Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-49566Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability
- CVE-2023-46801Apache Linkis DataSource: DataSource Remote code execution vulnerability
- CVE-2023-41916Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading
- CVE-2024-36522Apache Wicket: Remote code execution via XSLT injection
- CVE-2024-37389Apache NiFi: Improper Neutralization of Input in Parameter Context Description
- CVE-2024-38346Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- CVE-2024-39864Apache CloudStack: Integration API service uses dynamic port when disabled
- CVE-2024-39884Apache HTTP Server: source code disclosure with handlers configured via AddType
- CVE-2024-34750Apache Tomcat: HTTP/2 excess header handling DoS
- CVE-2024-39573Apache HTTP Server: mod_rewrite proxy handler substitution
- CVE-2024-38477Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request
- CVE-2024-38476Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
- CVE-2024-38474Apache HTTP Server weakness with encoded question marks in backreferences
- CVE-2024-38473Apache HTTP Server proxy encoding problem
- CVE-2024-38472Apache HTTP Server on WIndows UNC SSRF
- CVE-2024-36387Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
- CVE-2024-29868Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
- CVE-2024-27136Apache JSPWiki: Cross-site scripting vulnerability on upload page
- CVE-2024-38379Apache Allura: Stored authenticated XSS
- CVE-2024-34693Apache Superset: Server arbitrary file read
- CVE-2024-25142Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache
- CVE-2024-36265Apache Submarine Server Core: authorization bypass
- CVE-2024-36264Apache Submarine Commons Utils: default secret
- CVE-2024-36263Apache Submarine Server Core: SQL injection
- CVE-2024-36471Apache Allura: sensitive information exposure via DNS rebinding
- CVE-2024-36104Apache OFBiz: Path traversal leading to a RCE
- CVE-2024-32077Apache Airflow: XSS vulnerability in Task Instance Log/Log Details
- CVE-2024-34365Apache Karaf Cave: Cave SSRF and arbitrary file access
- CVE-2024-26579Apache Inlong JDBC Vulnerability