Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-40604Format String Vulnerability
- CVE-2022-40955Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC
- CVE-2022-34917Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers
- CVE-2022-39135Apache Calcite: potential XEE attacks
- CVE-2022-28220STARTTLS command injection in Apache JAMES
- CVE-2022-38370No authorization of DatabaseConnectController in grafana-connector.
- CVE-2022-38369Login check vulnerability by session Id
- CVE-2022-38170Overly permissive umask for daemons
- CVE-2022-38054Session Fixation
- CVE-2022-29158Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz
- CVE-2022-29063Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz
- CVE-2022-25813Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz
- CVE-2022-25371Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz
- CVE-2022-25370Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz
- CVE-2022-37435Apache ShenYu Admin Improper Privilege Management
- CVE-2022-37023Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11
- CVE-2022-37022Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11
- CVE-2022-37021Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.
- CVE-2022-22728libapreq2 multipart form parse memory corruption
- CVE-2021-25642Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler
- CVE-2022-35278HTML Injection in ActiveMQ Artemis Web Console
- CVE-2022-34916Improper Input Validation (JNDI Injection) in JMSMessageConsumer
- CVE-2022-38362Docker Provider <3.0 RCE vulnerability in example dag
- CVE-2022-37401Apache OpenOffice Weak Master Keys
- CVE-2022-37400Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password
- CVE-2022-31779Improper HTTP/2 scheme and method validation
- CVE-2022-25763Improper input validation on HTTP/2 headers
- CVE-2022-31780HTTP/2 framing vulnerabilities
- CVE-2022-31778Transfer-Encoding not treated as hop-by-hop
- CVE-2022-28129Insufficient Validation of HTTP/1.x Headers