Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-113504Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
- CVE-2026-107474Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
- CVE-2026-111395Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline…
- CVE-2026-111421Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow. classes on the API server
- CVE-2026-111452Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
- CVE-2026-111453Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
- CVE-2026-111454Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
- CVE-2026-111455Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
- CVE-2026-90436Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
- CVE-2026-85111Apache James: Denial of service upon MIME parsing
- CVE-2026-85108Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
- CVE-2026-76168Apache James: ManageSieve file implementation cross-user path traversal
- CVE-2026-74756Apache James: WebAdmin exposed without authentication on official Docker default
- CVE-2026-76171Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
- CVE-2026-49939Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
- CVE-2025-66621Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
- CVE-2026-66903Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
- CVE-2026-71901Apache OFBiz: Dispatch arbitrary internal services on SFA component
- CVE-2026-68524Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
- CVE-2026-73577Apache OFBiz: Unauthenticated path-suffix view authorization bypass
- CVE-2026-73578Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
- CVE-2026-73580Apache OFBiz: Unauthenticated HR organization and employee disclosure
- CVE-2026-74841Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode
- CVE-2026-76150Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
- CVE-2026-81734Apache OFBiz: Missing authorization - catalog quick-admin product writes
- CVE-2026-76152Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
- CVE-2026-81744Apache OFBiz: Authorization bypass - self-grant content OWNER
- CVE-2026-81808Apache OFBiz: Missing authorization - search-result bulk catalog mutation
- CVE-2026-81815Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
- CVE-2026-81816Apache OFBiz: XML external entity injection (XXE)