Apache CVEs
3,085 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-53868Apache Traffic Server: Malformed chunked message body allows request smuggling
- CVE-2025-30676Apache OFBiz: Stored XSS Vulnerability
- CVE-2025-30177Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering
- CVE-2024-56325Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
- CVE-2025-29868Apache Answer: Using externally referenced images can leak user privacy.
- CVE-2025-30065Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
- CVE-2025-27427Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission
- CVE-2025-30067Apache Kylin: The remote code execution via jdbc url
- CVE-2024-48944Apache Kylin: SSRF vulnerability in the diagnosis api
- CVE-2024-53679Apache VCL: XSS vulnerability in User Lookup impacting user privileges
- CVE-2024-53678Apache VCL: SQL injection vulnerability in New Block Allocation form
- CVE-2025-27553Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT
- CVE-2025-30474Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message
- CVE-2025-26796Apache Oozie: XSS in Oozie Web Console
- CVE-2025-27888Apache Druid: Server-Side Request Forgery and Cross-Site Scripting
- CVE-2024-54016compression bomb attack in Apache Seata Server
- CVE-2024-47552Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server
- CVE-2025-27018Apache Airflow MySQL Provider: SQL injection in MySQL provider core function
- CVE-2025-27017Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record
- CVE-2025-27867Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin
- CVE-2025-29891Apache Camel: Camel Message Header Injection through request parameters
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
- CVE-2025-26865Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE
- CVE-2025-27636Apache Camel: Camel Message Header Injection via Improper Filtering
- CVE-2024-38311Apache Traffic Server: Request smuggling via pipelining after a chunked message body
- CVE-2024-56195Apache Traffic Server: Intercept plugins are not access controlled
- CVE-2024-56196Apache Traffic Server: ACL is not fully compatible with older versions
- CVE-2024-56202Apache Traffic Server: Expect header field can unreasonably retain resource
- CVE-2024-55532Apache Ranger: Improper Neutralization of Formula Elements in a CSV File
- CVE-2024-24778Apache StreamPipes: Resources Permission Escalation