Apache
3573 CVEs across 871 Apache products. Browse Apache vulnerabilities, severities, and proof-of-concept exploits.
Apache products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81930 | | 2026-09-29 | Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API en… | |
CVE-2026-81914 | | 2026-09-29 | Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, with… | |
CVE-2026-81862 | | 2026-09-29 | Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOpera… | |
CVE-2026-92142 | | 2026-09-29 | Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the r… | |
CVE-2026-91085 | | 2026-09-29 | Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactor… | |
CVE-2026-91048 | | 2026-09-29 | The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no match… | |
CVE-2026-91012 | | 2026-09-29 | org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the fil… | |
CVE-2026-91006 | | 2026-09-28 | Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then execute… | |
CVE-2026-90979 | | 2026-09-28 | LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn… | |
CVE-2026-86507 | Medium | 6.1 | 2026-09-28 | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in th… |
CVE-2026-91206 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-91204 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comm… |
CVE-2026-82546 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store… |
CVE-2026-82387 | Medium | 5.4 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store act… |
CVE-2026-82386 | High | 7.7 | 2026-09-28 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and rea… |
CVE-2026-82385 | Medium | 6.5 | 2026-09-28 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, inc… |
CVE-2026-82384 | Critical | 9.8 | 2026-09-28 | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, becau… |
CVE-2026-82383 | High | 8.2 | 2026-09-28 | Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuratio… |
CVE-2026-82382 | Medium | 6.1 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross… |
CVE-2026-82381 | Medium | 5.4 | 2026-09-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to… |
CVE-2026-82380 | High | 8.1 | 2026-09-28 | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim'… |
CVE-2026-82379 | High | 7.7 | 2026-09-28 | Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain… |
CVE-2026-82378 | Critical | 9.0 | 2026-09-28 | Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding req… |
CVE-2026-82377 | Critical | 9.9 | 2026-09-28 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the lega… |
CVE-2026-82376 | High | 7.7 | 2026-09-28 | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse a… |
CVE-2026-82375 | High | 7.4 | 2026-09-28 | Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to… |
CVE-2026-82348 | High | 7.7 | 2026-09-28 | Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or de… |
CVE-2026-92573 | Medium | 6.5 | 2026-09-25 | Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP ma… |
CVE-2026-92564 | | 2026-09-25 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qp… | |
CVE-2026-92560 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-92550 | High | 7.5 | 2026-09-25 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-92609 | Critical | 9.8 | 2026-09-25 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a se… |
CVE-2026-92608 | High | 7.5 | 2026-09-25 | Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQ… |
CVE-2026-97636 | Medium | 6.5 | 2026-09-24 | Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deploymen… |
CVE-2026-57590 | High | 8.1 | 2026-09-24 | A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authentica… |
CVE-2026-86247 | High | 7.4 | 2026-09-23 | Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurat… |
CVE-2026-86246 | Critical | 9.1 | 2026-09-23 | Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOT… |
CVE-2026-86243 | High | 7.5 | 2026-09-23 | Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affect… |
CVE-2026-87022 | High | 7.5 | 2026-09-23 | Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This… |
CVE-2026-86350 | Critical | 9.1 | 2026-09-23 | Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41… |
CVE-2026-86248 | Critical | 9.8 | 2026-09-23 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache… |
CVE-2026-79677 | High | 7.5 | 2026-09-23 | Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of l… |
CVE-2026-78437 | High | 7.3 | 2026-09-23 | Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. … |
CVE-2026-78383 | High | 7.5 | 2026-09-23 | Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leadi… |
CVE-2026-77791 | High | 7.5 | 2026-09-23 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache T… |
CVE-2026-77762 | High | 8.1 | 2026-09-23 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer… |
CVE-2026-77756 | Low | 3.7 | 2026-09-23 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding head… |
CVE-2026-76183 | Critical | 9.8 | 2026-09-23 | Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issu… |
CVE-2026-75973 | High | 7.3 | 2026-09-23 | Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and mu… |
CVE-2026-73581 | Medium | 6.5 | 2026-09-23 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate use… |
CVE-2026-96443 | Medium | 6.5 | 2026-09-23 | Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE. |
CVE-2026-94243 | High | 7.3 | 2026-09-23 | A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: bef… |
CVE-2026-91928 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91852 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-73192 | Medium | 6.1 | 2026-09-23 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache S… |
CVE-2026-31377 | High | 7.5 | 2026-09-23 | An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata s… |
CVE-2026-82331 | Critical | 9.8 | 2026-09-23 | Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows m… |
CVE-2026-70410 | High | 8.8 | 2026-09-22 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUt… |
CVE-2026-94301 | Critical | 9.8 | 2026-09-21 | The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 an… |
CVE-2026-86473 | Critical | 9.1 | 2026-09-21 | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as a… |
CVE-2026-82355 | Medium | 4.2 | 2026-09-21 | When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie… |
CVE-2026-75158 | Medium | 4.3 | 2026-09-21 | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authoriz… |
CVE-2026-91867 | Medium | 4.3 | 2026-09-21 | When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fe… |
CVE-2026-91866 | High | 7.5 | 2026-09-21 | A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (deni… |
CVE-2026-91865 | High | 7.5 | 2026-09-21 | A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming hug… |
CVE-2026-91864 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its si… |
CVE-2026-91863 | High | 7.5 | 2026-09-21 | A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the pa… |
CVE-2026-47321 | High | 7.5 | 2026-09-21 | The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting s… |
CVE-2026-75157 | High | 7.5 | 2026-09-18 | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could… |
CVE-2026-92230 | High | 7.5 | 2026-09-17 | Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outli… |
CVE-2026-87976 | High | 8.1 | 2026-09-16 | Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates… |
CVE-2026-86089 | High | 7.1 | 2026-09-16 | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration s… |
CVE-2026-82561 | Medium | 6.5 | 2026-09-16 | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering… |
CVE-2026-81866 | Medium | 4.3 | 2026-09-16 | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets… |
CVE-2026-76646 | High | 7.5 | 2026-09-16 | A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service co… |
CVE-2026-70469 | High | 7.5 | 2026-09-16 | Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encodi… |
CVE-2026-68536 | Critical | 9.8 | 2026-09-16 | Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade… |
CVE-2026-86792 | High | 8.8 | 2026-09-16 | Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables… |
CVE-2026-86466 | High | 8.1 | 2026-09-16 | Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An at… |
CVE-2026-84501 | Medium | 5.3 | 2026-09-16 | An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request… |
CVE-2026-84439 | Medium | 5.3 | 2026-09-16 | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sendi… |
CVE-2026-82310 | High | 7.2 | 2026-09-16 | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rej… |
CVE-2026-79993 | High | 7.5 | 2026-09-16 | The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes… |
CVE-2026-76187 | Critical | 9.8 | 2026-09-16 | Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak… |
CVE-2026-76186 | Critical | 9.1 | 2026-09-16 | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keyclo… |
CVE-2026-59969 | High | 7.5 | 2026-09-16 | Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hos… |
CVE-2026-59739 | High | 7.5 | 2026-09-16 | Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registeri… |
CVE-2026-86465 | Medium | 6.5 | 2026-09-16 | Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag… |
CVE-2026-86462 | Critical | 9.1 | 2026-09-16 | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed ses… |
CVE-2026-82311 | Critical | 9.8 | 2026-09-16 | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it do… |
CVE-2026-82438 | High | 8.1 | 2026-09-14 | Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user… |
CVE-2026-82437 | Medium | 4.3 | 2026-09-14 | Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not app… |
CVE-2026-82435 | Critical | 9.8 | 2026-09-14 | Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentica… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is con… |
CVE-2026-82432 | High | 8.1 | 2026-09-14 | Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overr… |
CVE-2026-82431 | Critical | 9.8 | 2026-09-14 | Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered… |
CVE-2026-82429 | High | 7.8 | 2026-09-14 | Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown`… |
CVE-2026-82428 | High | 8.8 | 2026-09-14 | Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep--… |
CVE-2026-82427 | High | 7.8 | 2026-09-14 | Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to bu… |