Apache CVEs
3,088 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-46589Apache Tomcat: HTTP request smuggling via malformed trailer headers
- CVE-2022-41678Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE
- CVE-2023-49145Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt
- CVE-2023-43701Apache Superset: Stored XSS on API endpoint
- CVE-2023-42501Apache Superset: Unnecessary read permissions within the Gamma role
- CVE-2023-40610Apache Superset: Privilege escalation with default examples database
- CVE-2023-49068Apache DolphinScheduler: Information Leakage Vulnerability
- CVE-2023-48796Apache dolphinscheduler sensitive information disclosure
- CVE-2023-43123Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files
- CVE-2023-37924Apache Submarine: SQL injection from unauthorized login
- CVE-2022-46337Apache Derby: LDAP injection vulnerability in authenticator
- CVE-2023-46302Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization
- CVE-2023-26031Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems
- CVE-2023-42781Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
- CVE-2023-47037Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)
- CVE-2023-47248PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
- CVE-2023-39913Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats
- CVE-2023-46819Apache OFBiz: Execution of Solr plugin queries without authentication
- CVE-2023-46851Apache Allura: sensitive information exposure via import
- CVE-2023-46215Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
- CVE-2023-46288Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is set
- CVE-2023-31122Apache HTTP Server: mod_macro buffer over-read
- CVE-2023-43622Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
- CVE-2023-45802Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST
- CVE-2023-44483Apache Santuario: Private Key disclosure in debug-log output
- CVE-2023-46227Apache inlong has an Arbitrary File Read Vulnerability
- CVE-2023-25753Server-Side Request Forgery in Apache ShenYu
- CVE-2023-39456Apache Traffic Server: Malformed http/2 frames can cause an abort
- CVE-2023-41752Apache Traffic Server: s3_auth plugin problem with hash calculation