Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-61422Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
- CVE-2026-62440Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation
- CVE-2026-65613Apache CloudStack: Webhook Deliveries Incorrect Access
- CVE-2026-66721Apache CloudStack: Authorization issue with listHostTags for domain admins
- CVE-2026-66722Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue
- CVE-2026-66797Apache CloudStack: Unauthorised comment creation and disclosure
- CVE-2026-68745Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP
- CVE-2026-63044Apache InLong: Authenticated SSRF via POST /api/node/testConnection
- CVE-2026-63043Apache InLong: Agent path traversal via unvalidated file source path
- CVE-2026-63042Apache InLong: Missing authorization on DataNode management endpoints
- CVE-2026-63040Apache InLong: Missing authorization in StreamSource forceDelete
- CVE-2026-63039Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
- CVE-2026-63038Apache InLong: SQL Injection via String Concatenation Vulnerability Report
- CVE-2026-63037Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
- CVE-2026-63016Apache InLong: Ordinary users can create new packages
- CVE-2026-63015Apache InLong: Non-template responsible persons can view template information
- CVE-2026-34884Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server
- CVE-2026-73632Apache Struts: Shared serialization state in the JSON plugin
- CVE-2026-73631Apache Struts: Shared parsing state in the JSON plugin
- CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request locale
- CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation report
- CVE-2026-73633Apache Struts: Unbounded read of a JSON request body
- CVE-2026-66256Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)
- CVE-2026-73237Apache Allura: XSS in markdown pipeline
- CVE-2026-73238Apache Allura: XSS in code display
- CVE-2026-73239Apache Allura: Missing permission checks IDOR
- CVE-2026-73240Apache Allura: Git command injection
- CVE-2026-59244Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI
- CVE-2026-58076Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables…
- CVE-2026-59242Apache Airflow: Arbitrary airflow. class instantiation on the API server via the XCom deserialize endpoint