Apache Software Foundation
Page 9 of 22 — Apache Software Foundation CVEs from a corpus of 2174, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-53868 | High | 7.5 | 2025-04-03 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, fro… |
CVE-2025-30676 | Medium | 6.1 | 2025-04-01 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19… |
CVE-2025-30177 | Medium | 6.5 | 2025-04-01 | Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4… |
CVE-2024-56325 | Critical | 9.8 | 2025-04-01 | Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -… |
CVE-2025-30065 | Critical | 9.8 | 2025-04-01 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to… |
CVE-2025-29868 | Medium | 6.5 | 2025-04-01 | Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an exter… |
CVE-2025-27427 | Medium | 4.3 | 2025-04-01 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the… |
CVE-2025-30067 | High | 7.2 | 2025-03-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permiss… |
CVE-2024-48944 | Medium | 6.5 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api o… |
CVE-2024-53679 | Medium | 5.4 | 2025-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficien… |
CVE-2024-53678 | High | 8.8 | 2025-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when req… |
CVE-2025-30474 | Medium | 5.0 | 2025-03-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is… |
CVE-2025-27553 | High | 7.5 | 2025-03-23 | Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' p… |
CVE-2025-26796 | Medium | 5.4 | 2025-03-22 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie. This issue… |
CVE-2025-27888 | Medium | 5.4 | 2025-03-20 | Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), U… |
CVE-2024-54016 | Medium | 4.3 | 2025-03-20 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): thr… |
CVE-2024-47552 | Critical | 9.8 | 2025-03-20 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. … |
CVE-2025-27018 | Medium | 6.3 | 2025-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG… |
CVE-2025-27017 | Medium | 6.5 | 2025-03-12 | Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components gen… |
CVE-2025-27867 | Medium | 5.6 | 2025-03-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects… |
CVE-2025-29891 | Medium | 4.8 | 2025-03-12 | Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4… |
CVE-2025-24813 | Critical | 9.8 | 2025-03-10 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files vi… |
CVE-2025-26865 | Low | 3.5 | 2025-03-10 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18… |
CVE-2025-27636 | Medium | 5.6 | 2025-03-09 | Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4… |
CVE-2024-56196 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended t… |
CVE-2024-56195 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3… |
CVE-2024-38311 | Medium | 6.3 | 2025-03-06 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-56202 | Medium | 4.3 | 2025-03-06 | Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10… |
CVE-2024-55532 | Critical | 9.8 | 2025-03-03 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to versio… |
CVE-2024-24778 | Medium | 6.5 | 2025-03-03 | Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affec… |
CVE-2024-56180 | Critical | 9.8 | 2025-02-14 | CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\m… |
CVE-2024-52577 | Critical | 9.0 | 2025-02-14 | In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could b… |
CVE-2024-46910 | High | 7.1 | 2025-02-13 | An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recomme… |
CVE-2024-32838 | High | 8.8 | 2025-02-12 | SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an au… |
CVE-2025-25247 | Medium | 6.1 | 2025-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix… |
CVE-2025-25069 | Medium | 6.5 | 2025-02-07 | A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP r… |
CVE-2022-31764 | High | 8.5 | 2025-02-06 | The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apac… |
CVE-2024-45626 | Medium | 6.5 | 2025-02-06 | Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a de… |
CVE-2024-37358 | High | 8.6 | 2025-02-06 | Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated use… |
CVE-2024-48019 | Medium | 5.4 | 2025-02-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Dor… |
CVE-2025-24860 | Medium | 5.4 | 2025-02-04 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using Cassand… |
CVE-2024-27137 | Medium | 5.3 | 2025-02-04 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry… |
CVE-2025-23015 | High | 8.8 | 2025-02-04 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w… |
CVE-2024-29869 | Medium | 5.5 | 2025-01-28 | Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. A… |
CVE-2024-23953 | Medium | 6.5 | 2025-01-28 | Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte… |
CVE-2025-24783 | High | 7.5 | 2025-01-27 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Co… |
CVE-2025-24814 | Medium | 5.5 | 2025-01-27 | Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" comp… |
CVE-2024-52012 | Medium | 5.4 | 2025-01-27 | Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of in… |
CVE-2024-53299 | Medium | 6.5 | 2025-01-23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are… |
CVE-2025-23196 | High | 8.8 | 2025-01-21 | A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. Th… |
CVE-2025-23195 | High | 7.5 | 2025-01-21 | An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occu… |
CVE-2024-51941 | High | 8.8 | 2025-01-21 | A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code… |
CVE-2024-45479 | Critical | 9.1 | 2025-01-21 | SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, wh… |
CVE-2024-45478 | Medium | 4.8 | 2025-01-21 | Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5… |
CVE-2025-23184 | Medium | 5.9 | 2025-01-21 | A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream ins… |
CVE-2024-45627 | Medium | 5.9 | 2025-01-14 | In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manage… |
CVE-2025-22828 | Medium | 4.3 | 2025-01-13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache Cl… |
CVE-2024-54676 | Critical | 9.8 | 2025-01-08 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https… |
CVE-2024-45033 | High | 8.1 | 2025-01-08 | Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user passwor… |
CVE-2024-56512 | Medium | 5.4 | 2024-12-28 | Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Paramet… |
CVE-2024-52046 | Critical | 9.8 | 2024-12-25 | The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security… |
CVE-2024-43441 | Critical | 9.8 | 2024-12-24 | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0… |
CVE-2024-45387 | Critical | 9.9 | 2024-12-23 | An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operation… |
CVE-2024-23945 | Medium | 5.9 | 2024-12-23 | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps p… |
CVE-2024-56337 | Critical | 9.8 | 2024-12-20 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0… |
CVE-2024-56128 | Medium | 5.3 | 2024-12-18 | Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challe… |
CVE-2024-54677 | Medium | 5.3 | 2024-12-17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apa… |
CVE-2024-50379 | Critical | 9.8 | 2024-12-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when th… |
CVE-2024-55633 | Medium | 6.5 | 2024-12-12 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML s… |
CVE-2024-53677 | Critical | 9.8 | 2024-12-11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lea… |
CVE-2024-53949 | Medium | 6.5 | 2024-12-09 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use thi… |
CVE-2024-53948 | Medium | 5.3 | 2024-12-09 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recomme… |
CVE-2024-53947 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific fu… |
CVE-2024-46901 | Low | 3.1 | 2024-12-09 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit… |
CVE-2022-41137 | High | 8.3 | 2024-12-05 | Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and c… |
CVE-2024-45106 | High | 8.1 | 2024-12-03 | Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secr… |
CVE-2024-52338 | Critical | 9.8 | 2024-11-28 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An ap… |
CVE-2024-51569 | High | 7.5 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing… |
CVE-2024-47250 | Medium | 5.0 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI even… |
CVE-2024-47249 | Medium | 5.0 | 2024-11-26 | Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory… |
CVE-2024-47248 | Medium | 6.3 | 2024-11-26 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory c… |
CVE-2024-45719 | Low | 2.6 | 2024-11-22 | Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version a… |
CVE-2024-52067 | Medium | 4.9 | 2024-11-21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization proc… |
CVE-2024-31141 | Medium | 6.5 | 2024-11-19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configur… |
CVE-2024-52318 | Medium | 6.1 | 2024-11-18 | Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgr… |
CVE-2024-52317 | Medium | 6.5 | 2024-11-18 | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to r… |
CVE-2024-52316 | Critical | 9.8 | 2024-11-18 | Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext co… |
CVE-2024-48962 | High | 8.8 | 2024-11-18 | Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template… |
CVE-2024-47208 | Critical | 9.8 | 2024-11-18 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45791 | High | 7.5 | 2024-11-18 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are re… |
CVE-2024-45505 | High | 8.8 | 2024-11-18 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can onl… |
CVE-2024-41151 | High | 8.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Ap… |
CVE-2024-45784 | High | 7.5 | 2024-11-15 | Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG a… |
CVE-2024-50306 | Critical | 9.1 | 2024-11-14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, fr… |
CVE-2024-50305 | High | 7.5 | 2024-11-14 | Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users… |
CVE-2024-38479 | High | 7.5 | 2024-11-14 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-50386 | High | 8.5 | 2024-11-12 | Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due t… |
CVE-2024-50378 | Medium | 4.9 | 2024-11-08 | Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2024-51504 | Critical | 9.1 | 2024-11-07 | When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authent… |
CVE-2024-38286 | High | 8.6 | 2024-11-07 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from… |