Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-25641Dubbo Zookeeper does not check serialization id
- CVE-2020-17514disabled hostname verificiation
- CVE-2021-22160Authentication with JWT allows use of “none”-algorithm
- CVE-2021-23937DNS proxy and possible amplification attack
- CVE-2021-31164Apache Unomi log injection
- CVE-2021-28359Apache Airflow Reflected XSS via Origin Query Argument in URL
- CVE-2021-30128Unsafe deserialization in Apache OFBiz
- CVE-2021-29200RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
- CVE-2021-30638An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later
- CVE-2021-28125Apache Superset Open Redirect
- CVE-2020-17517Ozone S3 Gateway allows bucket and key access to non authenticated users
- CVE-2021-26291block repositories using http by default
- CVE-2021-30245Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks
- CVE-2021-27850Bypass of the fix for CVE-2019-0195
- CVE-2021-29425Possible limited path traversal vulnerabily in Apache Commons IO
- CVE-2021-29943Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections
- CVE-2021-29262Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings
- CVE-2021-27905SSRF vulnerability with the Replication handler
- CVE-2021-22696OAuth 2 authorization service vulnerable to DDos attacks
- CVE-2021-28657Infinite loop in Apache Tika's MP3 parser
- CVE-2021-26919Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.
- CVE-2020-1946Apache SpamAssassin has an OS Command Injection vulnerability
- CVE-2021-26295RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
- CVE-2021-27906A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file
- CVE-2021-27807A carefully crafted PDF file can trigger an infinite loop while loading the file
- CVE-2020-17525Remote unauthenticated denial-of-service in Subversion mod_authz_svn
- CVE-2020-13924In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other direct
- CVE-2020-1926Timing attack in Cookie signature verification
- CVE-2021-27576Apache OpenMeetings: bandwidth can be overloaded with public web service
- CVE-2020-13959Velocity Tools XSS Vulnerability