Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-88041Apache Tomcat: HTTP/2 trailer header cross-contamination
- CVE-2026-80353Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
- CVE-2026-74049Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
- CVE-2026-74048Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- CVE-2026-108089Apache Cocoon: Unauthenticated access to diagnostic interfaces
- CVE-2026-108088Apache Cocoon: Cross-user cache poisoning
- CVE-2026-108087Apache Cocoon: SQL Injection
- CVE-2026-108086Apache Cocoon: XEE could lead to SSRF and information disclosure
- CVE-2026-92287Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
- CVE-2026-86467Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
- CVE-2026-88900Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
- CVE-2026-91858Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
- CVE-2026-88901Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
- CVE-2026-85317Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
- CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
- CVE-2026-85315Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-85314Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of…
- CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set
- CVE-2026-85312Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
- CVE-2026-85300Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
- CVE-2026-85301Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim
- CVE-2026-85296Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
- CVE-2026-85260Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
- CVE-2026-85257Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-85254Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
- CVE-2026-71253Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
- CVE-2026-85251Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
- CVE-2026-85250Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option
- CVE-2026-85249Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
- CVE-2026-85248Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance