Apache CVEs
3,067 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-54813Apache Log4cxx: Improper escaping with JSONLayout
- CVE-2024-48988Apache StreamPark: SQL injection vulnerability
- CVE-2025-54988Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
- CVE-2024-39954Apache EventMesh Runtime: SSRF
- CVE-2025-53192Apache Commons OGNL: Expression Injection leading to RCE
- CVE-2025-54466Apache OFBiz: RCE Vulnerability in scrum plugin
- CVE-2025-55675Apache Superset: Incorrect datasource authorization on REST API
- CVE-2025-55674Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
- CVE-2025-55672Apache Superset: Stored XSS on charts metadata
- CVE-2025-55673Apache Superset: Metadata exposure in embedded charts
- CVE-2025-54472Apache bRPC: Redis Parser Remote Denial of Service
- CVE-2025-55668Apache Tomcat: session fixation via rewrite valve
- CVE-2025-48989Apache Tomcat: h2 DoS - Made You Reset
- CVE-2025-53606Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server
- CVE-2025-48913Apache CXF: Untrusted JMS configuration can lead to RCE
- CVE-2024-51775Apache Zeppelin: Command Injection via CSWSH
- CVE-2024-41177Apache Zeppelin: XSS in the Helium module
- CVE-2024-52279Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
- CVE-2025-24854Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin
- CVE-2025-24853Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing
- CVE-2025-54656Apache Struts Extras: Improper Output Neutralization for Logs
- CVE-2025-54090Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
- CVE-2025-50151Apache Jena: Configuration files uploaded by administrative users are not check properly
- CVE-2025-49656Apache Jena: Administrative users can create files outside the server directory space via the admin UI
- CVE-2025-48795Apache CXF: Denial of Service and sensitive data exposure in logs
- CVE-2025-53689Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons
- CVE-2024-41169Apache Zeppelin: raft directory listing and file read
- CVE-2025-48924Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs
- CVE-2025-53506Apache Tomcat: DoS via excessive h2 streams at connection start
- CVE-2025-52520Apache Tomcat: DoS via integer overflow in multipart file upload