Apache CVEs
3,088 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-43666Apache InLong: General user Unauthorized access User Management
- CVE-2023-43667Apache InLong: Log Injection in Global functions
- CVE-2023-43668Apache InLong: Jdbc Connection Security Bypass in InLong
- CVE-2023-45757Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability
- CVE-2023-42663Apache Airflow: Bypass permission verification to view task instances of other dags
- CVE-2023-42792Apache Airflow: Improper access control to DAG resources
- CVE-2023-45348Apache Airflow: Configuration information leakage vulnerability
- CVE-2023-42780Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature
- CVE-2023-44981Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication
- CVE-2023-45648Apache Tomcat: Trailer header parsing too lenient
- CVE-2023-42795Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests
- CVE-2023-42794Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows
- CVE-2023-39410Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK
- CVE-2023-41834Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences
- CVE-2023-41267Apache HDFS Provider error message suggested installation of incorrect pip package
- CVE-2023-42503Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file
- CVE-2023-41081Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
- CVE-2023-40712Apache Airflow: Secrets can be unmasked in the "Rendered Template"
- CVE-2023-40611Apache Airflow Dag Runs Broken Access Control Vulnerability
- CVE-2023-32672Apache Superset: SQL parser edge case bypasses data access authorization
- CVE-2023-37941Apache Superset: Metadata db write access can lead to remote code execution
- CVE-2023-39265Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
- CVE-2023-39264Apache Superset: Stack traces enabled by default
- CVE-2023-27523Apache Superset: Improper data permission validation on Jinja templated queries
- CVE-2023-36388Apache Superset: Improper API permission for low privilege users allows for SSRF
- CVE-2023-27526Apache Superset: Improper Authorization check on import charts
- CVE-2023-36387Apache Superset: Improper API permission for low privilege users
- CVE-2023-40743Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
- CVE-2023-41180Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++
- CVE-2023-40195Apache Airflow Spark Provider Deserialization Vulnerability RCE