CVEs published by Apache Software Foundation

CVEs published by Apache Software Foundation (CVE Numbering Authority). 193 tracked.

• CVE-2026-105933 LOW 2.3 Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace b
• CVE-2026-105932 LOW 2.3 The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filte
• CVE-2026-33267 CRITICAL 10.0 UPGRADE Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: f
• CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
• CVE-2026-41920 CRITICAL 9.3 UPGRADE Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fro
• CVE-2026-58153 HIGH 8.3 UPGRADE Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when co
• CVE-2026-22068 HIGH 8.2 UPGRADE Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic
• CVE-2026-23904 HIGH 7.3 UPGRADE Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destina
• CVE-2026-58177 HIGH 8.1 UPGRADE The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors
• CVE-2026-66907 HIGH 7.5 UPGRADE Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache C
• CVE-2026-66908 HIGH 7.5 UPGRADE Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apac
• CVE-2026-24033 HIGH 7.2 UPGRADE Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traff
• CVE-2026-50622 HIGH 8.8 UPGRADE Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's ad
• CVE-2026-62391 HIGH 8.1 UPGRADE The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuub
• CVE-2026-44615 MEDIUM 6.5 UPGRADE Path traversal vulnerability in Apache Zeppelin
• CVE-2026-64607 MEDIUM 5.3 UPGRADE HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con
• CVE-2026-65325 MEDIUM 4.8 UPGRADE Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate co
• CVE-2026-112381 MEDIUM 5.9 Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via ha
• CVE-2026-111817 MEDIUM 5.3 Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.con
• CVE-2026-111816 CRITICAL 9.3 Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, beca
• CVE-2026-111810 HIGH 7.5 Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @
• CVE-2026-111808 HIGH 8.6 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DA
• CVE-2026-111805 HIGH 8.6 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-L
• CVE-2026-111804 HIGH 8.2 Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and for
• CVE-2026-105945 HIGH 7.7 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the brok
• CVE-2026-105944 CRITICAL 10.0 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters
• CVE-2026-105942 HIGH 7.7 When a configured proxy role sends a request to the broker on behalf of another user (the original principal),
• CVE-2026-105938 LOW 2.3 Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription
• CVE-2026-105937 HIGH 8.7 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that top
• CVE-2026-105936 MEDIUM 5.3 The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors in
• CVE-2026-105935 MEDIUM 4.9 The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-s
• CVE-2026-105934 HIGH 7.2 The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/
• CVE-2026-52680 CRITICAL 9.8 UPGRADE Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a
• CVE-2026-28812 CRITICAL 9.8 UPGRADE UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to es
• CVE-2026-66756 CRITICAL 9.8 DOWNGRADE Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.
• CVE-2025-61581 HIGH 7.5 UPGRADE ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Cont
• CVE-2026-28811 HIGH 7.5 UPGRADE Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgr
• CVE-2026-28814 HIGH 7.5 UPGRADE Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker t
• CVE-2026-66755 HIGH 7.5 UPGRADE Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1
• CVE-2026-44617 MEDIUM 6.5 UPGRADE LDAP filter injection vulnerability in Apache Zeppelin
• CVE-2026-44616 MEDIUM 6.5 UPGRADE LDAP injection vulnerability in Apache Zeppelin
• CVE-2026-23985 MEDIUM 6.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through
• CVE-2026-28813 HIGH 8.8 UPGRADE Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are
• CVE-2026-48910 MEDIUM 6.5 UPGRADE A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors
• CVE-2026-44613 MEDIUM 6.1 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin
• CVE-2026-23981 MEDIUM 4.3 UPGRADE An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissi
• CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
• CVE-2026-71558 CRITICAL 9.8 UPGRADE Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ vers
• CVE-2026-61484 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue
• CVE-2026-68079 CRITICAL 9.8 UPGRADE In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited
• CVE-2026-71560 CRITICAL 9.1 UPGRADE Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versi
• CVE-2026-68979 CRITICAL 9.8 UPGRADE Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce aut
• CVE-2026-61486 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affect
• CVE-2026-34191 CRITICAL 9.1 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache P
• CVE-2026-61466 CRITICAL 9.1 UPGRADE In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `
• CVE-2026-60053 CRITICAL 9.1 UPGRADE Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0
• CVE-2026-68980 CRITICAL 9.1 UPGRADE Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Cont
• CVE-2026-61483 HIGH 7.5 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apa
• CVE-2026-32327 CRITICAL 9.1 UPGRADE A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer whi
• CVE-2026-57817 HIGH 8.1 UPGRADE The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when opera
• CVE-2026-61372 HIGH 7.5 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fu
• CVE-2026-68981 HIGH 7.5 UPGRADE Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jerse
• CVE-2026-66257 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-66273 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
• CVE-2026-67465 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-67551 HIGH 7.5 UPGRADE pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to p
• CVE-2026-67588 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-67589 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
• CVE-2026-68060 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
• CVE-2026-68074 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-66274 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-67552 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-67590 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-67592 HIGH 7.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-68073 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-48834 HIGH 7.5 UPGRADE Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache
• CVE-2026-54225 HIGH 7.5 UPGRADE Apache CXF allows to control the maximum attachment size via the "attachment-max-size"
• CVE-2026-57819 HIGH 7.5 UPGRADE Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParamete
• CVE-2026-71559 HIGH 7.5 UPGRADE Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to
• CVE-2026-60023 HIGH 7.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects
• CVE-2026-64958 HIGH 7.5 UPGRADE An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on
• CVE-2026-65432 HIGH 7.5 UPGRADE Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external en
• CVE-2026-68481 HIGH 7.5 UPGRADE In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and Toke
• CVE-2026-48911 HIGH 7.5 UPGRADE Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answ
• CVE-2026-57818 HIGH 8.1 UPGRADE A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple t
• CVE-2026-63687 CRITICAL 9.1 UPGRADE Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter
• CVE-2026-65583 CRITICAL 9.1 UPGRADE Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required
• CVE-2026-34501 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects
• CVE-2026-34502 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affec
• CVE-2026-66275 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-66276 MEDIUM 6.5 UPGRADE An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usa
• CVE-2026-66277 MEDIUM 6.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-67553 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-67554 MEDIUM 6.5 UPGRADE An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usa
• CVE-2026-67555 MEDIUM 6.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-67591 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-68075 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-68077 MEDIUM 6.5 UPGRADE An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usa
• CVE-2026-68078 MEDIUM 6.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-68080 MEDIUM 6.5 UPGRADE It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenti
• CVE-2026-48912 MEDIUM 6.5 UPGRADE Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1.
• CVE-2026-50749 MEDIUM 6.5 UPGRADE Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any
• CVE-2026-64640 MEDIUM 6.5 UPGRADE Apache Polaris did not consistently validate storage locations supplied during table and view registration. A
• CVE-2026-62354 MEDIUM 4.3 UPGRADE Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows c
• CVE-2026-28672 CRITICAL 9.8 UPGRADE Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ra
• CVE-2026-42537 CRITICAL 9.8 UPGRADE Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to ver
• CVE-2026-44416 CRITICAL 9.8 UPGRADE Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <
• CVE-2026-55799 CRITICAL 9.8 UPGRADE Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommende
• CVE-2026-40920 CRITICAL 9.8 UPGRADE Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended
• CVE-2026-32227 CRITICAL 9.8 UPGRADE SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to up
• CVE-2026-71290 CRITICAL 9.1 UPGRADE Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerific
• CVE-2026-61899 HIGH 7.5 UPGRADE Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspat
• CVE-2026-55814 HIGH 7.5 UPGRADE Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade t
• CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
• CVE-2026-44630 HIGH 7.5 Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attack
• CVE-2026-65942 HIGH 7.5 UPGRADE TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to up
• CVE-2026-65948 HIGH 7.3 UPGRADE UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a recommende
• CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
• CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
• CVE-2026-65945 MEDIUM 6.5 UPGRADE Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to vers
• CVE-2026-68968 HIGH 7.5 UPGRADE Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf
• CVE-2026-68872 MEDIUM 6.5 UPGRADE The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resol
• CVE-2026-68868 MEDIUM 6.5 UPGRADE The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team sco
• CVE-2026-65017 MEDIUM 6.5 UPGRADE Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments
• CVE-2026-68871 MEDIUM 6.5 UPGRADE The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Va
• CVE-2026-59242 MEDIUM 5.4 UPGRADE Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal
• CVE-2026-68969 MEDIUM 6.5 UPGRADE Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w
• CVE-2026-68971 MEDIUM 6.5 UPGRADE Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom re
• CVE-2026-68870 MEDIUM 5.3 The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connec
• CVE-2026-59244 MEDIUM 6.5 UPGRADE Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered
• CVE-2026-68076 MEDIUM 5.4 UPGRADE Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the w
• CVE-2026-68970 MEDIUM 6.5 UPGRADE Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store
• CVE-2026-54183 MEDIUM 4.3 UPGRADE Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U
• CVE-2026-73240 CRITICAL 9.8 UPGRADE Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al
• CVE-2026-69223 CRITICAL 9.1 UPGRADE Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allu
• CVE-2026-73237 MEDIUM 6.1 UPGRADE XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before
• CVE-2026-73238 MEDIUM 6.1 UPGRADE XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users a
• CVE-2026-73239 MEDIUM 6.5 UPGRADE Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache
• CVE-2026-111815 CRITICAL 10.0 Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certific
• CVE-2026-111814 CRITICAL 10.0 Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated w
• CVE-2026-111813 CRITICAL 10.0 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert
• CVE-2026-111812 CRITICAL 10.0 Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request h
• CVE-2026-111811 CRITICAL 9.0 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletio
• CVE-2025-55702 HIGH 8.7 When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Tr
• CVE-2025-31699 HIGH 8.9 Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on
• CVE-2026-34884 CRITICAL 9.8 UPGRADE SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.
• CVE-2026-113582 HIGH 7.5 UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an at
• CVE-2026-105869 CRITICAL 9.2 Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of i
• CVE-2026-111809 CRITICAL 9.3 Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encodin
• CVE-2026-105930 MEDIUM 6.0 When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a pa

← Back to latest CVEs