Apache - vulnerabilities (CVEs)
3499 CVEs in 469 products, 65 in the last 30 days, newest from 2026-10-26.
Products
- Http Server - 350 CVEs
- Tomcat - 274 CVEs
- Airflow - 159 CVEs
- Traffic Server - 121 CVEs
- Struts - 99 CVEs
- Camel - 87 CVEs
- Cxf - 80 CVEs
- Ofbiz - 76 CVEs
- Activemq - 75 CVEs
- Superset - 70 CVEs
- Cloudstack - 65 CVEs
- Openoffice - 60 CVEs
- Nifi - 59 CVEs
- Solr - 47 CVEs
- Subversion - 47 CVEs
- Inlong - 42 CVEs
- Hadoop - 37 CVEs
- Dolphinscheduler - 34 CVEs
- Wicket - 33 CVEs
- Thrift - 32 CVEs
- Ranger - 31 CVEs
- Apisix - 29 CVEs
- Jspwiki - 29 CVEs
- Openmeetings - 29 CVEs
- Tika - 27 CVEs
- Ambari - 26 CVEs
- Zeppelin - 26 CVEs
- Shiro - 25 CVEs
- Answer - 24 CVEs
- Kylin - 24 CVEs
- Syncope - 24 CVEs
- Fineract - 23 CVEs
- Geode - 23 CVEs
- Hive - 23 CVEs
- Spark - 23 CVEs
- Artemis - 22 CVEs
- Iotdb - 21 CVEs
- Qpid Broker-j - 21 CVEs
- Archiva - 20 CVEs
- Couchdb - 20 CVEs
- Log4j - 20 CVEs
- Pulsar - 20 CVEs
- Dubbo - 19 CVEs
- Cordova - 18 CVEs
- Karaf - 18 CVEs
- Linkis - 18 CVEs
- Kafka - 17 CVEs
- Streampark - 17 CVEs
- Cassandra - 16 CVEs
- Hertzbeat - 16 CVEs
- Qpid - 16 CVEs
- Zookeeper - 16 CVEs
- Activemq Broker - 15 CVEs
- Atlas - 15 CVEs
- Nimble - 15 CVEs
- James - 14 CVEs
- Jmeter - 14 CVEs
- Roller - 14 CVEs
- Storm - 14 CVEs
- Guacamole - 13 CVEs
- Spamassassin - 13 CVEs
- Allura - 12 CVEs
- Druid - 12 CVEs
- Impala - 12 CVEs
- Wss4j - 12 CVEs
- Apr-util - 11 CVEs
- Commons Compress - 11 CVEs
- Fory - 11 CVEs
- Neethi - 11 CVEs
- Ozone - 11 CVEs
- Tapestry - 11 CVEs
- Xerces-c++ - 11 CVEs
- Apache-airflow-providers-fab - 10 CVEs
- Batik - 10 CVEs
- Geronimo - 10 CVEs
- Httpclient - 10 CVEs
- Poi - 10 CVEs
- Tomee - 10 CVEs
- Ignite - 9 CVEs
- Log4net - 9 CVEs
- Mesos - 9 CVEs
- Nuttx - 9 CVEs
- Pdfbox - 9 CVEs
- Portable Runtime - 9 CVEs
- Shenyu - 9 CVEs
- Derby - 8 CVEs
- Jackrabbit - 8 CVEs
- Mina - 8 CVEs
- Opennlp - 8 CVEs
- Tomcat Native - 8 CVEs
- Traffic Control - 8 CVEs
- Avro - 7 CVEs
- Axis - 7 CVEs
- Bookkeeper - 7 CVEs
- Doris - 7 CVEs
- Mina Sshd - 7 CVEs
- Qpid Proton-j - 7 CVEs
- Streampipes - 7 CVEs
- Apache-airflow-providers-google - 6 CVEs
- Arrow - 6 CVEs
- Axis2 - 6 CVEs
- Brpc - 6 CVEs
- Commons Configuration - 6 CVEs
- Commons Fileupload - 6 CVEs
- Cxf Fediz - 6 CVEs
- Drill - 6 CVEs
- Hbase - 6 CVEs
- James Server - 6 CVEs
- Jena - 6 CVEs
- Jetspeed - 6 CVEs
- Juddi - 6 CVEs
- Mod Python - 6 CVEs
- Pluto - 6 CVEs
- Qpid Proton-dotnet - 6 CVEs
- Santuario Xml Security For Java - 6 CVEs
- Sling Xss Protection Api - 6 CVEs
- Xml Security For C++ - 6 CVEs
- Ant - 5 CVEs
- Apache-airflow-providers-apache-hive - 5 CVEs
- Apache Http Server - 5 CVEs
- Apache Tomcat - 5 CVEs
- Cocoon - 5 CVEs
- Myfaces - 5 CVEs
- Nutch - 5 CVEs
- Polaris - 5 CVEs
- Qpid Protonj2 - 5 CVEs
- Seata - 5 CVEs
- Sling - 5 CVEs
- Submarine - 5 CVEs
- Accumulo - 4 CVEs
- Activemq Web - 4 CVEs
- Any23 - 4 CVEs
- Apache-airflow-providers-amazon - 4 CVEs
- Apache Ofbiz - 4 CVEs
- Apache Tika - 4 CVEs
- Flink - 4 CVEs
- Helix - 4 CVEs
- Hugegraph - 4 CVEs
- Ivy - 4 CVEs
- Kvrocks - 4 CVEs
- Kyuubi - 4 CVEs
- Log4cxx - 4 CVEs
- Lucene.net - 4 CVEs
- Mod Fcgid - 4 CVEs
- Netbeans - 4 CVEs
- Olingo - 4 CVEs
- Oozie - 4 CVEs
- Openoffice.org - 4 CVEs
- Pinot - 4 CVEs
- Pony Mail - 4 CVEs
- Rocketmq - 4 CVEs
- Skywalking - 4 CVEs
- Sling Cms - 4 CVEs
- Sshd - 4 CVEs
- Activemq All - 3 CVEs
- Apache-airflow-providers-apache-drill - 3 CVEs
- Apache-airflow-providers-apache-spark - 3 CVEs
- Apache-airflow-providers-cncf-kubernetes - 3 CVEs
- Apache-airflow-providers-keycloak - 3 CVEs
- Brooklyn - 3 CVEs
- Calcite - 3 CVEs
- Commons Beanutils - 3 CVEs
- Directory Ldap Api - 3 CVEs
- Doris Mcp Server - 3 CVEs
- Eventmesh - 3 CVEs
- Flume - 3 CVEs
- Gravitino - 3 CVEs
- Groovy - 3 CVEs
- Heron - 3 CVEs
- Libapreq2 - 3 CVEs
- Libcloud - 3 CVEs
- Livy - 3 CVEs
- Lucy - 3 CVEs
- Mod Perl - 3 CVEs
- Seatunnel - 3 CVEs
- Servicecomb - 3 CVEs
- Shardingsphere - 3 CVEs
- Tomcat Connectors - 3 CVEs
- Tomcat Jk Connector - 3 CVEs
- Uimaj - 3 CVEs
- Unomi - 3 CVEs
- Vcl - 3 CVEs
- Virtual Computing Lab - 3 CVEs
- Xerces2 Java - 3 CVEs
- Xmlschema - 3 CVEs
- Apache-airflow-providers-ftp - 2 CVEs
- Apache-airflow-providers-mysql - 2 CVEs
- Apache-airflow-providers-odbc - 2 CVEs
- Apache-airflow-providers-snowflake - 2 CVEs
- Apache-airflow-providers-teradata - 2 CVEs
- Apache Archiva - 2 CVEs
- Apache Camel - 2 CVEs
- Apache Cxf - 2 CVEs
- Apache Fineract - 2 CVEs
- Apache Jspwiki - 2 CVEs
- Apache Solr - 2 CVEs
- Apache Spamassassin - 2 CVEs
- Apache Tapestry - 2 CVEs
- Apache Thrift - 2 CVEs
- Apisix Dashboard - 2 CVEs
- Aurora - 2 CVEs
- Beam - 2 CVEs
- Cayenne - 2 CVEs
- Chainsaw - 2 CVEs
- Commons Email - 2 CVEs
- Commons Imaging - 2 CVEs
- Commons Io - 2 CVEs
- Commons Jxpath - 2 CVEs
- Commons Vfs - 2 CVEs
- Continuum - 2 CVEs
- Cordova File Transfer - 2 CVEs
- Cordova Inappbrowser - 2 CVEs
- Deltaspike - 2 CVEs
- Directory Studio - 2 CVEs
- Formatting Objects Processor - 2 CVEs
- Gobblin - 2 CVEs
- Httpcomponents Core - 2 CVEs
- Hugegraph-server - 2 CVEs
- Isis - 2 CVEs
- Jena Fuseki - 2 CVEs
- Knox - 2 CVEs
- Maven - 2 CVEs
- Mod Jk - 2 CVEs
- Mxnet - 2 CVEs
- Nifi Minifi C++ - 2 CVEs
- Nifi Registry - 2 CVEs
- Openwhisk - 2 CVEs
- Orc - 2 CVEs
- Org.apache.sling.servlets.post - 2 CVEs
- Parquet - 2 CVEs
- Parquet Java - 2 CVEs
- Portable Runtime Utility - 2 CVEs
- Qpid-cpp - 2 CVEs
- Qpid Proton - 2 CVEs
- Sentry - 2 CVEs
- Shardingsphere Elasticjob-ui - 2 CVEs
- Shindig - 2 CVEs
- Skywalking Mcp - 2 CVEs
- Sling Api - 2 CVEs
- Sling Security - 2 CVEs
- Sling Servlets Post - 2 CVEs
- Soap - 2 CVEs
- Tiles - 2 CVEs
- Tomcat Jk Web Server Connector - 2 CVEs
- Uimaducc - 2 CVEs
- Ws-xmlrpc - 2 CVEs
- Xalan-java - 2 CVEs
- Xerces-j - 2 CVEs
- Xml-rpc - 2 CVEs
- Xml Graphics Batik - 2 CVEs
- Activemq-artemis - 1 CVEs
- Activemq Amqp - 1 CVEs
- Activemq Apollo - 1 CVEs
- Activemq Legacy Openwire Module - 1 CVEs
- Activemq Nms Amqp - 1 CVEs
- Activemq Nms Openwire - 1 CVEs
- Age - 1 CVEs
- Airavata Django Portal - 1 CVEs
- Airflow Celery Provider - 1 CVEs
- Airflow Cncf Kubernetes - 1 CVEs
- Airflow Common Sql Provider - 1 CVEs
- Airflow Hdfs Provider - 1 CVEs
- Airflow Hive Provider - 1 CVEs
- Airflow Mongo Provider - 1 CVEs
- Airflow Providers Databricks - 1 CVEs
- Airflow Providers Http - 1 CVEs
- Airflow Spark Provider - 1 CVEs
- Airflow Sqoop Provider - 1 CVEs
- Amqp 0-x Jms Client - 1 CVEs
- Apache-airflow-providers-akeyless - 1 CVEs
- Apache-airflow-providers-apache-kafka - 1 CVEs
- Apache-airflow-providers-apache-pig - 1 CVEs
- Apache-airflow-providers-apache-pinot - 1 CVEs
- Apache-airflow-providers-apache-sqoop - 1 CVEs
- Apache-airflow-providers-apache-yandex - 1 CVEs
- Apache-airflow-providers-docker - 1 CVEs
- Apache-airflow-providers-edge3 - 1 CVEs
- Apache-airflow-providers-elasticsearch - 1 CVEs
- Apache-airflow-providers-git - 1 CVEs
- Apache-airflow-providers-imap - 1 CVEs
- Apache-airflow-providers-jdbc - 1 CVEs
- Apache-airflow-providers-microsoft-mssql - 1 CVEs
- Apache-airflow-providers-mongo - 1 CVEs
- Apache-airflow-providers-opensearch - 1 CVEs
- Apache-airflow-providers-samba - 1 CVEs
- Apache-airflow-providers-sftp - 1 CVEs
- Apache-airflow-providers-smtp - 1 CVEs
- Apache Activemq - 1 CVEs
- Apache Axis2/c - 1 CVEs
- Apache Axis 1.4 - 1 CVEs
- Apache Calcite Avatica - 1 CVEs
- Apache Commons Beanutils - 1 CVEs
- Apache Commons Configuration - 1 CVEs
- Apache Commons Daemon - 1 CVEs
- Apache Druid - 1 CVEs
- Apache Dubbo - 1 CVEs
- Apache Hbase - 1 CVEs
- Apache Jclouds - 1 CVEs
- Apache Karaf - 1 CVEs
- Apache Kylin - 1 CVEs
- Apache Log4j - 1 CVEs
- Apache Mesos - 1 CVEs
- Apache Nifi Registry - 1 CVEs
- Apache Roller - 1 CVEs
- Apache Santuario - Xml Security For Java - 1 CVEs
- Apache Sling Engine - 1 CVEs
- Apache Spark - 1 CVEs
- Apache Uima Ducc - 1 CVEs
- Apache Webserver - 1 CVEs
- Apache Xml-rpc - 1 CVEs
- Asterixdb - 1 CVEs
- Ats - 1 CVEs
- Axis2/java - 1 CVEs
- Causeway - 1 CVEs
- Commons-httpclient - 1 CVEs
- Commons Bcel - 1 CVEs
- Commons Collections - 1 CVEs
- Commons Jelly - 1 CVEs
- Commons Lang - 1 CVEs
- Commons Net - 1 CVEs
- Commons Ognl - 1 CVEs
- Commons Text - 1 CVEs
- Cordova In-app-browser - 1 CVEs
- Ddlutils - 1 CVEs
- Echarts - 1 CVEs
- Eventmesh-connector-rabbitmq - 1 CVEs
- Felix Health Check Webconsole Plugin - 1 CVEs
- Felix Http Webconsole Plugin - 1 CVEs
- Felix Webconsole - 1 CVEs
- Fesod - 1 CVEs
- Flex - 1 CVEs
- Flex Blazeds - 1 CVEs
- Flink Cdc - 1 CVEs
- Flink Kubernetes Operator - 1 CVEs
- Flink Stateful Functions - 1 CVEs
- Fluss - 1 CVEs
- Fortress - 1 CVEs
- Freemarker - 1 CVEs
- Groovy Ldap - 1 CVEs
- Hama - 1 CVEs
- Harmony - 1 CVEs
- Hop Engine - 1 CVEs
- Html/java Api - 1 CVEs
- Http Server2.0a1 - 1 CVEs
- Http Server2.0a2 - 1 CVEs
- Http Server2.0a3 - 1 CVEs
- Http Server2.0a4 - 1 CVEs
- Http Server2.0a5 - 1 CVEs
- Http Server2.0a6 - 1 CVEs
- Http Server2.0a7 - 1 CVEs
- Http Server2.0a8 - 1 CVEs
- Http Server2.0a9 - 1 CVEs
- Httpasyncclient - 1 CVEs
- Hugegraph-hubble - 1 CVEs
- Hupa - 1 CVEs
- Iotdb Web Workbench - 1 CVEs
- Iotdb Workbench - 1 CVEs
- Jackrabbit Oak - 1 CVEs
- Jakarta Slide - 1 CVEs
- James Mime4j - 1 CVEs
- Java Chassis - 1 CVEs
- Jclouds - 1 CVEs
- Jena Sdb - 1 CVEs
- Jms Client Amqp - 1 CVEs
- Johnzon - 1 CVEs
- Jserv - 1 CVEs
- Kafka Connect - 1 CVEs
- Karaf Cave - 1 CVEs
- Karaf Decanter - 1 CVEs
- Kerby Ldap Backend - 1 CVEs
- Kudu - 1 CVEs
- Ldap Studio - 1 CVEs
- Log4j 1 2 Api - 1 CVEs
- Log4j Api - 1 CVEs
- Log4j Layout Template Json - 1 CVEs
- Lucene - 1 CVEs
- Lucene Replicator - 1 CVEs
- Manifoldcf - 1 CVEs
- Maven Archetype - 1 CVEs
- Maven Shared Utils - 1 CVEs
- Mod-gnutls - 1 CVEs
- Mod Auth Radius - 1 CVEs
- Mod Dav Svn - 1 CVEs
- Mod Dontdothat - 1 CVEs
- Myfaces Tomahawk - 1 CVEs
- Myfaces Trinidad - 1 CVEs
- Ode - 1 CVEs
- Ofbiz-framework - 1 CVEs
- Openjpa - 1 CVEs
- Opentaps - 1 CVEs
- Pdfbox-examples - 1 CVEs
- Pekko Management - 1 CVEs
- Plc4x - 1 CVEs
- Portals Jetspeed - 1 CVEs
- Pulsar Manager - 1 CVEs
- Pyarrow - 1 CVEs
- Qpid Dispatch - 1 CVEs
- Rampart/c - 1 CVEs
- Rave - 1 CVEs
- Rust Sgx Sdk - 1 CVEs
- Shardingsphere-ui - 1 CVEs
- Skywalking Nodejs Agent - 1 CVEs
- Sling Auth Core Component - 1 CVEs
- Sling Authentication Service - 1 CVEs
- Sling Commons Json - 1 CVEs
- Sling Commons Log - 1 CVEs
- Sling Commons Messaging Mail - 1 CVEs
- Sling I18n - 1 CVEs
- Sling Jcr Base - 1 CVEs
- Sling Jcr Contentloader - 1 CVEs
- Sling Resource Merger - 1 CVEs
- Sling Servlets Resolver - 1 CVEs
- Sling Xss Protection Api Compat - 1 CVEs
- Solr Operator - 1 CVEs
- Spatial Information System - 1 CVEs
- Sshj - 1 CVEs
- Standard Taglibs - 1 CVEs
- Storm Prometheus Reporter - 1 CVEs
- Struts2-showcase - 1 CVEs
- Struts Extras - 1 CVEs
- Synapse - 1 CVEs
- Systemds - 1 CVEs
- Teaclave Sgx Sdk - 1 CVEs
- Uima-as - 1 CVEs
- Uimafit - 1 CVEs
- Uniffle - 1 CVEs
- Unstructured Information Management Architecture - 1 CVEs
- Velocity Engine - 1 CVEs
- Velocity Tools - 1 CVEs
- Wink - 1 CVEs
- Xerces-c - 1 CVEs
- Xml Graphics Fop - 1 CVEs
- Xmlbeans - 1 CVEs
- Xmlgraphics Commons - 1 CVEs
- Activemq Artemis - 0 CVEs
- Airflow Providers Amazon - 0 CVEs
- Airflow Providers Fab - 0 CVEs
- Amqp Jms Client - 0 CVEs
- Apache - 0 CVEs
- Apache-ssl - 0 CVEs
- Apache Test - 0 CVEs
- Commons-compress - 0 CVEs
- Commons-jelly - 0 CVEs
- Commons Messaging Mail - 0 CVEs
- Coyote Http Connector - 0 CVEs
- Felix Health Checks - 0 CVEs
- Iceberg - 0 CVEs
- Incubator Superset - 0 CVEs
- Jackrabbit Jcr Commons - 0 CVEs
- Jakarta Isapi Redirector - 0 CVEs
- Karaf Cellar - 0 CVEs
- Kerby - 0 CVEs
- Maven Wagon - 0 CVEs
- Mod Imap - 0 CVEs
- Mynewt - 0 CVEs
- Open For Business Project - 0 CVEs
- Open Office - 0 CVEs
- Orchestration Director Engine - 0 CVEs
- Parquet-mr - 0 CVEs
- Qpid Dispatch Firmware - 0 CVEs
- Qpid Java - 0 CVEs
- Sanselan - 0 CVEs
- Simple Object Access Protocol - 0 CVEs
- Tinkerpop - 0 CVEs
- Tuscany - 0 CVEs
- Unstructured Information Management Architecture Distributed Uima Cluster Computing - 0 CVEs
- Wagon-http - 0 CVEs
- Whisker - 0 CVEs
- Xml Security For Java - 0 CVEs
Newest CVEs of Apache
- CVE-2026-95664 - CVSS 5.4 (medium), 2026-10-26: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3…
- CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
- CVE-2026-108039 - CVSS 7.5 (high), 2026-10-09: By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could…
- CVE-2026-107938 - CVSS 9.1 (critical), 2026-10-09: In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate…
- CVE-2026-107937 - CVSS 7.5 (high), 2026-10-09: In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters)…
- CVE-2026-100227 - CVSS 7.5 (high), 2026-10-09: Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors…
- CVE-2026-97791 - CVSS 7.5 (high), 2026-10-09: In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was…
- CVE-2026-97468 - CVSS 9.1 (critical), 2026-10-09: Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java…
- CVE-2026-86463 - CVSS 7.5 (high), 2026-10-09: Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many…
- CVE-2026-79650 - CVSS 6.1 (medium), 2026-10-09: Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because…
- CVE-2026-78384 - CVSS 7.5 (high), 2026-10-09: CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on…
- CVE-2026-73179 - CVSS 8.1 (high), 2026-10-09: Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to…
- CVE-2026-71575 - CVSS 9.1 (critical), 2026-10-09: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted…
- CVE-2026-92415 - CVSS 6.9 (medium), 2026-10-07: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or…
- CVE-2026-92414 - CVSS 9.3 (critical), 2026-10-07: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any…
- CVE-2026-90466 - CVSS 6.5 (medium), 2026-10-07: Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path…
- CVE-2026-105244 - CVSS 5.3 (medium), 2026-10-06: Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was…
- CVE-2026-105243 - CVSS 5.3 (medium), 2026-10-06: Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event…
- CVE-2026-105242 - CVSS 5.3 (medium), 2026-10-06: Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers…
- CVE-2026-105241 - CVSS 5.3 (medium), 2026-10-06: Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as…
- CVE-2026-105240 - CVSS 5.3 (medium), 2026-10-06: Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content…
- CVE-2026-105239 - CVSS 5.3 (medium), 2026-10-06: Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the…
- CVE-2026-104714 - CVSS 8.8 (high), 2026-10-05: Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats…
- CVE-2026-104713 - CVSS 6.5 (medium), 2026-10-05: Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on…
- CVE-2026-104712 - CVSS 7.5 (high), 2026-10-05: Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal…
- CVE-2026-104711 - CVSS 9.8 (critical), 2026-10-05: Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the…
- CVE-2026-63686 - CVSS 7.5 (high), 2026-10-01: A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server…
- CVE-2026-93546 - CVSS 8.8 (high), 2026-10-01: Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and…
- CVE-2026-79768 - CVSS 5.3 (medium), 2026-10-01: Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir…
- CVE-2026-73637 - CVSS 7.3 (high), 2026-10-01: Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to…
