Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-32113Apache OFBiz: Path traversal leading to RCE
- CVE-2024-28148Apache Superset: Incorrect datasource authorization on explore REST API
- CVE-2023-35701Apache Hive: Arbitrary command execution via JDBC driver
- CVE-2024-32638Apache APISIX: Forward-Auth Request Smuggling
- CVE-2024-32114Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
- CVE-2024-27349Apache HugeGraph-Server: Bypass whitelist in Auth mode
- CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlin
- CVE-2024-27347Apache HugeGraph-Hubble: SSRF in Hubble connection page
- CVE-2024-29733Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
- CVE-2024-29217Apache Answer: XSS vulnerability when changing personal website
- CVE-2024-31869Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
- CVE-2024-31391Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials
- CVE-2024-27309Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode
- CVE-2024-31309Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
- CVE-2024-31867Apache Zeppelin: LDAP search filter query Injection Vulnerability
- CVE-2024-31868Apache Zeppelin: XSS vulnerability in the helium module
- CVE-2024-31866Apache Zeppelin: Interpreter download command does not escape malicious code injection
- CVE-2024-31865Apache Zeppelin: Cron arbitrary user impersonation with improper privileges
- CVE-2024-31864Apache Zeppelin: Remote code execution by adding malicious JDBC connection string
- CVE-2024-31863Apache Zeppelin: Replacing other users notebook, bypassing any permissions
- CVE-2024-31862Apache Zeppelin: Denial of service with invalid notebook name
- CVE-2022-47894Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE
- CVE-2021-28656Apache Zeppelin: CSRF vulnerability in the Credentials page
- CVE-2024-31860Apache Zeppelin: Path traversal vulnerability
- CVE-2024-24746Apache NimBLE: Denial of service in NimBLE Bluetooth stack
- CVE-2024-27316Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
- CVE-2024-24795Apache HTTP Server: HTTP Response Splitting in multiple modules
- CVE-2023-38709Apache HTTP Server: HTTP response splitting
- CVE-2024-29008Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance
- CVE-2024-29007Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences