CVE-2026-68971 | Medium | 6.5 | 2026-08-12 | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` autho… |
CVE-2026-68970 | Medium | 6.5 | 2026-08-12 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task log… |
CVE-2026-68969 | Medium | 6.5 | 2026-08-12 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH… |
CVE-2026-68968 | High | 7.5 | 2026-08-12 | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_id` path segment failed to parse. The authori… |
CVE-2026-68076 | Medium | 5.4 | 2026-08-12 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent thi… |
CVE-2026-65017 | Medium | 6.5 | 2026-08-12 | Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mod… |
CVE-2026-59244 | Medium | 6.5 | 2026-08-12 | Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstan… |
CVE-2026-59242 | Medium | 5.4 | 2026-08-12 | Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` with… |
CVE-2026-58076 | High | 8.8 | 2026-08-12 | Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiatin… |
CVE-2026-54183 | Medium | 4.3 | 2026-08-12 | Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not des… |
CVE-2026-71560 | Critical | 9.1 | 2026-08-07 | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing s… |
CVE-2026-71559 | High | 7.5 | 2026-08-07 | Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted da… |
CVE-2026-71558 | Critical | 9.8 | 2026-08-07 | Heap type confusion vulnerability in Apache Fory C++ deserialization.
This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input pa… |
CVE-2026-34502 | High | 7.5 | 2026-08-06 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client
This issue affects Apache Portable Runtime Utility: from 1.3.0 th… |
CVE-2026-34501 | High | 7.5 | 2026-08-06 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.
This issue affects Apache Portable Runtime Utility: from 1.6.0 throu… |
CVE-2026-34191 | Critical | 9.1 | 2026-08-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provid… |
CVE-2026-32327 | Critical | 9.1 | 2026-08-06 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the… |
CVE-2025-49506 | High | 7.5 | 2026-08-06 | APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaki… |
CVE-2026-68481 | High | 7.5 | 2026-08-06 | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The sa… |
CVE-2026-68079 | Critical | 9.8 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementati… |
CVE-2026-65583 | Critical | 9.1 | 2026-08-06 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and s… |
CVE-2026-63687 | Critical | 9.1 | 2026-08-06 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive paramet… |
CVE-2026-61466 | Critical | 9.1 | 2026-08-06 | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration… |
CVE-2026-57818 | High | 8.1 | 2026-08-06 | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the is… |
CVE-2026-66909 | Critical | 9.8 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any at… |
CVE-2026-65432 | High | 7.5 | 2026-08-06 | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import… |
CVE-2026-64958 | High | 7.5 | 2026-08-06 | An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachm… |
CVE-2026-57819 | High | 7.5 | 2026-08-06 | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default… |
CVE-2026-57817 | High | 8.1 | 2026-08-06 | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is i… |
CVE-2026-54225 | High | 7.5 | 2026-08-06 | Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default pl… |
CVE-2026-64640 | Medium | 6.5 | 2026-08-06 | Apache Polaris did not consistently validate storage locations supplied during table and view registration.
An authenticated principal with permission to regi… |
CVE-2026-60053 | Critical | 9.1 | 2026-08-05 | Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable afte… |
CVE-2026-60023 | High | 7.5 | 2026-08-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Deleted or pendin… |
CVE-2026-50749 | Medium | 6.5 | 2026-08-05 | Improper Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Any authenticated user can reject arbitrary pending e… |
CVE-2026-48912 | Medium | 6.5 | 2026-08-05 | Improper Input Validation vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing ownership check in the avatar-cleanup l… |
CVE-2026-48911 | High | 7.5 | 2026-08-05 | Insufficient Verification of Data Authenticity vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing authorization check… |
CVE-2026-48834 | High | 7.5 | 2026-08-05 | Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Unauthenticated attacker… |
CVE-2026-61486 | Critical | 9.8 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is re… |
CVE-2026-61485 | High | 7.5 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As th… |
CVE-2026-61484 | Critical | 9.8 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project… |
CVE-2026-61483 | High | 7.5 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy.
This issue affects Apache Lucy: all versions.
As this project is retired… |
CVE-2026-68080 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-68078 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-68077 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-68075 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Broke… |
CVE-2026-68073 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-67592 | High | 7.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67591 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proto… |
CVE-2026-67590 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-67555 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-67554 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-67553 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proto… |
CVE-2026-67552 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-66277 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-66276 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-66275 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proto… |
CVE-2026-66274 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qp… |
CVE-2026-68074 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-68060 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-67589 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-67588 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-67551 | High | 7.5 | 2026-08-05 | pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects A… |
CVE-2026-67465 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-66273 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects… |
CVE-2026-66257 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apac… |
CVE-2026-68981 | High | 7.5 | 2026-08-03 | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a confi… |
CVE-2026-68980 | Critical | 9.1 | 2026-08-03 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authoriz… |
CVE-2026-68979 | Critical | 9.8 | 2026-08-03 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Par… |
CVE-2026-62354 | Medium | 4.3 | 2026-08-03 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parame… |
CVE-2026-61372 | High | 7.5 | 2026-08-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki.
This issue affects Apache Jena Fuseki: thr… |
CVE-2026-64607 | Medium | 5.3 | 2026-07-31 | HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or un… |
CVE-2026-62391 | High | 8.1 | 2026-07-31 | The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side confi… |
CVE-2026-44615 | Medium | 6.5 | 2026-07-31 | Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or acce… |
CVE-2026-66756 | Critical | 9.8 | 2026-07-30 | Improper Protection of Alternate Path vulnerability in Apache Tika.
This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1.
Users are recomme… |
CVE-2026-66755 | High | 7.5 | 2026-07-30 | Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can p… |
CVE-2026-52680 | Critical | 9.8 | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker w… |
CVE-2026-48910 | Medium | 6.5 | 2026-07-30 | A carefully crafted editing request could trigger an XSS vulnerability
on Apache JSPWiki when parsing errors on the markdown renderer, which
could allow the… |
CVE-2026-44617 | Medium | 6.5 | 2026-07-30 | LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RF… |
CVE-2026-44616 | Medium | 6.5 | 2026-07-30 | LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an… |
CVE-2026-44613 | Medium | 6.1 | 2026-07-30 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted te… |
CVE-2026-28814 | High | 7.5 | 2026-07-30 | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variabl… |
CVE-2026-28813 | High | 8.8 | 2026-07-30 | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.
Users are recommended to upgrade to version 2.12.4, which f… |
CVE-2026-28812 | Critical | 9.8 | 2026-07-30 | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.
Users are recommended to upgra… |
CVE-2026-28811 | High | 7.5 | 2026-07-30 | Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes this issue. |
CVE-2026-23985 | Medium | 6.5 | 2026-07-30 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_pa… |
CVE-2026-23981 | Medium | 4.3 | 2026-07-30 | An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do… |
CVE-2026-65100 | Medium | 4.8 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder o… |
CVE-2026-59243 | Critical | 9.8 | 2026-07-29 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned… |
CVE-2026-58189 | High | 7.5 | 2026-07-29 | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.
This issue affects Apache Traffic Server… |
CVE-2026-58188 | High | 8.2 | 2026-07-29 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58187 | Low | 3.7 | 2026-07-29 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
This issue affects Apache Traffic… |
CVE-2026-58186 | High | 7.5 | 2026-07-29 | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.
This issue affects Apache Traffic Server: from… |
CVE-2026-58185 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14… |
CVE-2026-58184 | High | 8.2 | 2026-07-29 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.
This issue affects Apache Tr… |
CVE-2026-58183 | Medium | 5.9 | 2026-07-29 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.
This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58182 | High | 8.6 | 2026-07-29 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.
This issue affects Apache Traffic Server: from 8… |
CVE-2026-58181 | High | 7.5 | 2026-07-29 | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input.
This issue affects Apache Traffic Server: from 8.0… |
CVE-2026-58180 | High | 7.5 | 2026-07-29 | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1… |
CVE-2026-58179 | High | 8.1 | 2026-07-29 | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.
This issue affects Apache Traffic Server: from 8.0.0 th… |
CVE-2026-58178 | High | 7.5 | 2026-07-29 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.
This issue affects Apache Traffic Server: from 8.0.0 throug… |