Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-78254Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
- CVE-2026-52691Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module
- CVE-2026-80190Apache Allura: Stored XSS via code repositories
- CVE-2026-85229Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)
- CVE-2026-81270Apache Allura: Information exposure via search
- CVE-2026-71216Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP
- CVE-2026-80181Apache Allura: Server-side request forgery
- CVE-2026-80180Apache Allura: Stored XSS via markdown HTML processing
- CVE-2026-32773Apache Spark: XSS Vulnerability in Spark Web 3.5.4
- CVE-2026-76986Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
- CVE-2026-76985Apache Wicket: XSS in Palette via getAdditionalAttributes
- CVE-2026-76983Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
- CVE-2026-76984Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
- CVE-2026-76982Apache Wicket: XSS in Button via its model object
- CVE-2026-75802Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
- CVE-2026-71378Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
- CVE-2026-71257Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
- CVE-2026-70449Apache Wicket: Path traversal in resource style/variation/locale
- CVE-2026-58301Apache Shiro: Server-side POST request may be steered to an alternate host
- CVE-2026-74848Apache APISIX: Cross-user response poisoning in serverless plugins
- CVE-2026-75005Apache APISIX: Unauthenticated CPU-exhaustion DoS
- CVE-2026-75020Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
- CVE-2026-63041Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
- CVE-2026-73180Apache Tomcat: Authenticated WebSocket session survives end of HTTP session
- CVE-2026-68763Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
- CVE-2026-68569Apache Tomcat: Principal lookup can fail open in some cases
- CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
- CVE-2026-66422Apache Tomcat: Servlet role references can bypass declarative role constraints
- CVE-2026-65927Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
- CVE-2026-65905Apache Tomcat: Limited replay attack possible with DIGEST authentication