Apache CVEs
3,064 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-44913Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
- CVE-2026-54665Apache NiFi: Missing Validation for Proxy Host Headers
- CVE-2025-66336Apache Doris MCP Server: SQL injection leading the authentication bypass
- CVE-2026-49872Apache APISIX: Improper authentication in cas-auth plugin
- CVE-2026-49871Apache APISIX: cas-auth login CSRF / session injection issue
- CVE-2026-47341Apache APISIX: Session replay issue in hmac-auth
- CVE-2026-48895Apache APISIX: Cas-auth Host header influence on CAS service URL
- CVE-2026-49231Apache APISIX: Identity spoofing issue in APISIX opa plugin
- CVE-2026-49230Apache APISIX: Authentication bypass in jwe-decrypt
- CVE-2026-44915Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
- CVE-2026-44087Apache APISIX: Openid-connect plugin Identity Header Spoofing
- CVE-2026-47339Apache APISIX: authz-casdoor incorrect session sharing
- CVE-2026-44046Apache APISIX: wolf-rbac plugin Identity Spoofing
- CVE-2026-39999Apache APISIX: JWT Algorithm Confusion allows authentication bypass
- CVE-2026-39998Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup
- CVE-2026-49268Apache Shiro: LDAP DN Injection in DefaultLdapRealm
- CVE-2026-47340Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
- CVE-2026-32967Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
- CVE-2026-42357Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
- CVE-2026-41280Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
- CVE-2026-32966Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
- CVE-2026-50203Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names
- CVE-2026-50645Apache CXF: No restriction on attachment headers per message
- CVE-2026-50634Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
- CVE-2026-50633Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
- CVE-2026-50632Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
- CVE-2026-50631Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
- CVE-2026-50630Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
- CVE-2026-50629Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
- CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control