Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-92119Apache Allura: REST API Mass Assignment
- CVE-2026-92116Apache Allura: OAuth1 missing callback validation
- CVE-2026-85499Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
- CVE-2026-103636Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
- CVE-2026-103635Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
- CVE-2026-103513Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
- CVE-2026-103501Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
- CVE-2026-103413Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
- CVE-2026-103412Apache Camel Karavan: project file name path traversal when committing a project to Git
- CVE-2026-108039Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
- CVE-2026-107938Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
- CVE-2026-107937Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
- CVE-2026-100227Apache CXF: XML Signature wrapping in JAX-RS XML Security
- CVE-2026-97791Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
- CVE-2026-97468Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
- CVE-2026-86463Apache CXF: FIQL Query Parser Denial of Service
- CVE-2026-79650Apache CXF: OIDC RP Open Redirect
- CVE-2026-78384Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
- CVE-2026-73179Apache CXF: JPA authorization-code consume is non-atomic
- CVE-2026-71575Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
- CVE-2026-71896Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
- CVE-2026-71895Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
- CVE-2026-71183Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
- CVE-2026-66087Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
- CVE-2026-66084Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
- CVE-2026-66082Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
- CVE-2026-103371Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
- CVE-2026-92415Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
- CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
- CVE-2026-97146Apache YuniKorn: Admission control bypass via system label forgery