Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
- CVE-2026-65183Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
- CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraint
- CVE-2026-49845Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths
- CVE-2026-55976Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- CVE-2026-53561Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user
- CVE-2026-49050Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
- CVE-2026-75099Apache Allura: Unauthenticated REST disclosure
- CVE-2026-78329Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
- CVE-2026-71300Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
- CVE-2026-63621Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
- CVE-2026-66908Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
- CVE-2026-66907Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
- CVE-2026-66906Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
- CVE-2026-60093Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
- CVE-2026-59230Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled
- CVE-2026-59654Apache CloudStack: DoS caused by database connections leak
- CVE-2026-63046Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
- CVE-2026-47359Apache CloudStack: OS Command Injection due to unsanitized mount command
- CVE-2026-50112Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
- CVE-2026-50222Apache CloudStack: Improper access control in Userdata reference APIs
- CVE-2026-59085Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
- CVE-2026-59655Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
- CVE-2026-59657Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob
- CVE-2026-59780Apache CloudStack: LDAP provider configuration disclosure
- CVE-2026-59799Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow
- CVE-2026-61397Apache CloudStack: OAuth2 Token Cross-Request Leak
- CVE-2026-61398Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI
- CVE-2026-61399Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI
- CVE-2026-61400Apache CloudStack: Get and Run Diagnostics Command Injection