Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-32531Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification
- CVE-2022-34271Apache Atlas: zip path traversal in import functionality
- CVE-2022-46364Apache CXF SSRF Vulnerability
- CVE-2022-46363Apache CXF directory listing / code exfiltration
- CVE-2022-45910Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities
- CVE-2021-37533Apache Commons Net's FTP client trusts the host from PASV response by default
- CVE-2022-46366Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
- CVE-2022-44635Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal
- CVE-2022-26885Apache DolphinScheduler config file read by task risk
- CVE-2022-45462Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability
- CVE-2022-41131Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)
- CVE-2022-40954Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files
- CVE-2022-40189Apache Airlfow Pig Provider RCE
- CVE-2022-38649Apache Airflow Pinot provider allowed Command Injection
- CVE-2022-45470Apache Hama allows XSS and information disclosure
- CVE-2022-45047Apache MINA SSHD: Java unsafe deserialization vulnerability
- CVE-2022-45402Apache Airflow: Open redirect during login
- CVE-2022-40309Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories
- CVE-2022-40308Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files
- CVE-2022-45378Apache SOAP allows unauthenticated users to potentially invoke arbitrary code
- CVE-2022-45136Apache Jena SDB allows arbitrary deserialisation via JDBC
- CVE-2022-40127Apache Airflow <2.4.0 has an RCE in a bash example
- CVE-2022-27949Apache Airflow prior to 2.3.1 may include sensitive values in rendered template
- CVE-2022-42920Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
- CVE-2022-37866Apache Ivy allows path traversal in the presence of a malicious repository
- CVE-2022-37865Apache Ivy allows creating/overwriting any file on the system
- CVE-2022-33684Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation
- CVE-2022-32287Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives
- CVE-2022-43985Apache Airflow prior to 2.4.2 has an open redirect
- CVE-2022-43982Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL