Apache CVEs
3,067 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-27818Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
- CVE-2025-27531Apache InLong: An arbitrary file read vulnerability for JDBC
- CVE-2025-46548Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effective
- CVE-2025-48912Apache Superset: Improper authorization bypass on row level security via SQL Injection
- CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scripts
- CVE-2025-48734Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
- CVE-2025-27528Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read
- CVE-2025-27526Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass
- CVE-2025-27522Apache InLong: JDBC Vulnerability during verification processing
- CVE-2025-35003Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.
- CVE-2025-47436Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression
- CVE-2025-26864Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication
- CVE-2025-26795Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver
- CVE-2024-24780Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
- CVE-2025-27696Apache Superset: Incorrect authorization leading to resource ownership takeover
- CVE-2025-46392Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x
- CVE-2025-27533Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
- CVE-2025-46762Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata
- CVE-2025-31651Apache Tomcat: Bypass of rules in Rewrite Valve
- CVE-2025-31650Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
- CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypass
- CVE-2025-26413Apache Kvrocks: The server was crashed by the negative offset
- CVE-2025-29953Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass
- CVE-2024-56736Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss
- CVE-2025-24859Apache Roller: Insufficient Session Expiration on Password Change
- CVE-2025-27391Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log
- CVE-2025-31672Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names
- CVE-2025-30677Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors
- CVE-2025-30473Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection
- CVE-2024-53868Apache Traffic Server: Malformed chunked message body allows request smuggling