Apache
Page 5 of 15 — Apache CVEs from a corpus of 1457, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25199 | Critical | 9.1 | 2026-05-08 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from… |
CVE-2026-25077 | High | 8.8 | 2026-05-08 | Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. D… |
CVE-2025-69233 | Medium | 6.5 | 2026-05-08 | Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platfor… |
CVE-2025-66467 | High | 8.0 | 2026-05-08 | Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user cre… |
CVE-2025-66172 | High | 8.1 | 2026-05-08 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… |
CVE-2025-66171 | Medium | 6.5 | 2026-05-08 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… |
CVE-2025-66170 | Medium | 6.5 | 2026-05-08 | The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack… |
CVE-2026-43975 | Medium | 6.5 | 2026-05-06 | FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allo… |
CVE-2026-43646 | High | 7.5 | 2026-05-06 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9… |
CVE-2026-42509 | Medium | 6.1 | 2026-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8… |
CVE-2026-40010 | Critical | 9.1 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. T… |
CVE-2026-28780 | Critical | 9.8 | 2026-05-05 | Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a… |
CVE-2026-29168 | High | 7.3 | 2026-05-05 | Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Serv… |
CVE-2026-43870 | High | 7.3 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Head… |
CVE-2026-43868 | Medium | 5.3 | 2026-05-05 | Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade… |
CVE-2026-43869 | High | 7.3 | 2026-05-05 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended… |
CVE-2026-42812 | Critical | 9.9 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `wr… |
CVE-2026-42811 | Critical | 9.9 | 2026-05-04 | In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can… |
CVE-2026-42810 | Critical | 9.9 | 2026-05-04 | Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those… |
CVE-2026-42809 | Critical | 9.9 | 2026-05-04 | Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or … |
CVE-2026-42440 | High | 7.5 | 2026-05-04 | OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 … |
CVE-2026-42027 | Critical | 9.8 | 2026-05-04 | Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Des… |
CVE-2026-40682 | Critical | 9.1 | 2026-05-04 | XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 De… |
CVE-2026-40563 | High | 8.1 | 2026-05-04 | Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts us… |
CVE-2026-33523 | Medium | 6.5 | 2026-05-04 | HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Ser… |
CVE-2026-33007 | Medium | 5.3 | 2026-05-04 | A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in… |
CVE-2026-33006 | Medium | 4.8 | 2026-05-04 | A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to u… |
CVE-2026-29169 | High | 7.5 | 2026-05-04 | A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_… |
CVE-2026-23918 | High | 8.8 | 2026-05-04 | Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommend… |
CVE-2026-34032 | Medium | 5.3 | 2026-05-04 | Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommend… |
CVE-2026-33857 | Medium | 5.3 | 2026-05-04 | Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to up… |
CVE-2026-34059 | High | 7.5 | 2026-05-04 | Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4… |
CVE-2026-24072 | High | 8.8 | 2026-05-04 | An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the htt… |
CVE-2026-42779 | Critical | 9.8 | 2026-05-01 | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer… |
CVE-2026-42778 | Critical | 9.8 | 2026-05-01 | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache M… |
CVE-2026-42404 | Medium | 6.5 | 2026-05-01 | Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application exp… |
CVE-2026-42403 | High | 7.5 | 2026-05-01 | Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A… |
CVE-2026-42402 | High | 7.5 | 2026-05-01 | Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can tri… |
CVE-2026-41016 | Medium | 5.9 | 2026-04-30 | Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the T… |
CVE-2026-41873 | Critical | 9.8 | 2026-04-28 | ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin ac… |
CVE-2026-41636 | High | 7.5 | 2026-04-28 | Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to v… |
CVE-2026-41607 | Medium | 6.5 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-41606 | Medium | 5.3 | 2026-04-28 | Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, w… |
CVE-2026-41605 | High | 7.3 | 2026-04-28 | Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0… |
CVE-2026-41604 | High | 8.2 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-41602 | High | 7.5 | 2026-04-28 | Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Us… |
CVE-2025-48431 | High | 7.5 | 2026-04-28 | Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are rec… |
CVE-2026-41081 | Medium | 6.5 | 2026-04-27 | Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description… |
CVE-2026-40557 | Medium | 4.8 | 2026-04-27 | Improper Certificate Validation via Global SSL Context Downgrade in Apache Storm Prometheus Reporter Versions Affected: from 2.6.3 to 2.8.6 Description: … |
CVE-2026-33453 | Critical | 10.0 | 2026-04-27 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap c… |
CVE-2026-27172 | High | 8.8 | 2026-04-27 | The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method)… |
CVE-2026-41409 | Critical | 9.8 | 2026-04-27 | The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applie… |
CVE-2026-40858 | High | 8.8 | 2026-04-27 | The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInpu… |
CVE-2026-40022 | High | 8.2 | 2026-04-27 | When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path su… |
CVE-2026-33454 | Critical | 9.4 | 2026-04-27 | The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) on… |
CVE-2026-41635 | Critical | 9.8 | 2026-04-27 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypas… |
CVE-2026-40860 | Critical | 9.8 | 2026-04-27 | JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values… |
CVE-2026-40473 | High | 8.8 | 2026-04-27 | The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInp… |
CVE-2026-40453 | Critical | 9.9 | 2026-04-27 | The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filt… |
CVE-2026-40048 | High | 7.8 | 2026-04-27 | The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `<keyId>.key` files in the configured key directory using java.io.ObjectInputStre… |
CVE-2026-40690 | Medium | 4.3 | 2026-04-24 | The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset grap… |
CVE-2026-38743 | Medium | 4.3 | 2026-04-24 | The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow u… |
CVE-2026-23902 | High | 8.1 | 2026-04-24 | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined o… |
CVE-2026-41044 | High | 8.8 | 2026-04-24 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ… |
CVE-2026-41043 | Medium | 6.5 | 2026-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker… |
CVE-2026-40466 | High | 8.8 | 2026-04-24 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache Activ… |
CVE-2025-62233 | Medium | 6.3 | 2026-04-24 | Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3… |
CVE-2026-40542 | High | 7.3 | 2026-04-22 | Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper m… |
CVE-2026-33558 | Medium | 5.3 | 2026-04-20 | Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in t… |
CVE-2026-33557 | Critical | 9.1 | 2026-04-20 | A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.a… |
CVE-2025-66335 | Medium | 5.3 | 2026-04-20 | Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unint… |
CVE-2026-40948 | Medium | 5.4 | 2026-04-18 | The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-ca… |
CVE-2026-32690 | Low | 3.7 | 2026-04-18 | Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fie… |
CVE-2026-32228 | High | 7.5 | 2026-04-18 | UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the… |
CVE-2026-30912 | High | 7.5 | 2026-04-18 | In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing addit… |
CVE-2026-30898 | High | 8.8 | 2026-04-18 | An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to es… |
CVE-2026-25917 | High | 7.2 | 2026-04-18 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code… |
CVE-2026-31987 | High | 7.5 | 2026-04-16 | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains… |
CVE-2026-25219 | Medium | 6.5 | 2026-04-15 | The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission… |
CVE-2026-30778 | High | 7.5 | 2026-04-15 | The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: fro… |
CVE-2025-54550 | High | 8.1 | 2026-04-15 | The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to… |
CVE-2026-33929 | Medium | 4.3 | 2026-04-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbedde… |
CVE-2026-31924 | Medium | 5.3 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache API… |
CVE-2026-31923 | High | 7.5 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration bein… |
CVE-2026-31908 | Critical | 9.1 | 2026-04-14 | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. … |
CVE-2026-33858 | High | 8.8 | 2026-04-13 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code… |
CVE-2025-66236 | High | 7.5 | 2026-04-13 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security d… |
CVE-2026-34476 | High | 7.1 | 2026-04-13 | Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended… |
CVE-2026-35565 | Medium | 5.4 | 2026-04-13 | Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualizat… |
CVE-2026-35337 | High | 8.8 | 2026-04-13 | Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitte… |
CVE-2026-40023 | Medium | 5.3 | 2026-04-10 | Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize charac… |
CVE-2026-40021 | Medium | 5.3 | 2026-04-10 | Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache… |
CVE-2026-34481 | High | 7.5 | 2026-04-10 | Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces inv… |
CVE-2026-34480 | High | 7.5 | 2026-04-10 | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize c… |
CVE-2026-34479 | High | 7.5 | 2026-04-10 | The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Con… |
CVE-2026-34478 | High | 7.5 | 2026-04-10 | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to… |
CVE-2026-34477 | Medium | 5.9 | 2026-04-10 | The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via t… |
CVE-2026-39304 | High | 7.5 | 2026-04-10 | Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. ActiveMQ NIO SSL transports do not corre… |
CVE-2026-34500 | Medium | 6.5 | 2026-04-09 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache… |
CVE-2026-34487 | High | 7.5 | 2026-04-09 | Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer… |