Apache CVEs
3,085 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-56180Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
- CVE-2024-52577Apache Ignite: Possible RCE when deserializing incoming messages by the server node
- CVE-2024-46910Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user
- CVE-2024-32838Apache Fineract: SQL injection vulnerabilities in offices API endpoint
- CVE-2025-25247Apache Felix Webconsole: XSS in services console
- CVE-2025-25069Apache Kvrocks: Cross-Protocol Scripting Vulnerability
- CVE-2022-31764Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC
- CVE-2024-37358Apache James: denial of service through the use of IMAP literals
- CVE-2024-45626Apache James: denial of service through JMAP HTML to text conversion
- CVE-2024-48019Apache Doris: allows admin users to read arbitrary files through the REST API
- CVE-2024-27137Apache Cassandra: unrestricted deserialization of JMX authentication credentials
- CVE-2025-24860Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions
- CVE-2025-23015Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
- CVE-2024-29869Apache Hive: Credentials file created with non restrictive permissions
- CVE-2024-23953Apache Hive: Timing Attack Against Signature in LLAP util
- CVE-2025-24783Apache Cocoon: continuations may not be private
- CVE-2025-24814Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
- CVE-2024-52012Apache Solr: Configset upload on Windows allows arbitrary path write-access
- CVE-2024-53299Apache Wicket: An attacker can intentionally trigger a memory leak
- CVE-2024-45479Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost
- CVE-2024-45478Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input
- CVE-2024-51941Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts
- CVE-2025-23196Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
- CVE-2025-23195Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie
- CVE-2025-23184Apache CXF: Denial of Service vulnerability with temporary files
- CVE-2024-45627Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability
- CVE-2025-22828Apache CloudStack: Unauthorised access to annotations
- CVE-2024-45033Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli
- CVE-2024-54676Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
- CVE-2024-56512Apache NiFi: Missing Complete Authorization for Parameter and Service References