Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-27181Apache Linkis Basic management services: Privilege Escalation Attack vulnerability
- CVE-2023-48396Apache SeaTunnel Web: Authentication bypass
- CVE-2023-38522Apache Traffic Server: Incomplete field name check allows request smuggling
- CVE-2024-35296Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests
- CVE-2024-35161Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling
- CVE-2024-25090Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode
- CVE-2023-48362Apache Drill: XXE Vulnerability in XML Format Reader
- CVE-2024-39676Apache Pinot: Unauthorized endpoint exposed sensitive information
- CVE-2024-41178Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files
- CVE-2024-29070Apache StreamPark: session not invalidated after logout
- CVE-2024-34457Apache StreamPark IDOR Vulnerability
- CVE-2024-38503Apache Syncope: HTML tags can be injected into Console or Enduser text fields
- CVE-2024-23321Apache RocketMQ: Unauthorized Exposure of Sensitive Data
- CVE-2024-41107Apache CloudStack: SAML Signature Exclusion
- CVE-2024-41172Apache CXF: Unrestricted memory consumption in CXF HTTP clients
- CVE-2024-32007Apache CXF Denial of Service vulnerability in JOSE
- CVE-2024-29736Apache CXF: SSRF vulnerability via WADL stylesheet parameter
- CVE-2024-29178Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- CVE-2024-40725Apache HTTP Server: source code disclosure with handlers configured via AddType
- CVE-2024-40898Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows
- CVE-2024-29120Apache StreamPark: Information leakage vulnerability
- CVE-2024-31411Apache StreamPipes: Potential remote code execution (RCE) via file upload
- CVE-2024-31979Apache StreamPipes: Possibility of SSRF in pipeline element installation process
- CVE-2024-30471Apache StreamPipes: Potential creation of multiple identical accounts
- CVE-2024-29737Apache StreamPark (incubating): maven build params could trigger remote command execution
- CVE-2023-52291Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
- CVE-2024-39877Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
- CVE-2024-39863Apache Airflow: Potential XSS Vulnerability
- CVE-2024-39887Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
- CVE-2023-52290Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability