Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-31387Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation
- CVE-2026-31380Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass
- CVE-2026-31379Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager
- CVE-2026-31378Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution
- CVE-2026-29226Apache OFBiz: Low-Privilege SSRF in Content Component
- CVE-2026-29207Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component
- CVE-2026-29220Apache OFBiz: Low-Privilege LFI in Content Component
- CVE-2026-35194Apache Flink: Remote code execution via SQL injection in code generation
- CVE-2026-45205Apache Commons Configuration: StackOverflowError for YAML input with cycles
- CVE-2026-43515Apache Tomcat: Security constraints not correctly applied
- CVE-2026-43514Apache Tomcat: AJP secret compared in non-constant time
- CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitive
- CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown user
- CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validated
- CVE-2026-42498Apache Tomcat: WebSocket authentication header exposure
- CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
- CVE-2026-41018Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL
- CVE-2026-43826Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL
- CVE-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
- CVE-2026-25199Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access
- CVE-2026-25077Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates
- CVE-2025-69233Apache CloudStack: Domain/account resources limits not honored
- CVE-2025-66467Apache CloudStack: MinIO policy remains intact on bucket deletion
- CVE-2025-66172Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to
- CVE-2025-66171Apache CloudStack: Any user can create a new VM from backups they should not have access to
- CVE-2025-66170Apache CloudStack: Any user can list backups that they should not have access to
- CVE-2026-40010Apache Wicket: possible session fixation using AuthenticatedWebSession
- CVE-2026-42509Apache Wicket: crafted strings can break out of the JavaScript sequence
- CVE-2026-43646Apache Wicket: crafted URLs can bypass PackageResourceGuard
- CVE-2026-43975Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager