Apache
Page 8 of 15 — Apache CVEs from a corpus of 1457, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35164 | Medium | 6.8 | 2025-07-02 | The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If… |
CVE-2025-32897 | Critical | 9.8 | 2025-06-28 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range… |
CVE-2025-50213 | Critical | 9.8 | 2025-06-24 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affect… |
CVE-2025-32896 | Medium | 6.5 | 2025-06-19 | # Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can… |
CVE-2025-49763 | High | 7.5 | 2025-06-19 | ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can… |
CVE-2025-31698 | High | 7.5 | 2025-06-19 | ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl… |
CVE-2025-49125 | High | 7.5 | 2025-06-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the ro… |
CVE-2025-49124 | High | 8.4 | 2025-06-16 | Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without speci… |
CVE-2025-48988 | High | 7.5 | 2025-06-16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10… |
CVE-2025-48976 | High | 7.5 | 2025-06-16 | Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Com… |
CVE-2025-47869 | Critical | 9.8 | 2025-06-16 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In… |
CVE-2025-47868 | Critical | 9.8 | 2025-06-16 | Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part o… |
CVE-2025-30675 | Medium | 4.7 | 2025-06-11 | In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue b… |
CVE-2025-47849 | High | 8.8 | 2025-06-10 | A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can… |
CVE-2025-47713 | High | 8.8 | 2025-06-10 | A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can… |
CVE-2025-26521 | High | 8.1 | 2025-06-10 | When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the calle… |
CVE-2025-22829 | Medium | 4.3 | 2025-06-10 | The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0… |
CVE-2025-27819 | High | 7.5 | 2025-06-10 | In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect A… |
CVE-2025-27818 | High | 8.8 | 2025-06-10 | A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker… |
CVE-2025-27817 | High | 7.5 | 2025-06-10 | A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting th… |
CVE-2025-27531 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an aut… |
CVE-2025-46548 | Medium | 6.5 | 2025-06-03 | If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication i… |
CVE-2025-48912 | Medium | 6.5 | 2025-05-30 | An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. T… |
CVE-2025-46701 | High | 7.3 | 2025-05-29 | Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the… |
CVE-2025-48734 | High | 8.8 | 2025-05-28 | Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers fro… |
CVE-2025-27528 | Critical | 9.1 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows att… |
CVE-2025-27526 | Medium | 6.5 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can le… |
CVE-2025-27522 | Medium | 6.5 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a seconda… |
CVE-2025-35003 | Critical | 9.8 | 2025-05-26 | Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bl… |
CVE-2025-47436 | Critical | 9.8 | 2025-05-14 | Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted ma… |
CVE-2025-26864 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache Io… |
CVE-2025-26795 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This i… |
CVE-2024-24780 | Critical | 9.8 | 2025-05-14 | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function fro… |
CVE-2025-27696 | High | 8.8 | 2025-05-13 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissio… |
CVE-2025-46392 | Medium | 6.5 | 2025-05-09 | Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that all… |
CVE-2025-27533 | High | 7.5 | 2025-05-07 | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not prop… |
CVE-2025-46762 | High | 8.1 | 2025-05-06 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced… |
CVE-2025-3891 | High | 7.5 | 2025-04-29 | A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending… |
CVE-2025-31651 | Critical | 9.8 | 2025-04-28 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was poss… |
CVE-2025-31650 | High | 7.5 | 2025-04-28 | Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of th… |
CVE-2025-27820 | High | 7.5 | 2025-04-24 | A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apac… |
CVE-2025-26413 | High | 7.5 | 2025-04-22 | Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an inde… |
CVE-2025-29953 | Critical | 9.8 | 2025-04-18 | Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 wh… |
CVE-2024-56736 | Medium | 6.5 | 2025-04-16 | Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended t… |
CVE-2025-24859 | High | 8.8 | 2025-04-14 | A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes… |
CVE-2025-27391 | Medium | 6.5 | 2025-04-09 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apac… |
CVE-2025-31672 | Medium | 5.3 | 2025-04-09 | Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are bas… |
CVE-2025-30677 | Medium | 6.5 | 2025-04-09 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Ad… |
CVE-2025-30473 | High | 8.8 | 2025-04-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the parti… |
CVE-2024-53868 | High | 7.5 | 2025-04-03 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, fro… |
CVE-2025-30676 | Medium | 6.1 | 2025-04-01 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19… |
CVE-2025-30177 | Medium | 6.5 | 2025-04-01 | Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4… |
CVE-2024-56325 | Critical | 9.8 | 2025-04-01 | Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -… |
CVE-2025-30065 | Critical | 9.8 | 2025-04-01 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to… |
CVE-2025-29868 | Medium | 6.5 | 2025-04-01 | Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an exter… |
CVE-2025-27427 | Medium | 4.3 | 2025-04-01 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the… |
CVE-2025-30067 | High | 7.2 | 2025-03-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permiss… |
CVE-2024-48944 | Medium | 6.5 | 2025-03-27 | Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. Through a kylin server, an attacker may forge a request to invoke "/kylin/api/xxx/diag" api o… |
CVE-2024-53679 | Medium | 5.4 | 2025-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficien… |
CVE-2024-53678 | High | 8.8 | 2025-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when req… |
CVE-2025-30474 | Medium | 5.0 | 2025-03-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is… |
CVE-2025-27553 | High | 7.5 | 2025-03-23 | Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' p… |
CVE-2025-26796 | Medium | 5.4 | 2025-03-22 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Oozie. This issue… |
CVE-2025-27888 | Medium | 5.4 | 2025-03-20 | Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), U… |
CVE-2024-54016 | Medium | 4.3 | 2025-03-20 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): thr… |
CVE-2024-47552 | Critical | 9.8 | 2025-03-20 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. … |
CVE-2025-27018 | Medium | 6.3 | 2025-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG… |
CVE-2025-27017 | Medium | 6.5 | 2025-03-12 | Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components gen… |
CVE-2025-27867 | Medium | 5.6 | 2025-03-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects… |
CVE-2025-29891 | Medium | 4.8 | 2025-03-12 | Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4… |
CVE-2025-24813 | Critical | 9.8 | 2025-03-10 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files vi… |
CVE-2025-26865 | Low | 3.5 | 2025-03-10 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18… |
CVE-2025-27636 | Medium | 5.6 | 2025-03-09 | Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4… |
CVE-2024-56196 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended t… |
CVE-2024-56195 | Medium | 6.3 | 2025-03-06 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3… |
CVE-2024-38311 | Medium | 6.3 | 2025-03-06 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-56202 | Medium | 4.3 | 2025-03-06 | Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10… |
CVE-2024-55532 | Critical | 9.8 | 2025-03-03 | Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0. Users are recommended to upgrade to versio… |
CVE-2024-24778 | Medium | 6.5 | 2025-03-03 | Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affec… |
CVE-2024-56180 | Critical | 9.8 | 2025-02-14 | CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\m… |
CVE-2024-52577 | Critical | 9.0 | 2025-02-14 | In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could b… |
CVE-2024-46910 | High | 7.1 | 2025-02-13 | An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recomme… |
CVE-2024-32838 | High | 8.8 | 2025-02-12 | SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an au… |
CVE-2025-25247 | Medium | 6.1 | 2025-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix… |
CVE-2025-25069 | Medium | 6.5 | 2025-02-07 | A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP r… |
CVE-2022-31764 | High | 8.5 | 2025-02-06 | The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apac… |
CVE-2024-45626 | Medium | 6.5 | 2025-02-06 | Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a de… |
CVE-2024-37358 | High | 8.6 | 2025-02-06 | Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated use… |
CVE-2024-48019 | Medium | 5.4 | 2025-02-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Dor… |
CVE-2025-24860 | Medium | 5.4 | 2025-02-04 | Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using Cassand… |
CVE-2024-27137 | Medium | 5.3 | 2025-02-04 | In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry… |
CVE-2025-23015 | High | 8.8 | 2025-02-04 | Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser w… |
CVE-2024-29869 | Medium | 5.5 | 2025-01-28 | Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. A… |
CVE-2024-23953 | Medium | 6.5 | 2025-01-28 | Use of Arrays.equals() in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte… |
CVE-2025-24783 | High | 7.5 | 2025-01-27 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Co… |
CVE-2025-24814 | Medium | 5.5 | 2025-01-27 | Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" comp… |
CVE-2024-52012 | Medium | 5.4 | 2025-01-27 | Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of in… |
CVE-2024-53299 | Medium | 6.5 | 2025-01-23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are… |
CVE-2025-23196 | High | 8.8 | 2025-01-21 | A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. Th… |
CVE-2025-23195 | High | 7.5 | 2025-01-21 | An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occu… |