Apache CVEs
3,067 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-48768Apache NuttX RTOS: fs/inode: fs_inoderemove root inode removal
- CVE-2025-66524Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor
- CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appender
- CVE-2025-67895Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2
- CVE-2025-66388Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI
- CVE-2025-53960Apache StreamPark: Uses the user’s password as the secret key
- CVE-2025-54947Apache StreamPark: Use hard-coded key vulnerability
- CVE-2025-54981Apache StreamPark: Weak Encryption Algorithm in StreamPark
- CVE-2025-26866Apache HugeGraph-Server: RAFT and deserialization vulnerability
- CVE-2025-58137Apache Fineract: IDOR via self-service API
- CVE-2025-58130Apache Fineract: Server Key not masked
- CVE-2025-23408Apache Fineract: weak password policy
- CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
- CVE-2025-58098Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
- CVE-2025-66200Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
- CVE-2025-65082Apache HTTP Server: CGI environment variable override
- CVE-2025-59775Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
- CVE-2025-55753Apache HTTP Server: mod_md (ACME), unintended retry intervals
- CVE-2025-66516Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected
- CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
- CVE-2025-59789Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser
- CVE-2025-59792Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins
- CVE-2025-59790Apache Kvrocks: RESET command grants admin privileges
- CVE-2025-54057Apache SkyWalking: Stored XSS vulnerability
- CVE-2025-59302Apache CloudStack: Potential remote code execution on Javascript engine defined rules
- CVE-2025-59454Apache CloudStack: Lack of user permission validation leading to data leak for few APIs
- CVE-2025-59390Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
- CVE-2025-62728Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs
- CVE-2025-65998Apache Syncope: Default AES key used for internal password encryption
- CVE-2025-64408Apache Causeway: Java deserialization vulnerability to authenticated attackers