Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-45802Apache StreamPark (incubating): Upload any file to any directory
- CVE-2023-22665Apache Jena: Exposure of arbitrary execution in script engine expressions.
- CVE-2023-30776Apache Superset: Database connection password leak
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
- CVE-2023-25601Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication
- CVE-2023-25504Apache Superset: Possible SSRF on import datasets
- CVE-2023-27525Apache Superset: Incorrect default permissions for Gamma role
- CVE-2023-22946Apache Spark proxy-user privilege escalation from malicious configuration class
- CVE-2023-30771Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench
- CVE-2023-24831Apache IoTDB grafana-connector Login Bypass Vulnerability
- CVE-2022-47501Apache OFBiz: Arbitrary file reading vulnerability
- CVE-2022-45064Apache Sling Engine: Include-based XSS
- CVE-2023-30465Apache InLong: SQL injection in apache inLong 1.5.0
- CVE-2023-29216Apache Linkis DatasourceManager module has a deserialization command execution
- CVE-2023-27987Apache Linkis gateway module token authentication bypass
- CVE-2023-27603Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue
- CVE-2023-27602Apache Linkis publicsercice module unrestricted upload of file
- CVE-2023-29215Apache Linkis JDBC EngineCon has a deserialization command execution
- CVE-2023-28710Apache Airflow Spark Provider Arbitrary File Read via JDBC
- CVE-2023-28706Apache Airflow Hive Provider Beeline Remote Command Execution
- CVE-2023-28707Airflow Apache Drill Provider Arbitrary File Read Vulnerability
- CVE-2023-26269Apache James server: Privilege escalation through unauthenticated JMX
- CVE-2023-28935Apache UIMA DUCC: DUCC (EOL) allows RCE
- CVE-2023-28158Apache Archiva privilege escalation
- CVE-2023-28326Apache OpenMeetings: allows user impersonation
- CVE-2023-25197apache fineract: SQL injection vulnerability in certain procedure calls
- CVE-2023-25196Apache Fineract: SQL injection vulnerability
- CVE-2023-25195Apache Fineract: SSRF template type vulnerability in certain authenticated users
- CVE-2023-27296Apache InLong: JDBC Deserialization Vulnerability in InLong
- CVE-2022-47502Apache OpenOffice: Macro URL arbitrary script execution