Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-82429Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
- CVE-2026-82430Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
- CVE-2026-82431Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
- CVE-2026-82433Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
- CVE-2026-82432Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
- CVE-2026-82434Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
- CVE-2026-82435Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
- CVE-2026-82437Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
- CVE-2026-82426Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location
- CVE-2026-82438Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
- CVE-2026-82439Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
- CVE-2026-82441Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
- CVE-2026-84179Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
- CVE-2026-73191Apache Syncope: CAS service URL injection via Forwarded HTTP headers
- CVE-2026-73195Apache Syncope: CSV export spreadsheet formula injection
- CVE-2026-73236Apache Syncope: Cross-Realm authorization bypass in delegated administration
- CVE-2026-73370Apache Syncope: Cross-Realm boundaries reconciliation bypass
- CVE-2026-73178Apache Syncope: JWT Access Token takeover
- CVE-2026-73470Apache Syncope: Delegating users can grant unowned Roles
- CVE-2026-73579Apache Syncope: Non-recursive Any search could skip Realms restrictions
- CVE-2026-75015Apache Syncope: Nested secrets leak cleartext into audit records readable
- CVE-2026-75030Apache Syncope: Incomplete authorization checks for Group members deprovisioning
- CVE-2026-77051Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
- CVE-2026-73668Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
- CVE-2026-77147Apache Syncope: Groovy Sandbox escape for empty CommandArgs
- CVE-2026-77181Apache Syncope: ClientApp update entitlement not effective
- CVE-2026-77883Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
- CVE-2026-78318Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
- CVE-2026-78330Apache Syncope: Privilege escalation for admin user via JWT authentication
- CVE-2026-78336Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user