Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-64945Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
- CVE-2026-64944Apache Answer: Stored XSS via unsanitized HTML in imported question content
- CVE-2026-64943Apache Answer: API keys logged in plaintext during authentication
- CVE-2026-108837Apache Kylin: Potential computed-column resource exhaustion
- CVE-2026-108833Apache Kylin: default startup profile miss security settings
- CVE-2026-108823Apache Kylin: Potential unauthenticated job metadata replacement
- CVE-2026-108780Apache Kylin: Potential JDBC source configuration validation issue
- CVE-2026-108776Apache Kylin: tables/names SparkSQL injection
- CVE-2026-108771Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
- CVE-2026-108766Apache Kylin: missing JDBC-config authorization
- CVE-2026-108764Apache Kylin: job-driver UI proxy SSRF
- CVE-2026-108762Apache Kylin: delete metadata backup path-confinement bypass
- CVE-2026-108743Apache Kylin: spark job OS command injection
- CVE-2026-108709Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
- CVE-2026-69080Apache Kylin: Broken Access Control in QuerySQLBlacklistController
- CVE-2026-69077Apache Kylin: JobController allows unauthorized cross-project manipulation
- CVE-2026-69076Apache Kylin: Unauthorized cross-project job discard
- CVE-2026-68573Apache Kylin: Unauthenticated Metastore Cleanup
- CVE-2026-68572Apache Kylin: Unauthorized SQL execution to Spark SQL env
- CVE-2026-68571Apache Kylin: JDBC URL Whitelist Verification Bypass
- CVE-2026-64959Apache Kylin: Missing authentication on certain cache API endpoints
- CVE-2026-64610Apache Kylin: Redis unsafe Java deserialization
- CVE-2026-63619Apache Kylin: Missing authorization and path-confinement on system meta dump
- CVE-2026-63618Apache Kylin: Low-Privilege Config Exposure
- CVE-2026-94135Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
- CVE-2026-96806Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
- CVE-2026-94134Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
- CVE-2026-92228Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
- CVE-2026-107460Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
- CVE-2026-92120Apache Allura: Oauth1 Replay Attack