Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
- CVE-2026-34483Apache Tomcat: Incomplete escaping of JSON access logs
- CVE-2026-32990Apache Tomcat: Fix for CVE-2025-66614 is incomplete
- CVE-2026-29146Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
- CVE-2026-29145Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
- CVE-2026-29129Apache Tomcat: TLS cipher order is not preserved
- CVE-2026-25854Apache Tomcat: Occasionally open redirect
- CVE-2026-24880Apache Tomcat: Request smuggling via invalid chunk extension
- CVE-2026-40046Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated
- CVE-2026-33005Apache OpenMeetings: Insufficient checks in FileWebService
- CVE-2026-33266Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
- CVE-2026-34020Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
- CVE-2025-57735Apache Airflow: Airflow Logout Not Invalidating JWT
- CVE-2025-62188Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
- CVE-2026-34538Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)
- CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing
- CVE-2026-27315Apache Cassandra: cqlsh history sensitive information leak
- CVE-2026-27314Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
- CVE-2026-35554Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
- CVE-2026-33227Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
- CVE-2025-65114Apache Traffic Server: Malformed chunked message body allows request smuggling
- CVE-2025-58136Apache Traffic Server: A simple legitimate POST request causes a crash
- CVE-2026-32794Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange
- CVE-2026-32642Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission
- CVE-2026-28563Apache Airflow: DAG authorization bypass
- CVE-2026-26929Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata
- CVE-2026-30911Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
- CVE-2026-28779Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications
- CVE-2025-54920Apache Spark: Spark History Server Code Execution Vulnerability