Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-27906Apache Airflow: Dag Code and Import Error Permissions Ignored
- CVE-2024-23946Apache OFBiz: Path traversal or file inclusion
- CVE-2024-25065Apache OFBiz: Path traversal allowing authentication bypass.
- CVE-2024-23807Apache Xerces C++: Use-after-free on external DTD scan
- CVE-2024-26016Apache Superset: Improper authorization validation on dashboards and charts import
- CVE-2024-24779Apache Superset: Improper data authorization when creating a new dataset
- CVE-2024-24772Apache Superset: Improper Neutralisation of custom SQL on embedded context
- CVE-2024-24773Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
- CVE-2024-27315Apache Superset: Improper error handling on alerts
- CVE-2023-50380Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server
- CVE-2024-21742Apache James Mime4J: Mime4J DOM header injection
- CVE-2024-27905Apache Aurora: padding oracle can allow construction an authentication cookie
- CVE-2023-51747SMTP smuggling in Apache James
- CVE-2023-51518Apache James server: Privilege escalation via JMX pre-authentication deserialisation
- CVE-2023-50379Apache Ambari: authenticated users could perform command injection to perform RCE
- CVE-2024-22371Apache Camel issue on ExchangeCreatedEvent
- CVE-2024-23320Apache DolphinScheduler: Arbitrary js execution as root for authenticated users
- CVE-2024-22393Apache Answer: Pixel Flood Attack by uploading the large pixel file
- CVE-2024-23349Apache Answer: XSS vulnerability when submitting summary
- CVE-2024-26578Apache Answer: Repeated submission at registration created duplicate users with the same name
- CVE-2024-25141Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo
- CVE-2024-23114Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository
- CVE-2024-22369Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository
- CVE-2023-51770Apache DolphinScheduler: Arbitrary File Read Vulnerability
- CVE-2023-50270Apache DolphinScheduler: Session do not expire after password change
- CVE-2023-49250Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
- CVE-2023-49109Remote Code Execution in Apache Dolphinscheduler
- CVE-2024-25710Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2024-26308Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
- CVE-2024-23952Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)