Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-91048Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
- CVE-2026-91012Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- CVE-2026-91006Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
- CVE-2026-90979Apache Karaf: LDAP filter injection in JAAS LDAP login modules
- CVE-2026-86507Apache Roller: Stored XSS in comment moderation via comment author URL
- CVE-2026-82379Apache Roller: WSSE digest authentication headers can be replayed
- CVE-2026-82380Apache Roller: CSRF protection bypass via self-generated salt validation
- CVE-2026-82381Apache Roller: Stored cross-site scripting in the authoring UI
- CVE-2026-82382Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
- CVE-2026-82383Apache Roller: Anonymous setup action allows frontpage configuration tampering
- CVE-2026-82384Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
- CVE-2026-82375Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
- CVE-2026-82376Apache Roller: XML external entity processing in trackback response parser
- CVE-2026-82377Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
- CVE-2026-82378Apache Roller: OAuth authorization endpoint trusts request-supplied identity
- CVE-2026-82385Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
- CVE-2026-82386Apache Roller: XML external entity processing in OPML bookmark import
- CVE-2026-82348Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
- CVE-2026-82387Apache Roller: Stored cross-site scripting via uploaded media content type
- CVE-2026-82546Apache Roller: Stored cross-site scripting through incoming Trackback links
- CVE-2026-91204Apache Roller: Stored javascript: URI in HTML comments
- CVE-2026-91206Apache Roller: Reflected XSS in the optional LDAP comment authenticator
- CVE-2026-92550Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder
- CVE-2026-92560Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder
- CVE-2026-92573Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering
- CVE-2026-92564Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing
- CVE-2026-92608Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10
- CVE-2026-92609Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- CVE-2026-97636Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key
- CVE-2026-57590Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations