[ Vendor · 458 CVEs ]
Apache Software Foundation
CVEs affecting Apache Software Foundation published in the last 30 days, plus any Apache Software Foundation CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-94251 | 23 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache Sling Security BundleA vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache… | |
| CVE-2026-96443 | 23 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache DorisInsufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE. | |
| CVE-2026-73192 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSAn improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref()… | |
| CVE-2026-91852 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-31377 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache DorisAn Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal… | |
| CVE-2026-82331 | 23 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache BuildStreamImproper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python <… | |
| CVE-2026-84501 | 16 Sep 2026 | CVSS 5.3 | Apache Software Foundation Apache ZooKeeperAn unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble"… | |
| CVE-2026-84439 | 16 Sep 2026 | CVSS 5.3 | Apache Software Foundation Apache ZooKeeperWhen audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit… | |
| CVE-2026-79993 | 16 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache ZooKeeperThe `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete… | |
| CVE-2026-59969 | 16 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache ZooKeeperApache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true… | |
| CVE-2026-59739 | 16 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache ZooKeeperInformation disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by… | |
| CVE-2026-82617 | 11 Sep 2026 | CVSS 10.0 | Apache Software Foundation Apache OpenNLPThe two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and… | |
| CVE-2026-73334 | 9 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache Parquet HadoopPotential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to… | |
| CVE-2026-65183 | 25 Aug 2026 | CVSS 8.1 | Apache Software Foundation Apache TomcatTime-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user… | Fix |
| CVE-2026-64607 | 31 Jul 2026 | CVSS 5.3 | Apache Software Foundation Apache HttpComponents ClientHttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an… | |
| CVE-2026-63317 | 24 Jul 2026 | CVSS 5.6 | Apache Software Foundation Apache OpenNLPArbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before… | |
| CVE-2026-49844 | 10 Jul 2026 | CVSS 6.3 | Apache Software Foundation Apache Log4j APIImproper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid… | |
| CVE-2026-54428 | 1 Jul 2026 | CVSS 7.5 | Apache Software Foundation Apache HttpComponents CoreAllocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and… | |
| CVE-2026-54399 | 1 Jul 2026 | CVSS 7.5 | Apache Software Foundation Apache HttpComponents CoreUncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and… | |
| CVE-2026-55956 | 29 Jun 2026 | CVSS 6.5 | Apache Software Foundation Apache TomcatImproper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method… | |
| CVE-2026-47065 | 3 Jun 2026 | CVSS 9.8 | Apache Software Foundation Apache MINAZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the… | |
| CVE-2026-42779 | 1 May 2026 | CVSS 9.8 | Apache Software Foundation Apache MINAThe fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's… | |
| CVE-2026-42404 | 1 May 2026 | CVSS 6.5 | Apache Software Foundation Apache NeethiApache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an… | |
| CVE-2026-41635 | 27 Apr 2026 | CVSS 9.8 | Apache Software Foundation Apache MINAApache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at… | |
| CVE-2026-40948 | 18 Apr 2026 | CVSS 5.4 | Apache Software Foundation Apache Airflow Providers KeycloakThe Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login… | |
| CVE-2026-34481 | 10 Apr 2026 | CVSS 6.3 | Apache Software Foundation Apache Log4j JSON Template LayoutApache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3… | |
| CVE-2026-34477 | 10 Apr 2026 | CVSS 6.3 | Apache Software Foundation Apache Log4j CoreThe fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when… | |
| CVE-2026-34486 | 9 Apr 2026 | CVSS 7.5 | Apache Tomcat Missing Encryption of Sensitive DataMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor… | Exploited |
| CVE-2026-34197 | 7 Apr 2026 | CVSS 8.8 | Apache ActiveMQ Improper Input ValidationImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache… | Exploited |
| CVE-2025-48734 | 28 May 2025 | CVSS 8.8 | Apache Software Foundation Apache Commons BeanUtils 1.xImproper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop… | Fix |
| CVE-2025-24813 | 10 Mar 2025 | CVSS 9.8 | Apache Tomcat Path EquivalencePath Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to… | Exploited |
| CVE-2024-45195 | 4 Sep 2024 | CVSS 7.5 | Apache OFBiz Forced BrowsingDirect Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade… | Exploited |
| CVE-2024-38856 | 5 Aug 2024 | CVSS 9.8 | Apache OFBiz Incorrect AuthorizationIncorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version… | ExploitedFix |
| CVE-2024-38475 | 1 Jul 2024 | CVSS 9.1 | Apache HTTP Server Improper Escaping of OutputImproper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are… | ExploitedFix |
| CVE-2024-32113 | 8 May 2024 | CVSS 9.8 | Apache OFBiz Path TraversalImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before… | ExploitedFix |
| CVE-2024-27348 | 22 Apr 2024 | CVSS 9.8 | Apache HugeGraph-Server Improper Access ControlRCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 &… | Exploited |
| CVE-2023-46604 | 27 Oct 2023 | CVSS 9.8 | Apache ActiveMQ Deserialization of Untrusted DataThe Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to… | Exploited |
| CVE-2023-43622 | 23 Oct 2023 | Not scored yet | Apache Software Foundation Apache HTTP ServerAn attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP… | |
| CVE-2023-33246 | 24 May 2023 | CVSS 9.8 | Apache RocketMQ Command ExecutionFor RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ… | Exploited |
| CVE-2023-27524 | 24 Apr 2023 | CVSS 9.8 | Apache Superset Insecure Default Initialization of ResourceSession Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured… | Exploited |
| CVE-2022-33891 | 18 Jul 2022 | CVSS 8.8 | Apache Spark Command InjectionThe Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks… | Exploited |
| CVE-2022-24706 | 26 Apr 2022 | CVSS 9.8 | Apache CouchDB Insecure Default Initialization of ResourceIn Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges… | ExploitedFix |
| CVE-2022-24112 | 11 Feb 2022 | CVSS 9.8 | Apache APISIX Authentication BypassAn attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX… | Exploited |
| CVE-2021-45046 | 14 Dec 2021 | CVSS 9.0 | Apache Log4j2 Deserialization of Untrusted DataIt was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows… | ExploitedFix |
| CVE-2021-44228 | 10 Dec 2021 | CVSS 10.0 | Apache Log4j2 Remote Code ExecutionApache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and… | ExploitedFix |
| CVE-2021-42013 | 7 Oct 2021 | CVSS 9.8 | Apache HTTP Server Path TraversalIt was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs… | ExploitedFix |
| CVE-2021-41773 | 5 Oct 2021 | CVSS 9.8 | Apache HTTP Server Path TraversalA flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to… | ExploitedFix |
| CVE-2021-40438 | 16 Sep 2021 | CVSS 9.0 | Apache HTTP Server-Side Request Forgery (SSRF)A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP… | ExploitedFix |
| CVE-2020-17519 | 5 Jan 2021 | CVSS 7.5 | Apache Flink Improper Access ControlA change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of… | Exploited |
| CVE-2020-17530 | 11 Dec 2020 | CVSS 9.8 | Apache Struts Remote Code ExecutionForced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts… | ExploitedFix |
| CVE-2020-11978 | 17 Jul 2020 | CVSS 8.8 | Apache Airflow Command InjectionAn issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example… | Exploited |
| CVE-2018-11776 | 22 Aug 2018 | CVSS 8.1 | Apache Struts Remote Code ExecutionApache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by… | ExploitedFix |
| CVE-2017-12617 | 4 Oct 2017 | CVSS 8.1 | Apache Tomcat Remote Code ExecutionWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via… | ExploitedFix |
| CVE-2017-12615 | 19 Sep 2017 | CVSS 8.1 | Apache Tomcat on Windows Remote Code ExecutionWhen running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default… | ExploitedFix |
| CVE-2017-9805 | 15 Sep 2017 | CVSS 8.1 | Apache Struts Deserialization of Untrusted DataThe REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for… | ExploitedFix |
| CVE-2017-9791 | 10 Jul 2017 | CVSS 9.8 | Apache Struts 1 Improper Input ValidationThe Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the… | ExploitedFix |
| CVE-2016-8735 | 6 Apr 2017 | CVSS 9.8 | Apache Tomcat Remote Code ExecutionRemote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before… | ExploitedFix |
| CVE-2017-5638 | 11 Mar 2017 | CVSS 9.8 | Apache Struts Remote Code ExecutionThe Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message… | ExploitedFix |
Page 5 of 5