Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-86336Apache TomEE: EJB method authorization is silently skipped on JDK 21+
- CVE-2026-86531Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server
- CVE-2026-87758Apache TomEE: Missing TLS hostname verification in ejbds client connections
- CVE-2026-97849Apache TomEE: Derby network service listens on all interfaces
- CVE-2026-97867Apache TomEE: Database credential disclosure via remote JNDI lookup
- CVE-2026-97870Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server
- CVE-2026-97872Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings
- CVE-2026-97874Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications
- CVE-2026-97880Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication
- CVE-2026-97881Apache TomEE: Path traversal in embedded HTTP server static resource handling
- CVE-2026-97888Apache TomEE: Caller identity leaks across requests in embedded HTTP server
- CVE-2026-97890Apache TomEE: Session fixation in embedded HTTP server
- CVE-2026-111239Apache TomEE: Code execution by any authenticated user via the SSH administration shell
- CVE-2026-111240Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module
- CVE-2026-111241Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory
- CVE-2026-111242Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity
- CVE-2026-111243Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew
- CVE-2026-111244Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources
- CVE-2026-111245Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests
- CVE-2026-111246Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server
- CVE-2026-111247Apache TomEE: Privilege escalation via user name matching a role name
- CVE-2026-111248Apache TomEE: Authentication with the stored password digest in Tomcat user identity store
- CVE-2026-111249Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network
- CVE-2026-111250Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server
- CVE-2026-111251Apache TomEE: Unauthenticated server shutdown via the admin port
- CVE-2026-111256Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server
- CVE-2026-111257Apache TomEE: Well-known administrative credentials created at startup
- CVE-2026-111258Apache TomEE: Security constraint bypass via request routing
- CVE-2026-111259Apache TomEE: Predictable HTTP session identifiers in embedded server
- CVE-2026-111260Apache TomEE: Predictable OpenID Connect state and nonce values