Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-82232Apache Syncope: SQL injection via sort parameter in Task search
- CVE-2026-86460Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
- CVE-2026-87779Apache Syncope: AES Secret Key disclosure via log output
- CVE-2026-87785Apache Syncope: JWT subject spoofing
- CVE-2026-87802Apache Syncope: SRA OAuth2 JWT signature verification bypass
- CVE-2026-68570Apache Doris: Authorization bypass leading to unauthorized data access
- CVE-2026-72524Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
- CVE-2026-82617Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
- CVE-2026-67211Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
- CVE-2026-80354Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
- CVE-2026-80351Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
- CVE-2026-80352Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
- CVE-2026-84939Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks
- CVE-2026-49362Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
- CVE-2026-49363Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
- CVE-2026-49364Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers
- CVE-2026-57822Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service
- CVE-2026-57967Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
- CVE-2026-67593Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
- CVE-2026-75880Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
- CVE-2026-74761Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId
- CVE-2026-73334Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
- CVE-2026-41871Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
- CVE-2026-41869Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
- CVE-2026-41870Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
- CVE-2026-65181Apache Impala: RCE via External Data Source Class Loading
- CVE-2026-57866Apache Impala: Secrets Exfiltration via SSRF
- CVE-2026-56207Apache Impala: SAML authentication bypass via forged bearer token
- CVE-2026-54048Apache Impala: Avro Schema URL Server-Side Request Forgery
- CVE-2026-75156Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass