Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-13936Velocity Sandbox Bypass
- CVE-2020-35451Oozie local privilege escalation
- CVE-2021-27907Apache Superset stored XSS on Dashboard markdown
- CVE-2020-1936Stored XSS in Apache Ambari
- CVE-2020-9479unzip directory traversal
- CVE-2021-25329Incomplete fix for CVE-2020-9484
- CVE-2021-25122Apache Tomcat h2c request mix-up
- CVE-2021-26544Apache Livy (Incubating) is vulnerable to cross site scripting
- CVE-2021-26296Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces
- CVE-2021-26697Apache Airflow: Lineage API endpoint for Experimental API missed authentication check
- CVE-2021-26559CWE-284 Improper Access Control on Configurations Endpoint for the Stable API
- CVE-2021-25646Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
- CVE-2021-26118Flaw in ActiveMQ Artemis OpenWire support
- CVE-2021-26117ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind
- CVE-2021-23901An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser
- CVE-2020-17532Apache ServiceComb Yaml remote deserialization vulnerability
- CVE-2021-24122Apache Tomcat information disclosure
- CVE-2021-23926XMLBeans XML Entity Expansion
- CVE-2020-13922Apache DolphinScheduler (incubating) Permission vulnerability
- CVE-2020-11995Apache Dubbo default deserialization protocol Hessian2 cause CRE
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST API
- CVE-2020-17518Apache Flink directory traversal attack: remote file writing through the REST API
- CVE-2020-17533Apache Accumulo Improper Handling of Insufficient Permissions
- CVE-2020-17526Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on si
- CVE-2020-17513In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
- CVE-2020-17511In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Air
- CVE-2020-17515The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.
- CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
- CVE-2020-17529Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header
- CVE-2020-17528Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length