Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-114272Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure
- CVE-2026-114277Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
- CVE-2026-103866Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
- CVE-2026-103864Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
- CVE-2026-103863Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
- CVE-2026-121489Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
- CVE-2026-96677Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
- CVE-2026-73117Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data
- CVE-2026-73116Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
- CVE-2026-73101Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults
- CVE-2026-73100Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors
- CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override
- CVE-2026-73098Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
- CVE-2026-73095Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
- CVE-2026-59267Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption
- CVE-2026-90632Apache OpenOffice: Local file inclusion via GStreamer plugin
- CVE-2026-90634Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
- CVE-2026-90631Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
- CVE-2026-90629Apache OpenOffice: Out of bounds memory access during WMF import
- CVE-2026-90628Apache OpenOffice: Stack overflow in CFF hint handling
- CVE-2026-90627Apache OpenOffice: Local file inclusion via SQL provider and flat file database references
- CVE-2026-90626Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
- CVE-2026-90624Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
- CVE-2026-59268Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader
- CVE-2026-59264Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
- CVE-2026-59263Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported…
- CVE-2026-100302Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
- CVE-2026-115448Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
- CVE-2026-100300Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply…
- CVE-2026-100252Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID