Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-24830Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization
- CVE-2023-22884Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
- CVE-2022-37436Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
- CVE-2022-36760Apache HTTP Server: mod_proxy_ajp Possible request smuggling
- CVE-2006-20001Apache HTTP Server: mod_dav out of bounds read, or write of zero byte
- CVE-2022-41703Apache Superset: SQL injection vulnerability in adhoc clauses
- CVE-2022-45438Apache Superset: Dashboard metadata information leak
- CVE-2022-43721Apache Superset: Open Redirect Vulnerability
- CVE-2022-43720Apache Superset: Improper rendering of user input
- CVE-2022-43719Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
- CVE-2022-43718Apache Superset: Cross-Site Scripting vulnerability on upload forms
- CVE-2022-43717Apache Superset: Cross-Site Scripting on dashboards
- CVE-2023-22602Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request
- CVE-2022-46769Apache Sling App CMS: XSS in CMS Site Group Detail
- CVE-2022-45935Apache James server: Temporary File Information Disclosure
- CVE-2022-45787Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider
- CVE-2022-45875Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
- CVE-2022-45143Apache Tomcat: JsonErrorReportValve escaping
- CVE-2021-32824Regular expression Denial of Service in MooTools
- CVE-2022-44621Apache Kylin: Command injection by Diagnosis Controller
- CVE-2022-43396Apache Kylin: Command injection by Useless configuration
- CVE-2022-45347Apache ShardingSphere-Proxy: MySQL authentication bypass
- CVE-2022-40145Apache Karaf: JDBC JAAS LDAP injection
- CVE-2022-46421Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params
- CVE-2022-40743Apache Traffic Server: Security issues with the xdebug plugin
- CVE-2022-37392Apache Traffic Server: Improperly reading the client requests
- CVE-2022-32749Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins
- CVE-2022-47500Apache Helix: Open redirect
- CVE-2022-46870Apache Zeppelin: Stored XSS in note permissions
- CVE-2021-28655Apache Zeppelin: Arbitrary file deletion vulnerability