Apache CVEs
3,066 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-23906Apache Druid: Authentication Bypass via LDAP Anonymous Bind
- CVE-2026-23901Apache Shiro: Brute force attack possible to determine valid user names
- CVE-2026-22922Apache Airflow: Airflow externalLogUrl Permission Bypass
- CVE-2026-24098Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors
- CVE-2026-23903Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
- CVE-2026-24735Apache Answer: Revision API Improper Access Control leads to Information Disclosure
- CVE-2026-23794Apache Syncope: Reflected XSS on Enduser Login
- CVE-2026-23795Apache Syncope: Console XXE on Keymaster parameters
- CVE-2016-15057Apache Continuum: Command injection leading to RCE
- CVE-2025-27821HDFS native client: Out of bounds write in URI parser of native HDFS client
- CVE-2026-24656Apache Karaf: Decanter log-socket collector has deserialization vulnerability
- CVE-2026-22022Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
- CVE-2026-22444Apache Solr: Insufficient file-access checking in standalone core-creation requests
- CVE-2025-59355Apache Linkis: Password Exposure
- CVE-2025-29847Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass
- CVE-2025-68675Apache Airflow: proxy credentials for various providers might leak in task logs
- CVE-2025-68438Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated
- CVE-2025-60021Apache bRPC: Remote command injection vulnerability in heap builtin service
- CVE-2025-66169Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component
- CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
- CVE-2025-52435Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller
- CVE-2025-53470Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
- CVE-2025-53477Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
- CVE-2025-62235Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing
- CVE-2025-68637Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client
- CVE-2025-68280Apache SIS: XML External Entity (XXE) vulnerability
- CVE-2025-66518Apache Kyuubi: Unauthorized directory access due to missing path normalization
- CVE-2025-47411Apache StreamPipes: Leverage of User ID for Privilege Escalation
- CVE-2025-48769Apache NuttX RTOS: fs/vfs/fs_rename: use after free
- CVE-2025-48768Apache NuttX RTOS: fs/inode: fs_inoderemove root inode removal