Apache CVEs
3,064 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
- CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
- CVE-2026-50623Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
- CVE-2026-47342Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass
- CVE-2026-50223Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution
- CVE-2026-25700Apache Answer: AdminToken not invalidated after admin deactivation
- CVE-2026-49818Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names
- CVE-2026-34905Apache Answer: Unlisted Questions Accessible via Direct API Access
- CVE-2026-34033Apache Answer: HTML Content Injection in Email
- CVE-2026-34031Apache Answer: The custom avatar was not properly validated
- CVE-2026-33582Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error
- CVE-2026-25699Apache Answer: Authorization Bypass in Timeline API
- CVE-2026-25688Apache Answer: XSS in AI Answer Rendering
- CVE-2026-49975Apache HTTP Server: mod_http2 denial of service
- CVE-2026-48913Apache HTTP Server: mod_http2 memory corruption when file handles exhausted
- CVE-2026-42536Apache HTTP Server: mod_xml2enc heap overflow
- CVE-2026-44185Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
- CVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflow
- CVE-2026-44631Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
- CVE-2026-44119Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules
- CVE-2026-43951Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash
- CVE-2026-42535Apache HTTP Server: mod_dav_fs protected directory access
- CVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow
- CVE-2026-44186Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp
- CVE-2026-29170Apache HTTP Server: mod_proxy_ftp XSS
- CVE-2026-29167Apache HTTP Server: mod_ldap per-dir use-after-free
- CVE-2026-47430Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews
- CVE-2026-50076Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass
- CVE-2026-47065Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232