Apache CVEs
3,067 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-62402Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API
- CVE-2025-62503Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)
- CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
- CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- CVE-2025-55754Apache Tomcat: console manipulation via escape sequences in log messages
- CVE-2025-58712Amq: privilege escalation via excessive /etc/passwd permissions
- CVE-2025-57738Apache Syncope: Remote Code Execution by delegated administrators
- CVE-2025-47410Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
- CVE-2025-61581Apache Traffic Control: ReDoS issue in Traffic Router configuration
- CVE-2025-54539Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data
- CVE-2025-55039Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks
- CVE-2024-44088Apache Geode: Reflected XSS
- CVE-2025-30001Apache StreamPark: Authenticated users can trigger remote command execution
- CVE-2025-62228Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers
- CVE-2025-61735Apache Kylin: Server-Side Request Forgery
- CVE-2025-61733Apache Kylin: Authentication bypass
- CVE-2025-61734Apache Kylin: improper restriction of file read
- CVE-2025-61622Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory
- CVE-2025-54831Apache Airflow: Connection sensitive details exposed to users with READ permissions
- CVE-2025-58457Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands
- CVE-2025-48392Apache IoTDB: DoS Vulnerability
- CVE-2025-48459Apache IoTDB: Deserialization of untrusted Data
- CVE-2025-59328Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data
- CVE-2025-48208Apache HertzBeat (incubating): Jmx JNDI injection vulnerability
- CVE-2025-24404Apache HertzBeat (incubating): RCE by parse http sitemap xml response
- CVE-2025-58782Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory
- CVE-2024-43166Incorrect Default Permissions vulnerability in Apache DolphinScheduler.
- CVE-2024-43115Apache DolphinScheduler: Alert Script Attack
- CVE-2025-26467Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
- CVE-2025-54812Apache Log4cxx: Improper HTML escaping in HTMLLayout