# cve.now: Apache

The newest entries naming Apache as an affected vendor (up to 200), of 3,063 in all, 33 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-86336](https://cve.now/CVE-2026-86336.md): Apache TomEE: EJB method authorization is silently skipped on JDK 21+ (no CVSS)
- [CVE-2026-86531](https://cve.now/CVE-2026-86531.md): Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server (no CVSS)
- [CVE-2026-87758](https://cve.now/CVE-2026-87758.md): Apache TomEE: Missing TLS hostname verification in ejbds client connections (no CVSS)
- [CVE-2026-97849](https://cve.now/CVE-2026-97849.md): Apache TomEE: Derby network service listens on all interfaces (no CVSS)
- [CVE-2026-97867](https://cve.now/CVE-2026-97867.md): Apache TomEE: Database credential disclosure via remote JNDI lookup (no CVSS)
- [CVE-2026-97870](https://cve.now/CVE-2026-97870.md): Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server (no CVSS)
- [CVE-2026-97872](https://cve.now/CVE-2026-97872.md): Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings (no CVSS)
- [CVE-2026-97874](https://cve.now/CVE-2026-97874.md): Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications (no CVSS)
- [CVE-2026-97880](https://cve.now/CVE-2026-97880.md): Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication (no CVSS)
- [CVE-2026-97881](https://cve.now/CVE-2026-97881.md): Apache TomEE: Path traversal in embedded HTTP server static resource handling (no CVSS)
- [CVE-2026-97888](https://cve.now/CVE-2026-97888.md): Apache TomEE: Caller identity leaks across requests in embedded HTTP server (no CVSS)
- [CVE-2026-97890](https://cve.now/CVE-2026-97890.md): Apache TomEE: Session fixation in embedded HTTP server (low (no CVSS))
- [CVE-2026-111239](https://cve.now/CVE-2026-111239.md): Apache TomEE: Code execution by any authenticated user via the SSH administration shell (no CVSS)
- [CVE-2026-111240](https://cve.now/CVE-2026-111240.md): Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module (no CVSS)
- [CVE-2026-111241](https://cve.now/CVE-2026-111241.md): Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory (no CVSS)
- [CVE-2026-111242](https://cve.now/CVE-2026-111242.md): Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity (no CVSS)
- [CVE-2026-111243](https://cve.now/CVE-2026-111243.md): Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew (low (no CVSS))
- [CVE-2026-111244](https://cve.now/CVE-2026-111244.md): Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources (no CVSS)
- [CVE-2026-111245](https://cve.now/CVE-2026-111245.md): Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests (no CVSS)
- [CVE-2026-111246](https://cve.now/CVE-2026-111246.md): Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server (low (no CVSS))
- [CVE-2026-111247](https://cve.now/CVE-2026-111247.md): Apache TomEE: Privilege escalation via user name matching a role name (no CVSS)
- [CVE-2026-111248](https://cve.now/CVE-2026-111248.md): Apache TomEE: Authentication with the stored password digest in Tomcat user identity store (low (no CVSS))
- [CVE-2026-111249](https://cve.now/CVE-2026-111249.md): Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network (low (no CVSS))
- [CVE-2026-111250](https://cve.now/CVE-2026-111250.md): Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server (no CVSS)
- [CVE-2026-111251](https://cve.now/CVE-2026-111251.md): Apache TomEE: Unauthenticated server shutdown via the admin port (no CVSS)
- [CVE-2026-111256](https://cve.now/CVE-2026-111256.md): Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server (no CVSS)
- [CVE-2026-111257](https://cve.now/CVE-2026-111257.md): Apache TomEE: Well-known administrative credentials created at startup (no CVSS)
- [CVE-2026-111258](https://cve.now/CVE-2026-111258.md): Apache TomEE: Security constraint bypass via request routing (no CVSS)
- [CVE-2026-111259](https://cve.now/CVE-2026-111259.md): Apache TomEE: Predictable HTTP session identifiers in embedded server (no CVSS)
- [CVE-2026-111260](https://cve.now/CVE-2026-111260.md): Apache TomEE: Predictable OpenID Connect state and nonce values (low (no CVSS))
- [CVE-2026-111261](https://cve.now/CVE-2026-111261.md): Apache TomEE: Authentication bypass with empty password in LDAP identity store (no CVSS)
- [CVE-2026-111262](https://cve.now/CVE-2026-111262.md): Apache TomEE: LDAP injection in LDAP identity store (no CVSS)
- [CVE-2026-111263](https://cve.now/CVE-2026-111263.md): Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application (no CVSS)
- [CVE-2026-111264](https://cve.now/CVE-2026-111264.md): Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method (no CVSS)
- [CVE-2026-87756](https://cve.now/CVE-2026-87756.md): Apache TomEE: Missing authorization on internal deployer EJBs in default profile (no CVSS)
- [CVE-2026-87755](https://cve.now/CVE-2026-87755.md): Apache TomEE: Stateful session bean hijacking via predictable session identifiers (no CVSS)
- [CVE-2026-86811](https://cve.now/CVE-2026-86811.md): Apache TomEE: Path traversal via stateful EJB passivation (no CVSS)
- [CVE-2026-86532](https://cve.now/CVE-2026-86532.md): Apache TomEE: Username enumeration and timing side channel in JAAS login modules (low (no CVSS))
- [CVE-2026-119078](https://cve.now/CVE-2026-119078.md): Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys (no CVSS)
- [CVE-2026-124077](https://cve.now/CVE-2026-124077.md): Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class) (low (no CVSS))
- [CVE-2026-120367](https://cve.now/CVE-2026-120367.md): Apache Axis2/Java: unbounded JSON request body buffering (CVSS 7.5)
- [CVE-2026-123779](https://cve.now/CVE-2026-123779.md): Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes (low (no CVSS))
- [CVE-2026-123753](https://cve.now/CVE-2026-123753.md): Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints (no CVSS)
- [CVE-2026-123766](https://cve.now/CVE-2026-123766.md): Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page (no CVSS)
- [CVE-2026-123770](https://cve.now/CVE-2026-123770.md): Apache Axis2/Java: Unbounded multipart and form-encoded request bodies (low (no CVSS))
- [CVE-2026-120761](https://cve.now/CVE-2026-120761.md): Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents (no CVSS)
- [CVE-2026-120832](https://cve.now/CVE-2026-120832.md): Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution (no CVSS)
- [CVE-2026-118196](https://cve.now/CVE-2026-118196.md): Apache Allura: OAuth1 rebinding (critical (no CVSS))
- [CVE-2026-82436](https://cve.now/CVE-2026-82436.md): Apache Storm Client: Deserialization of Untrusted Data from the State Store (no CVSS)
- [CVE-2026-82440](https://cve.now/CVE-2026-82440.md): Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist (no CVSS)
- [CVE-2026-40913](https://cve.now/CVE-2026-40913.md): Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement (low (no CVSS))
- [CVE-2026-50204](https://cve.now/CVE-2026-50204.md): Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext (no CVSS)
- [CVE-2026-68982](https://cve.now/CVE-2026-68982.md): Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation (no CVSS)
- [CVE-2026-76185](https://cve.now/CVE-2026-76185.md): Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode (no CVSS)
- [CVE-2026-86829](https://cve.now/CVE-2026-86829.md): Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation (no CVSS)
- [CVE-2026-82337](https://cve.now/CVE-2026-82337.md): Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization (no CVSS)
- [CVE-2026-86468](https://cve.now/CVE-2026-86468.md): Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs (low (no CVSS))
- [CVE-2026-96285](https://cve.now/CVE-2026-96285.md): Apache Airflow: Scheduler: next\_kwargs deserialized before the dict check, so resume data still invokes constructors (no CVSS)
- [CVE-2026-113508](https://cve.now/CVE-2026-113508.md): Apache Airflow: Logout token revocation fails open; errors silently swallowed (low (no CVSS))
- [CVE-2026-101031](https://cve.now/CVE-2026-101031.md): Apache Airflow: Shell command injection in the example\_dag\_decorator example Dag via an IPv6 zone identifier (low (no CVSS))
- [CVE-2026-113504](https://cve.now/CVE-2026-113504.md): Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext (no CVSS)
- [CVE-2026-107474](https://cve.now/CVE-2026-107474.md): Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext (no CVSS)
- [CVE-2026-111395](https://cve.now/CVE-2026-111395.md): Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline… (no CVSS)
- [CVE-2026-111421](https://cve.now/CVE-2026-111421.md): Apache Airflow: Execution API: set\_xcom skips the reserved-key check, so task-written XComs instantiate airflow. classes on the API server (CVSS 8.8)
- [CVE-2026-111452](https://cve.now/CVE-2026-111452.md): Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list (low (no CVSS))
- [CVE-2026-111453](https://cve.now/CVE-2026-111453.md): Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag\_id query value but deletes rows for every readable Dag (CVSS 4.3)
- [CVE-2026-111454](https://cve.now/CVE-2026-111454.md): Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read (low (no CVSS))
- [CVE-2026-111455](https://cve.now/CVE-2026-111455.md): Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit (low (no CVSS))
- [CVE-2026-90436](https://cve.now/CVE-2026-90436.md): Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName (CVSS 9.8)
- [CVE-2026-85111](https://cve.now/CVE-2026-85111.md): Apache James: Denial of service upon MIME parsing (CVSS 8.7)
- [CVE-2026-85108](https://cve.now/CVE-2026-85108.md): Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling (CVSS 7.5)
- [CVE-2026-76168](https://cve.now/CVE-2026-76168.md): Apache James: ManageSieve file implementation cross-user path traversal (CVSS 9.8)
- [CVE-2026-74756](https://cve.now/CVE-2026-74756.md): Apache James: WebAdmin exposed without authentication on official Docker default (CVSS 9.1)
- [CVE-2026-76171](https://cve.now/CVE-2026-76171.md): Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client (CVSS 9.1)
- [CVE-2026-49939](https://cve.now/CVE-2026-49939.md): Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol (CVSS 7.5)
- [CVE-2025-66621](https://cve.now/CVE-2025-66621.md): Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred (no CVSS)
- [CVE-2026-66903](https://cve.now/CVE-2026-66903.md): Apache OFBiz: Authenticated Path Traversal in Catalog Image Management (CVSS 6.5)
- [CVE-2026-71901](https://cve.now/CVE-2026-71901.md): Apache OFBiz: Dispatch arbitrary internal services on SFA component (CVSS 8.1)
- [CVE-2026-68524](https://cve.now/CVE-2026-68524.md): Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading (CVSS 7.5)
- [CVE-2026-73577](https://cve.now/CVE-2026-73577.md): Apache OFBiz: Unauthenticated path-suffix view authorization bypass (CVSS 7.5)
- [CVE-2026-73578](https://cve.now/CVE-2026-73578.md): Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact (CVSS 7.5)
- [CVE-2026-73580](https://cve.now/CVE-2026-73580.md): Apache OFBiz: Unauthenticated HR organization and employee disclosure (CVSS 5.3)
- [CVE-2026-74841](https://cve.now/CVE-2026-74841.md): Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode (CVSS 9.1)
- [CVE-2026-76150](https://cve.now/CVE-2026-76150.md): Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage (CVSS 6.5)
- [CVE-2026-81734](https://cve.now/CVE-2026-81734.md): Apache OFBiz: Missing authorization - catalog quick-admin product writes (CVSS 6.5)
- [CVE-2026-76152](https://cve.now/CVE-2026-76152.md): Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services (CVSS 6.5)
- [CVE-2026-81744](https://cve.now/CVE-2026-81744.md): Apache OFBiz: Authorization bypass - self-grant content OWNER (CVSS 6.5)
- [CVE-2026-81808](https://cve.now/CVE-2026-81808.md): Apache OFBiz: Missing authorization - search-result bulk catalog mutation (CVSS 6.5)
- [CVE-2026-81815](https://cve.now/CVE-2026-81815.md): Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB (CVSS 9.8)
- [CVE-2026-81816](https://cve.now/CVE-2026-81816.md): Apache OFBiz: XML external entity injection (XXE) (CVSS 3.5)
- [CVE-2026-81828](https://cve.now/CVE-2026-81828.md): Apache OFBiz: Server-side request forgery in SurveyWrapper (CVSS 8.1)
- [CVE-2026-82894](https://cve.now/CVE-2026-82894.md): Apache OFBiz: Content renderer runs a service name stored on the row (CVSS 7.5)
- [CVE-2026-82902](https://cve.now/CVE-2026-82902.md): Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile (CVSS 4.3)
- [CVE-2026-82904](https://cve.now/CVE-2026-82904.md): Apache OFBiz: Unbounded multi-form row count from a parameter name (CVSS 7.5)
- [CVE-2026-82907](https://cve.now/CVE-2026-82907.md): Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound (CVSS 9.8)
- [CVE-2026-82910](https://cve.now/CVE-2026-82910.md): Apache OFBiz: renderLink compiles link parameters as FreeMarker source (CVSS 8.8)
- [CVE-2026-82912](https://cve.now/CVE-2026-82912.md): Apache OFBiz: Unsandboxed Groovy compiled from a service parameter (CVSS 8.8)
- [CVE-2026-82916](https://cve.now/CVE-2026-82916.md): Apache OFBiz: webtools xmldsdump exports any entity to any path (CVSS 7.1)
- [CVE-2026-82960](https://cve.now/CVE-2026-82960.md): Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE (CVSS 8.8)
- [CVE-2026-83538](https://cve.now/CVE-2026-83538.md): Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers (CVSS 5.3)
- [CVE-2026-83542](https://cve.now/CVE-2026-83542.md): Apache OFBiz: Unauthenticated RCE via login-page widget injection (CVSS 9.8)
- [CVE-2026-84183](https://cve.now/CVE-2026-84183.md): Apache OFBiz: Content Manager VIEW-only RCE in updateLayout (CVSS 8.8)
- [CVE-2026-84728](https://cve.now/CVE-2026-84728.md): Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login (CVSS 5.4)
- [CVE-2026-85627](https://cve.now/CVE-2026-85627.md): Apache OFBiz: Authenticated Code Execution Vulnerability (CVSS 8.8)
- [CVE-2026-92887](https://cve.now/CVE-2026-92887.md): Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation (CVSS 7.3)
- [CVE-2026-97355](https://cve.now/CVE-2026-97355.md): Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service (CVSS 6.5)
- [CVE-2026-97356](https://cve.now/CVE-2026-97356.md): Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass (CVSS 6.5)
- [CVE-2026-100168](https://cve.now/CVE-2026-100168.md): Apache OFBiz: Missing Authorization vulnerability (CVSS 6.5)
- [CVE-2026-100228](https://cve.now/CVE-2026-100228.md): Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation (CVSS 6.5)
- [CVE-2026-105325](https://cve.now/CVE-2026-105325.md): Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations (CVSS 7.5)
- [CVE-2026-105330](https://cve.now/CVE-2026-105330.md): Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access (CVSS 9.8)
- [CVE-2026-105461](https://cve.now/CVE-2026-105461.md): Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities (CVSS 7.5)
- [CVE-2026-109129](https://cve.now/CVE-2026-109129.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification (CVSS 5.4)
- [CVE-2026-109837](https://cve.now/CVE-2026-109837.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association (CVSS 5.4)
- [CVE-2026-109856](https://cve.now/CVE-2026-109856.md): Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation (CVSS 6.5)
- [CVE-2026-109928](https://cve.now/CVE-2026-109928.md): Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover (CVSS 7.4)
- [CVE-2026-114229](https://cve.now/CVE-2026-114229.md): Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session (CVSS 6.1)
- [CVE-2026-114233](https://cve.now/CVE-2026-114233.md): Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders (CVSS 8.1)
- [CVE-2026-114235](https://cve.now/CVE-2026-114235.md): Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification (CVSS 6.5)
- [CVE-2026-114271](https://cve.now/CVE-2026-114271.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification (CVSS 6.5)
- [CVE-2026-114272](https://cve.now/CVE-2026-114272.md): Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure (CVSS 6.5)
- [CVE-2026-114277](https://cve.now/CVE-2026-114277.md): Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts (CVSS 6.5)
- [CVE-2026-103866](https://cve.now/CVE-2026-103866.md): Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling (CVSS 7.5)
- [CVE-2026-103864](https://cve.now/CVE-2026-103864.md): Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization (CVSS 7.5)
- [CVE-2026-103863](https://cve.now/CVE-2026-103863.md): Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths (CVSS 5.4)
- [CVE-2026-121489](https://cve.now/CVE-2026-121489.md): Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory (CVSS 10.0)
- [CVE-2026-96677](https://cve.now/CVE-2026-96677.md): Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome (CVSS 10.0)
- [CVE-2026-73117](https://cve.now/CVE-2026-73117.md): Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data (CVSS 10.0)
- [CVE-2026-73116](https://cve.now/CVE-2026-73116.md): Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects (CVSS 10.0)
- [CVE-2026-73101](https://cve.now/CVE-2026-73101.md): Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults (CVSS 10.0)
- [CVE-2026-73100](https://cve.now/CVE-2026-73100.md): Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors (CVSS 10.0)
- [CVE-2026-73099](https://cve.now/CVE-2026-73099.md): Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override (CVSS 10.0)
- [CVE-2026-73098](https://cve.now/CVE-2026-73098.md): Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing (CVSS 10.0)
- [CVE-2026-73095](https://cve.now/CVE-2026-73095.md): Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling (CVSS 8.7)
- [CVE-2026-59267](https://cve.now/CVE-2026-59267.md): Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption (CVSS 5.8)
- [CVE-2026-90632](https://cve.now/CVE-2026-90632.md): Apache OpenOffice: Local file inclusion via GStreamer plugin (CVSS 5.5)
- [CVE-2026-90634](https://cve.now/CVE-2026-90634.md): Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files (CVSS 7.3)
- [CVE-2026-90631](https://cve.now/CVE-2026-90631.md): Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables (CVSS 3.3)
- [CVE-2026-90629](https://cve.now/CVE-2026-90629.md): Apache OpenOffice: Out of bounds memory access during WMF import (CVSS 7.3)
- [CVE-2026-90628](https://cve.now/CVE-2026-90628.md): Apache OpenOffice: Stack overflow in CFF hint handling (CVSS 7.3)
- [CVE-2026-90627](https://cve.now/CVE-2026-90627.md): Apache OpenOffice: Local file inclusion via SQL provider and flat file database references (CVSS 5.5)
- [CVE-2026-90626](https://cve.now/CVE-2026-90626.md): Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files (CVSS 7.3)
- [CVE-2026-90624](https://cve.now/CVE-2026-90624.md): Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability (CVSS 7.3)
- [CVE-2026-59268](https://cve.now/CVE-2026-59268.md): Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader (CVSS 7.3)
- [CVE-2026-59264](https://cve.now/CVE-2026-59264.md): Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer (CVSS 7.8)
- [CVE-2026-59263](https://cve.now/CVE-2026-59263.md): Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported… (CVSS 1.9)
- [CVE-2026-100302](https://cve.now/CVE-2026-100302.md): Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling (CVSS 7.1)
- [CVE-2026-115448](https://cve.now/CVE-2026-115448.md): Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable (CVSS 8.7)
- [CVE-2026-100300](https://cve.now/CVE-2026-100300.md): Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply… (CVSS 8.7)
- [CVE-2026-100252](https://cve.now/CVE-2026-100252.md): Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID (CVSS 8.6)
- [CVE-2026-100235](https://cve.now/CVE-2026-100235.md): Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation (CVSS 6.0)
- [CVE-2026-108500](https://cve.now/CVE-2026-108500.md): Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection (no CVSS)
- [CVE-2026-103582](https://cve.now/CVE-2026-103582.md): Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS) (CVSS 7.5)
- [CVE-2026-108946](https://cve.now/CVE-2026-108946.md): Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection (CVSS 6.5)
- [CVE-2026-111822](https://cve.now/CVE-2026-111822.md): Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation (CVSS 8.1)
- [CVE-2026-111821](https://cve.now/CVE-2026-111821.md): Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal (CVSS 7.5)
- [CVE-2026-108949](https://cve.now/CVE-2026-108949.md): Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM (CVSS 6.5)
- [CVE-2026-114442](https://cve.now/CVE-2026-114442.md): Apache HertzBeat: incomplete XPath expression validation in aliasFields (CVSS 6.5)
- [CVE-2026-119641](https://cve.now/CVE-2026-119641.md): Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership (CVSS 6.5)
- [CVE-2026-119724](https://cve.now/CVE-2026-119724.md): Apache JClouds: XML External Entity (XXE) in provider-response parsing (CVSS 7.5)
- [CVE-2026-111959](https://cve.now/CVE-2026-111959.md): Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads (CVSS 9.1)
- [CVE-2026-114364](https://cve.now/CVE-2026-114364.md): Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search (CVSS 9.8)
- [CVE-2026-113687](https://cve.now/CVE-2026-113687.md): Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass (CVSS 9.8)
- [CVE-2026-113511](https://cve.now/CVE-2026-113511.md): Apache Syncope: Delegated administration boundaries can be bypassed for Realm update (CVSS 9.1)
- [CVE-2026-110535](https://cve.now/CVE-2026-110535.md): Apache Syncope: AuthProfile value escalation via self-service update (CVSS 8.8)
- [CVE-2026-109083](https://cve.now/CVE-2026-109083.md): Apache Syncope: Remote Code Execution via Flowable JUEL expression (CVSS 9.8)
- [CVE-2026-111089](https://cve.now/CVE-2026-111089.md): Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup (CVSS 7.6)
- [CVE-2026-95863](https://cve.now/CVE-2026-95863.md): Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup (CVSS 7.6)
- [CVE-2026-87718](https://cve.now/CVE-2026-87718.md): Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates (CVSS 2.3)
- [CVE-2026-84231](https://cve.now/CVE-2026-84231.md): Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag (CVSS 7.4)
- [CVE-2026-84177](https://cve.now/CVE-2026-84177.md): Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore (CVSS 6.3)
- [CVE-2026-84172](https://cve.now/CVE-2026-84172.md): Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader (CVSS 6.3)
- [CVE-2026-84170](https://cve.now/CVE-2026-84170.md): Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource (CVSS 8.3)
- [CVE-2026-83594](https://cve.now/CVE-2026-83594.md): Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names (CVSS 8.3)
- [CVE-2026-83559](https://cve.now/CVE-2026-83559.md): Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal (CVSS 7.4)
- [CVE-2026-83539](https://cve.now/CVE-2026-83539.md): Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data (CVSS 7.4)
- [CVE-2026-82956](https://cve.now/CVE-2026-82956.md): Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name (CVSS 7.6)
- [CVE-2026-82898](https://cve.now/CVE-2026-82898.md): Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in (CVSS 2.1)
- [CVE-2026-82840](https://cve.now/CVE-2026-82840.md): Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication (CVSS 7.2)
- [CVE-2026-82705](https://cve.now/CVE-2026-82705.md): Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component (CVSS 6.3)
- [CVE-2026-82704](https://cve.now/CVE-2026-82704.md): Apache Wicket: A listener is invoked on a page instance the request itself created and never configured (CVSS 6.9)
- [CVE-2026-82559](https://cve.now/CVE-2026-82559.md): Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation (CVSS 2.3)
- [CVE-2026-82558](https://cve.now/CVE-2026-82558.md): Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke (CVSS 2.3)
- [CVE-2026-82557](https://cve.now/CVE-2026-82557.md): Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission (CVSS 6.9)
- [CVE-2026-82115](https://cve.now/CVE-2026-82115.md): Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource (CVSS 6.3)
- [CVE-2026-120135](https://cve.now/CVE-2026-120135.md): Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default (CVSS 8.2)
- [CVE-2026-118636](https://cve.now/CVE-2026-118636.md): Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder (CVSS 9.8)
- [CVE-2026-73322](https://cve.now/CVE-2026-73322.md): Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup() (CVSS 6.5)
- [CVE-2026-64618](https://cve.now/CVE-2026-64618.md): Apache Fineract: SQL injection vulnerability in Search API (CVSS 9.8)
- [CVE-2026-65874](https://cve.now/CVE-2026-65874.md): Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints (CVSS 8.8)
- [CVE-2026-71569](https://cve.now/CVE-2026-71569.md): Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name (CVSS 4.8)
- [CVE-2026-115942](https://cve.now/CVE-2026-115942.md): Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read (CVSS 7.5)
- [CVE-2026-114230](https://cve.now/CVE-2026-114230.md): Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames (CVSS 9.8)
- [CVE-2026-105042](https://cve.now/CVE-2026-105042.md): Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash (CVSS 9.8)
- [CVE-2026-105031](https://cve.now/CVE-2026-105031.md): Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust… (CVSS 9.1)
- [CVE-2026-114349](https://cve.now/CVE-2026-114349.md): Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches (CVSS 6.5)
- [CVE-2026-112375](https://cve.now/CVE-2026-112375.md): Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs (CVSS 6.5)
- [CVE-2026-116593](https://cve.now/CVE-2026-116593.md): Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint (CVSS 8.1)
- [CVE-2026-115644](https://cve.now/CVE-2026-115644.md): Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions (CVSS 8.8)
- [CVE-2026-111551](https://cve.now/CVE-2026-111551.md): Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/apache
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.