Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-100235Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
- CVE-2026-108500Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection
- CVE-2026-103582Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)
- CVE-2026-108946Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
- CVE-2026-111822Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
- CVE-2026-111821Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
- CVE-2026-108949Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
- CVE-2026-114442Apache HertzBeat: incomplete XPath expression validation in aliasFields
- CVE-2026-119641Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership
- CVE-2026-119724Apache JClouds: XML External Entity (XXE) in provider-response parsing
- CVE-2026-111959Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
- CVE-2026-114364Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
- CVE-2026-113687Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
- CVE-2026-113511Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
- CVE-2026-110535Apache Syncope: AuthProfile value escalation via self-service update
- CVE-2026-109083Apache Syncope: Remote Code Execution via Flowable JUEL expression
- CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
- CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
- CVE-2026-87718Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
- CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
- CVE-2026-84177Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore
- CVE-2026-84172Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
- CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
- CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
- CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
- CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
- CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
- CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
- CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
- CVE-2026-82705Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component