Apache CVEs
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-56624Apache MINA SSHD: SSH certificate options lack validations
- CVE-2026-58624Apache MINA SSHD: Remote execution of JGit commands can write files on the server
- CVE-2026-56452Apache MINA SSHD: Path traversal in SCP file reception
- CVE-2026-62418Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
- CVE-2026-62183Apache Syncope: User self-service privilege escalation
- CVE-2026-57308Apache Syncope: SQL injection vulnerability in Audit Events search
- CVE-2026-53421Apache Syncope: Remote Code Execution via Scripted Connector
- CVE-2026-53405Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask
- CVE-2026-63071Apache Syncope: RCE via Groovy Sandbox bypass
- CVE-2026-59173Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions
- CVE-2026-62764Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions
- CVE-2026-26032Apache Ivy: PackagerResolver path traversal vulnerability
- CVE-2026-57821Apache Fineract: Office list: SQL Injection via Subquery in orderBy
- CVE-2026-35152Apache Fineract: SQL injection in runreports endpoint
- CVE-2026-56287Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
- CVE-2026-49488Apache OpenMeetings: Arbitrary File Read
- CVE-2026-62393Apache Kylin: Improper authorization in job information retrieval
- CVE-2026-62392Apache Kylin: OS Command Injection via Async Query API
- CVE-2026-62390Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
- CVE-2026-58319Apache Doris: Improper Authentication in Frontend HTTP API
- CVE-2026-59084Apache Tomcat: EncryptInterceptor requirements not clearly documented
- CVE-2026-59083Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
- CVE-2026-59245Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)
- CVE-2026-58065Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification
- CVE-2026-41041Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
- CVE-2026-49876Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs
- CVE-2026-49844Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
- CVE-2026-40454Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data
- CVE-2026-40452Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
- CVE-2026-40009Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor