Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-66755Apache Tika: Arbitrary Local File Read in ISArchiveParser
- CVE-2026-23985Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
- CVE-2026-23981Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification
- CVE-2026-52680Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write
- CVE-2026-48910Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing
- CVE-2026-28814Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
- CVE-2026-28813Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
- CVE-2026-28812Apache JSPWiki: UserManager does not sanity-check user database at startup
- CVE-2026-28811Apache JSPWiki: Error Handling - Reveals Error Details
- CVE-2026-44617Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867
- CVE-2026-44616Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction
- CVE-2026-44613Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
- CVE-2026-50622Apache Atlas: Missing Authorization on Admin Endpoints
- CVE-2026-23904Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy
- CVE-2026-65100Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
- CVE-2026-58189Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
- CVE-2026-58188Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins
- CVE-2026-58187Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
- CVE-2026-58186Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
- CVE-2026-58185Apache Traffic Server: Use-after-free in the intercept plugin
- CVE-2026-58184Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
- CVE-2026-58183Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
- CVE-2026-58182Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors
- CVE-2026-58181Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
- CVE-2026-58180Apache Traffic Server: txn_box plugin overflows the stack from attacker input
- CVE-2026-58179Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
- CVE-2026-58178Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
- CVE-2026-58177Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework
- CVE-2026-58175Apache Traffic Server: HostDB SRV handling leaks memory
- CVE-2026-58164Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free