Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-23945Apache ShenYu missing authentication allows gateway registration
- CVE-2022-23944Apache ShenYu 2.4.1 Improper access control
- CVE-2022-23223Apache ShenYu Password leakage
- CVE-2021-45029Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
- CVE-2022-23437Infinite loop within Apache XercesJ xml parser
- CVE-2022-22733Access-Token in ElasticJob UI causes password disclosure
- CVE-2021-45230Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver
- CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
- CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V1
- CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
- CVE-2021-42357DOM based XSS Vulnerability in Apache Knox
- CVE-2021-43999Improper validation of SAML responses
- CVE-2021-41767Private tunnel identifier may be included in the non-private details of active connections
- CVE-2021-43297Dubbo Hessian cause RCE when parse error
- CVE-2021-43045Possible DOS vulnerabilities in C# Avro SDK
- CVE-2021-45458Hardcoded credentials
- CVE-2021-45457Overly broad CORS configuration
- CVE-2021-45456Command injection
- CVE-2021-36774Mysql JDBC Connector Deserialize RCE
- CVE-2021-31522Apache Kylin unsafe class loading
- CVE-2021-27738Improper Access Control to Streaming Coordinator & SSRF
- CVE-2021-36739XSS vulnerability in the MVCBean JSP portlet maven archetype
- CVE-2021-36738XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet
- CVE-2021-36737XSS in V3 Demo Portlet
- CVE-2021-40525Sieve file storage vulnerable to path traversal attacks
- CVE-2021-40111Apache James IMAP parsing Denial Of Service
- CVE-2021-40110Apache James IMAP vulnerable to a ReDoS
- CVE-2021-38542Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
- CVE-2021-34797Apache Geode project log file redaction of sensitive information vulnerability
- CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration