Apache CVEs
3,064 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-49432Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service
- CVE-2026-49877Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console
- CVE-2026-50734Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format…
- CVE-2026-50750Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270
- CVE-2026-52760Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
- CVE-2026-53916Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec
- CVE-2026-53917Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property…
- CVE-2026-54475Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover
- CVE-2026-55957Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
- CVE-2026-55956Apache Tomcat: Security constraints for default servlet ignored method
- CVE-2026-55955Apache Tomcat: EncryptInterceptor not protected against replay attacks
- CVE-2026-55276Apache Tomcat: Logged effective web.xml is incomplete
- CVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
- CVE-2026-53404Apache Tomcat: Bad ornext processing in RewriteValve
- CVE-2026-50229Apache Tomcat: XSS in number guess example
- CVE-2025-64152Apache IoTDB: Path Traversal Vulnerability
- CVE-2025-55017Apache IoTDB: Path Traversal Vulnerability
- CVE-2026-57915Apache Kerby: Kerberos Pre-Authentication Bypass
- CVE-2026-57914Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures
- CVE-2026-49486Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
- CVE-2026-56091Apache Shiro: Authentication bypass in Guice-Web integration
- CVE-2026-56130Apache Shiro: Remember-me cookie isn't checked for expiry on the server
- CVE-2026-41566Apache Kvrocks: Improper permission for the APPLYBATCH command
- CVE-2026-45188Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling
- CVE-2026-46751Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.
- CVE-2026-46752Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()
- CVE-2026-54226Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS
- CVE-2025-62198Apache Atlas: Stored XSS in Create Entity page
- CVE-2026-44914Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents
- CVE-2026-44911Apache NiFi: Incorrect Authorization for Configuration Verification Requests