Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-23974Pinot segment push endpoint has a vulnerability in unprotected environments
- CVE-2022-25598Apache DolphinScheduler user registration is vulnerable to ReDoS attacks
- CVE-2022-25757Apache APISIX: the body_schema check in request-validation plugin can be bypassed
- CVE-2021-44759Improper authentication vulnerability in TLS origin verification
- CVE-2021-44040HTTP request line fuzzing attacks
- CVE-2022-26779Apache Cloudstack insecure random number generation affects project email invitation
- CVE-2022-23943mod_sed: Read/write beyond bounds
- CVE-2022-22721core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody
- CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
- CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebody
- CVE-2021-38296Apache Spark Key Negotiation Vulnerability
- CVE-2022-25312An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor
- CVE-2022-26336A carefully crafted TNEF file can cause an out of memory exception
- CVE-2022-24948Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen
- CVE-2022-24947Apache JSPWiki CSRF Account Takeover
- CVE-2022-24288Apache Airflow: RCE in example DAGs
- CVE-2021-45229Apache Airflow: Reflected XSS via Origin Query Argument in URL
- CVE-2022-24289Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions
- CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP header
- CVE-2021-44521Remote code execution for scripted UDFs
- CVE-2022-22931Path traversal in Apache James 3.6.1
- CVE-2022-23206Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
- CVE-2022-23913Apache ActiveMQ Artemis DoS
- CVE-2021-36152Insecure TrustManager used in LDAP connections
- CVE-2021-36151Local Credentials Disclosure Vulnerability
- CVE-2021-44451API sensitive information leak
- CVE-2021-41571Pulsar Admin API allows access to data from other tenants using getMessageById API
- CVE-2022-23181Local privilege escalation with FileStore
- CVE-2022-22932Path traversal flaws
- CVE-2021-41766Insecure Java Deserialization in Apache Karaf