Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-46718Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution
- CVE-2026-41115Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
- CVE-2026-49328Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF
- CVE-2026-48827Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git
- CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
- CVE-2026-49361Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
- CVE-2026-40861Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler
- CVE-2026-40961Apache Airflow: Open Redirect Bypass Vulnerability
- CVE-2026-40963Apache Airflow: DAG authorization bypass on /ui/structure/structure_data
- CVE-2026-41014Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints
- CVE-2026-49267Apache Airflow: No certificate validation on SMTP STARTTLS connections
- CVE-2026-41017Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy
- CVE-2026-41084Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation
- CVE-2026-42252Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern
- CVE-2026-42360Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking
- CVE-2026-42358Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets
- CVE-2026-42359Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
- CVE-2026-45360Apache Airflow: Arbitrary import in custom deadline-reference deserialization
- CVE-2026-45426Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access
- CVE-2026-46764Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
- CVE-2026-48726Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path
- CVE-2026-49298Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
- CVE-2026-42253Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties
- CVE-2026-42588Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
- CVE-2026-45505Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
- CVE-2026-46605Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
- CVE-2026-49157Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default
- CVE-2026-49270Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
- CVE-2026-35563Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname
- CVE-2026-45192Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response