-82355Fix available4.2 Medium
- apache neethiApache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitelyCVE-2026-918674.3 Medium
- apache neethiApache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceCVE-2026-918667.5 High
- apache neethiApache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceCVE-2026-918657.5 High
- apache neethiApache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionCVE-2026-918647.5 High
- apache neethiApache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceCVE-2026-918637.5 High
- apache nifiApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsCVE-2026-70469Fix available7.5 High
- apache nifiApache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector ConfigurationCVE-2026-81866Fix available0.5 Low
- apache nifiApache NiFi: Missing Authorization for Components Referenced in Flow Update MethodsCVE-2026-82561Fix available5.9 Medium
- apache nifiApache NiFi: Missing Process Group Authorization for Connector MigrationCVE-2026-86089Fix available2.3 Low
- apache nifi, apache software foundation nifi registry +1 moreApache NiFi Registry: Improper Limitation of Pathname in Persisted Extension BundlesCVE-2026-87976Fix available7.2 High
- apache zookeeperApache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProviderCVE-2026-84501Fix available5.3 Medium
- apache zookeeperApache ZooKeeper: Audit log injection via unsanitized output from multiple sourcesCVE-2026-84439Fix available5.3 Medium
- Show moreLoading…