Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-40914Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission
- CVE-2025-48977Apache Ignite: REST HTTP arbitrary file read vulnerability
- CVE-2026-40564Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
- CVE-2026-48589Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
- CVE-2026-44598Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
- CVE-2026-43828Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
- CVE-2026-43827Apache Shiro: Session fixation: new session is not created after login by default
- CVE-2026-42797Apache Syncope: JexlContextBuilder Information Disclosure
- CVE-2026-42782Apache Syncope: Post-auth RCE via Groovy static
- CVE-2026-46745Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token
- CVE-2026-45361Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
- CVE-2026-45249Apache ECharts: XSS in Lines series tooltip rendering
- CVE-2026-44417Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)
- CVE-2026-44618Apache CXF: XXE vulnerability in WS-Transfer functionality
- CVE-2026-44930Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
- CVE-2026-48207Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement
- CVE-2026-45760Apache Camel K: Camel K Cross-Namespace Build Deputy Attack
- CVE-2026-27173Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
- CVE-2026-42526Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends
- CVE-2026-47323Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering
- CVE-2026-46586Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution
- CVE-2026-45434Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
- CVE-2026-45187Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs
- CVE-2026-41919Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction
- CVE-2026-35086Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services
- CVE-2026-31986Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection
- CVE-2026-31910Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access
- CVE-2026-31909Apache OFBiz: Unauthenticated Shipment Label Image Disclosure
- CVE-2026-31906Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters
- CVE-2026-31388Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature