Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-82704Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
- CVE-2026-82559Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
- CVE-2026-82558Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
- CVE-2026-82557Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission
- CVE-2026-82115Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource
- CVE-2026-120135Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
- CVE-2026-118636Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
- CVE-2026-73322Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
- CVE-2026-64618Apache Fineract: SQL injection vulnerability in Search API
- CVE-2026-65874Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
- CVE-2026-71569Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
- CVE-2026-115942Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
- CVE-2026-114230Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
- CVE-2026-105042Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
- CVE-2026-105031Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust…
- CVE-2026-114349Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
- CVE-2026-112375Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
- CVE-2026-116593Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
- CVE-2026-115644Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
- CVE-2026-111551Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
- CVE-2026-111496Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
- CVE-2026-111115Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
- CVE-2026-111108Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
- CVE-2026-111073Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of…
- CVE-2026-110985Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
- CVE-2026-110952Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
- CVE-2026-83525Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller…
- CVE-2026-111422Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
- CVE-2026-115748Apache Vysper: Authorization bypass
- CVE-2026-115721Apache Vysper: Unbounded allocation