Apache CVEs
3,067 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-54057Apache SkyWalking: Stored XSS vulnerability
- CVE-2025-59302Apache CloudStack: Potential remote code execution on Javascript engine defined rules
- CVE-2025-59454Apache CloudStack: Lack of user permission validation leading to data leak for few APIs
- CVE-2025-59390Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
- CVE-2025-62728Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs
- CVE-2025-65998Apache Syncope: Default AES key used for internal password encryption
- CVE-2025-64408Apache Causeway: Java deserialization vulnerability to authenticated attackers
- CVE-2025-61623Apache OFBiz: Reflected Cross-site Scripting
- CVE-2025-59118Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload
- CVE-2025-64407Apache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variables
- CVE-2025-64406Apache OpenOffice: Possible memory corruption during CSV import
- CVE-2025-64405Apache OpenOffice: Remote documents loaded without prompt via DDE function
- CVE-2025-64404Apache OpenOffice: Remote documents loaded without prompt via background and bullet images
- CVE-2025-64403Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc
- CVE-2025-64402Apache OpenOffice: Remote documents loaded without prompt via OLE objects
- CVE-2025-64401Apache OpenOffice: Remote documents loaded without prompt via IFrame
- CVE-2025-58337Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server
- CVE-2025-62232Apache APISIX: basic-auth logs plaintext credentials at info level
- CVE-2025-54941Apache Airflow: Command injection in "example_dag_decorator"
- CVE-2025-62402Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
- CVE-2025-62503Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)
- CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
- CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- CVE-2025-55754Apache Tomcat: console manipulation via escape sequences in log messages
- CVE-2025-58712Amq: privilege escalation via excessive /etc/passwd permissions
- CVE-2025-57738Apache Syncope: Remote Code Execution by delegated administrators
- CVE-2025-47410Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
- CVE-2025-61581Apache Traffic Control: ReDoS issue in Traffic Router configuration
- CVE-2025-54539Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data
- CVE-2025-55039Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks