Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-85532Apache WSS4J: Insufficient Validation of Derived-Key Parameters
- CVE-2026-77185Apache MINA SSHD: Asynchronous authentication can bypass signature verification
- CVE-2026-93994Apache MINA SSHD: Repeated-publickey policy bypass on server
- CVE-2026-94053Apache MINA SSHD: LDAP injection in sshd-ldap
- CVE-2026-93995Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
- CVE-2026-93996Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read
- CVE-2026-94002Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
- CVE-2026-94029Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension
- CVE-2026-94052Apache MINA SSHD: LDAP password authentication ineffective
- CVE-2026-102511Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them
- CVE-2026-102510Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths
- CVE-2026-102509Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser
- CVE-2026-102508Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
- CVE-2026-97395Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
- CVE-2026-71897Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
- CVE-2026-71898Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
- CVE-2026-71899Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
- CVE-2026-78214Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths
- CVE-2026-81569Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution
- CVE-2026-82804Apache DolphinScheduler: Command Injection in the Alert Script Plugin
- CVE-2026-66083Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
- CVE-2026-102497Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
- CVE-2026-102496Apache XMLSchema: Denial of service through deeply nested schema structures
- CVE-2026-102495Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
- CVE-2026-86843Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag
- CVE-2026-81930Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
- CVE-2026-81862Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
- CVE-2026-81914Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
- CVE-2026-92142Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
- CVE-2026-91085Apache Karaf: config:install missing ACL entry allows privilege escalation to admin