Apache CVEs
3,066 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-60012Apache Livy: Restrict file access
- CVE-2025-66249Apache Livy: Unauthorized directory access
- CVE-2026-23907Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
- CVE-2026-25604Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass
- CVE-2025-69219Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator
- CVE-2026-24713Apache IoTDB: JEXL Expression Injection Vulnerability
- CVE-2026-24015Apache IoTDB: Insecure Default Configuration Vulnerability
- CVE-2026-24308Apache ZooKeeper: Sensitive information disclosure in client configuration handling
- CVE-2026-24281Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
- CVE-2026-27446Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation
- CVE-2025-66168Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated
- CVE-2025-59060Apache Ranger: Hostname verification bypass in NiFiRegistryClient
- CVE-2025-59059Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator
- CVE-2026-23969Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering
- CVE-2026-23980Apache Superset: Improper Neutralization of Special Elements used in a SQL Command
- CVE-2026-23982Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass
- CVE-2026-23983Apache Superset: Sensitive Data Exposure via REST API (disabled by default)
- CVE-2026-23984Apache Superset: SQLLab Read-Only Bypass on PostgreSQL
- CVE-2025-27555Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli
- CVE-2024-56373Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information
- CVE-2026-25747Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB
- CVE-2026-23552Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy
- CVE-2025-65995Apache Airflow: Disclosure of secrets to UI via kwargs
- CVE-2026-24734Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
- CVE-2026-24733Apache Tomcat: Security constraint bypass with HTTP/0.9
- CVE-2025-66614Apache Tomcat: Client certificate verification bypass due to virtual host mapping
- CVE-2026-25087Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
- CVE-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
- CVE-2025-33042Apache Avro Java SDK: Code injection on Java generated code
- CVE-2026-24343Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions