Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-111261Apache TomEE: Authentication bypass with empty password in LDAP identity store
- CVE-2026-111262Apache TomEE: LDAP injection in LDAP identity store
- CVE-2026-111263Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application
- CVE-2026-111264Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method
- CVE-2026-87756Apache TomEE: Missing authorization on internal deployer EJBs in default profile
- CVE-2026-87755Apache TomEE: Stateful session bean hijacking via predictable session identifiers
- CVE-2026-86811Apache TomEE: Path traversal via stateful EJB passivation
- CVE-2026-86532Apache TomEE: Username enumeration and timing side channel in JAAS login modules
- CVE-2026-119078Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys
- CVE-2026-124077Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
- CVE-2026-120367Apache Axis2/Java: unbounded JSON request body buffering
- CVE-2026-123779Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes
- CVE-2026-123753Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
- CVE-2026-123766Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
- CVE-2026-123770Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
- CVE-2026-120761Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
- CVE-2026-120832Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution
- CVE-2026-118196Apache Allura: OAuth1 rebinding
- CVE-2026-82436Apache Storm Client: Deserialization of Untrusted Data from the State Store
- CVE-2026-82440Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy Allowlist
- CVE-2026-40913Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
- CVE-2026-50204Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
- CVE-2026-68982Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
- CVE-2026-76185Apache Airflow Task SDK: SecretCache: non-injective team cache key enables cross-team secret disclosure in multi-team mode
- CVE-2026-86829Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
- CVE-2026-82337Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
- CVE-2026-86468Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs
- CVE-2026-96285Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors
- CVE-2026-113508Apache Airflow: Logout token revocation fails open; errors silently swallowed
- CVE-2026-101031Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier