Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-33558Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output
- CVE-2026-40948Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager
- CVE-2026-32690Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1
- CVE-2026-30898Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
- CVE-2026-30912Apache Airflow: Exposing stack trace in case of constraint error
- CVE-2026-25917Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)
- CVE-2026-32228Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
- CVE-2026-31987Apache Airflow: JWT token appearing in logs
- CVE-2026-25219Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
- CVE-2026-30778Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
- CVE-2025-54550Apache Airflow: RCE by race condition in example_xcom dag
- CVE-2026-31923Apache APISIX: Openid-connect `tls_verify` field is disabled by default
- CVE-2026-33929Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
- CVE-2026-31924Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
- CVE-2026-31908Apache APISIX: forward auth plugin allows header injection
- CVE-2026-33858Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (type/var) Bypass in XCom API
- CVE-2025-66236Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
- CVE-2026-34476Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
- CVE-2026-35337Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling
- CVE-2026-35565Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI
- CVE-2026-40023Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters
- CVE-2026-40021Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
- CVE-2026-34481Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
- CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
- CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
- CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
- CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
- CVE-2026-39304Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM
- CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
- CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token