Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-38745Apache OpenOffice: Empty entry in Java class path
- CVE-2023-28708Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
- CVE-2023-26513Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS
- CVE-2023-25695Information disclosure in Apache Airflow
- CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
- CVE-2023-23638Apache Dubbo Deserialization Vulnerability Gadgets Bypass
- CVE-2023-27522Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
- CVE-2023-25690Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
- CVE-2023-25956Apache Airflow AWS Provider: Arbitrary file read via AWS provider
- CVE-2023-25696Apache Airflow Hive Provider Beeline RCE
- CVE-2023-25693Sqoop Apache Airflow Provider Remote Code Execution Vulnerability
- CVE-2023-25692Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service
- CVE-2023-25691Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution
- CVE-2023-25621Apache Sling does not allow to handle i18n content in a secure way
- CVE-2023-24998Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
- CVE-2023-25613LDAP Injection Vulnerability in Apache Kerby
- CVE-2022-42735Apache ShenYu Admin ultra vires
- CVE-2023-25141JNDI injection into Apache sling-org-apache-sling-jcr-base
- CVE-2023-22832Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes
- CVE-2023-25194Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect
- CVE-2022-45786Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection
- CVE-2023-22849Apache Sling App CMS: XSS in CMS Reference / UI Components
- CVE-2023-24997Apache InLong: Jdbc Connection Security Bypass
- CVE-2023-24977Apache InLong: Jdbc Connection causes arbitrary file reading in InLong
- CVE-2022-28331Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
- CVE-2022-25147Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
- CVE-2022-24963Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
- CVE-2022-44644Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability
- CVE-2022-44645Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability
- CVE-2023-24829Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench