Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-33234Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
- CVE-2023-30601Apache Cassandra: Privilege escalation when enabling FQL/Audit logs
- CVE-2022-46907Apache JSPWiki: XSS Injection points in several plugins
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
- CVE-2023-31062Apache InLong: Privilege escalation vulnerability for InLong
- CVE-2023-31064Apache InLong: Insecurity direct object references cancelling applications
- CVE-2023-31065Apache InLong: Insufficient Session Expiration in InLong
- CVE-2023-31066Apache InLong: Insecure direct object references for inlong sources
- CVE-2023-31098Apache InLong: Weak Password Implementation in InLong
- CVE-2023-31101Apache InLong: Users who joined later can see the data of deleted users
- CVE-2023-31103Apache InLong: Attackers can change the immutable name and type of cluster
- CVE-2023-31206Apache InLong: Attackers can change the immutable name and type of nodes
- CVE-2023-31453Apache InLong: IDOR make users can delete others' subscription
- CVE-2023-31454Apache InLong: IDOR make users can bind any cluster
- CVE-2023-31058Apache InLong: JDBC URL bypassing by adding blanks
- CVE-2023-28709Apache Tomcat: Fix for CVE-2023-24998 is incomplete
- CVE-2022-47937Multiple parsing problems in the Apache Sling Commons JSON module
- CVE-2023-28936Apache OpenMeetings: insufficient check of invitation hash
- CVE-2023-29032Apache OpenMeetings: allows bypass authentication
- CVE-2023-29246Apache OpenMeetings: allows null-byte Injection
- CVE-2023-25754Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-29247Stored XSS on Apache Airflow
- CVE-2023-31039Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution
- CVE-2023-31038Apache Log4cxx: SQL injection when using ODBC appender
- CVE-2021-40331Permissions problem in the Apache Ranger Hive Plugin
- CVE-2022-45048Apache Ranger: code execution vulnerability in policy expressions
- CVE-2023-26268Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes
- CVE-2023-32007Apache Spark: Shell command injection via Spark UI
- CVE-2022-46365Apache StreamPark (incubating): Logic error causing any account reset
- CVE-2022-45801Apache StreamPark (incubating): LDAP Injection Vulnerability