Apache Software Foundation - vulnerabilities (CVEs)
2766 CVEs in 449 products, 377 in the last 30 days, newest from 2026-10-28.
Products
- Apache Airflow - 152 CVEs
- Apache Tomcat - 141 CVEs
- Apache Http Server - 138 CVEs
- Apache Traffic Server - 111 CVEs
- Apache Camel - 96 CVEs
- Apache Thrift - 89 CVEs
- Apache Superset - 65 CVEs
- Apache Cxf - 56 CVEs
- Apache Cloudstack - 51 CVEs
- Apache Ofbiz - 51 CVEs
- Apache Nifi - 47 CVEs
- Apache Dolphinscheduler - 46 CVEs
- Apache Brpc - 41 CVEs
- Apache Inlong - 41 CVEs
- Apache Kylin - 40 CVEs
- Apache Syncope - 40 CVEs
- Apache Answer - 37 CVEs
- Apache Activemq - 35 CVEs
- Apache Apisix - 34 CVEs
- Apache Struts - 33 CVEs
- Apache Pulsar - 30 CVEs
- Apache Iotdb - 28 CVEs
- Apache Openoffice - 27 CVEs
- Apache Zeppelin - 25 CVEs
- Apache Roller - 24 CVEs
- Apache Solr - 24 CVEs
- Apache Kafka - 23 CVEs
- Apache Openmeetings - 23 CVEs
- Apache Ranger - 23 CVEs
- Apache Jspwiki - 22 CVEs
- Apache Wicket - 21 CVEs
- Apache Activemq All - 20 CVEs
- Apache Fineract - 20 CVEs
- Apache Qpid Broker-j - 19 CVEs
- Apache Allura - 18 CVEs
- Apache Geode - 18 CVEs
- Apache Hadoop - 18 CVEs
- Apache Hive - 18 CVEs
- Apache Mina Sshd - 17 CVEs
- Apache Shiro - 17 CVEs
- Apache Ambari - 16 CVEs
- Apache Couchdb - 16 CVEs
- Apache Dubbo - 16 CVEs
- Apache Spark - 16 CVEs
- Apache Activemq Artemis - 15 CVEs
- Apache Activemq Broker - 15 CVEs
- Apache Karaf - 15 CVEs
- Apache Tika - 15 CVEs
- Apache Zookeeper - 14 CVEs
- Apache Impala - 13 CVEs
- Apache Atlas - 12 CVEs
- Apache Druid - 11 CVEs
- Apache Fory - 11 CVEs
- Apache Neethi - 11 CVEs
- Apache Nimble - 11 CVEs
- Apache Ozone - 11 CVEs
- Apache Cassandra - 10 CVEs
- Apache Commons Compress - 10 CVEs
- Apache Doris - 10 CVEs
- Apache Mina - 10 CVEs
- Apache Airflow Fab Provider - 9 CVEs
- Apache Artemis - 9 CVEs
- Apache Kvrocks - 9 CVEs
- Apache Streampark - 9 CVEs
- Apache Archiva - 8 CVEs
- Apache Guacamole - 8 CVEs
- Apache Linkis - 8 CVEs
- Apache Streampark Incubating - 8 CVEs
- Apache Subversion - 8 CVEs
- Apache Tomcat Native - 8 CVEs
- Apache Cocoon - 7 CVEs
- Apache Directory Ldap Api - 7 CVEs
- Apache James - 7 CVEs
- Apache Opennlp - 7 CVEs
- Apache Qpid Proton-j - 7 CVEs
- Apache Sling - 7 CVEs
- Apache Storm - 7 CVEs
- Apache Storm Nimbus - 7 CVEs
- Apache Streampipes - 7 CVEs
- Apache Wss4j - 7 CVEs
- Apache Airflow Google Provider - 6 CVEs
- Apache Hertzbeat - 6 CVEs
- Apache James Server - 6 CVEs
- Apache Jena - 6 CVEs
- Apache Log4net - 6 CVEs
- Apache Pdfbox - 6 CVEs
- Apache Polaris - 6 CVEs
- Apache Qpid Proton Dotnet - 6 CVEs
- Apache Spamassassin - 6 CVEs
- Apache Tapestry - 6 CVEs
- Apache Traffic Control - 6 CVEs
- Apache Commons Configuration - 5 CVEs
- Apache Datasketches - 5 CVEs
- Apache Ignite - 5 CVEs
- Apache Mesos - 5 CVEs
- Apache Plc4x - 5 CVEs
- Apache Portable Runtime Utility - 5 CVEs
- Apache Qpid Protonj2 - 5 CVEs
- Apache Shenyu Incubating - 5 CVEs
- Apache Sling Xss - 5 CVEs
- Apache Storm Client - 5 CVEs
- Apache Xml Graphics - 5 CVEs
- Apache Activemq Client - 4 CVEs
- Apache Airflow Hive Provider - 4 CVEs
- Apache Airflow Keycloak Provider - 4 CVEs
- Apache Airflow Spark Provider - 4 CVEs
- Apache Any23 - 4 CVEs
- Apache Avro - 4 CVEs
- Apache Camel K - 4 CVEs
- Apache Cxf Fediz - 4 CVEs
- Apache Gravitino - 4 CVEs
- Apache Hugegraph-server - 4 CVEs
- Apache Iotdb Workbench - 4 CVEs
- Apache Ivy - 4 CVEs
- Apache Kyuubi - 4 CVEs
- Apache Linkis Datasource - 4 CVEs
- Apache Log4j 1.x - 4 CVEs
- Apache Mynewt Nimble - 4 CVEs
- Apache Nutch - 4 CVEs
- Apache Nuttx Rtos - 4 CVEs
- Apache Oozie - 4 CVEs
- Apache Pinot - 4 CVEs
- Apache Portable Runtime Apr - 4 CVEs
- Apache Portals - 4 CVEs
- Apache Seata Incubating - 4 CVEs
- Apache Skywalking - 4 CVEs
- Apache Tomcat Connectors - 4 CVEs
- Apache Accumulo - 3 CVEs
- Apache Activemq Web - 3 CVEs
- Apache Airflow Amazon Provider - 3 CVEs
- Apache Airflow Cncf Kubernetes Provider - 3 CVEs
- Apache Airflow Sftp Provider - 3 CVEs
- Apache Ant - 3 CVEs
- Apache Arrow - 3 CVEs
- Apache Avro Java Sdk - 3 CVEs
- Apache Axis - 3 CVEs
- Apache Brooklyn - 3 CVEs
- Apache Commons Bcel - 3 CVEs
- Apache Derby - 3 CVEs
- Apache Flink - 3 CVEs
- Apache Flume - 3 CVEs
- Apache Jackrabbit - 3 CVEs
- Apache Jmeter - 3 CVEs
- Apache Juddi - 3 CVEs
- Apache Kafka Clients - 3 CVEs
- Apache Log4cxx - 3 CVEs
- Apache Log4j - 3 CVEs
- Apache Log4j2 - 3 CVEs
- Apache Lucene.net - 3 CVEs
- Apache Lucy - 3 CVEs
- Apache Poi - 3 CVEs
- Apache Rocketmq - 3 CVEs
- Apache Shenyu - 3 CVEs
- Apache Sis - 3 CVEs
- Apache Sling App Cms - 3 CVEs
- Apache Storm Ui - 3 CVEs
- Apache Xmlschema - 3 CVEs
- Apache Yunikorn - 3 CVEs
- Ibm Cloudant - 3 CVEs
- Apache Activemq Stomp - 2 CVEs
- Apache Airflow Apache Hive Provider - 2 CVEs
- Apache Airflow Drill Provider - 2 CVEs
- Apache Airflow Ftp Provider - 2 CVEs
- Apache Airflow Mysql Provider - 2 CVEs
- Apache Airflow Odbc Provider - 2 CVEs
- Apache Airflow Sqoop Provider - 2 CVEs
- Apache Airflow Ssh Provider - 2 CVEs
- Apache Airflow Teradata Provider - 2 CVEs
- Apache Apisix Dashboard - 2 CVEs
- Apache Batik - 2 CVEs
- Apache Calcite - 2 CVEs
- Apache Calcite Avatica - 2 CVEs
- Apache Camel Jira - 2 CVEs
- Apache Camel Karavan - 2 CVEs
- Apache Cayenne - 2 CVEs
- Apache Commons Email - 2 CVEs
- Apache Commons Fileupload - 2 CVEs
- Apache Commons Io - 2 CVEs
- Apache Commons Vfs - 2 CVEs
- Apache Cordova Android - 2 CVEs
- Apache Doris Mcp Server - 2 CVEs
- Apache Drill - 2 CVEs
- Apache Fesod Incubating - 2 CVEs
- Apache Gobblin - 2 CVEs
- Apache Hbase - 2 CVEs
- Apache Helix - 2 CVEs
- Apache Hertzbeat Incubating - 2 CVEs
- Apache Httpcomponents Client - 2 CVEs
- Apache Httpcomponents Core - 2 CVEs
- Apache Iotdb Jdbc Driver - 2 CVEs
- Apache Isis - 2 CVEs
- Apache James Mime4j - 2 CVEs
- Apache Jena Fuseki - 2 CVEs
- Apache Johnzon - 2 CVEs
- Apache Kerby - 2 CVEs
- Apache Knox - 2 CVEs
- Apache Linkis Basic Management Services - 2 CVEs
- Apache Linkis Incubating - 2 CVEs
- Apache Livy - 2 CVEs
- Apache Maven - 2 CVEs
- Apache Mxnet - 2 CVEs
- Apache Myfaces - 2 CVEs
- Apache Nifi Registry - 2 CVEs
- Apache Nuttx Incubating - 2 CVEs
- Apache Orc - 2 CVEs
- Apache Parquet Java - 2 CVEs
- Apache Pdfbox Examples - 2 CVEs
- Apache Pluto - 2 CVEs
- Apache Portable Runtime - 2 CVEs
- Apache Santuario - 2 CVEs
- Apache Seatunnel Web - 2 CVEs
- Apache Servicecomb Service-center - 2 CVEs
- Apache Shardingsphere Elasticjob-ui - 2 CVEs
- Apache Skywalking Mcp - 2 CVEs
- Apache Sling Security Bundle - 2 CVEs
- Apache Soap - 2 CVEs
- Apache Storm Worker Launcher - 2 CVEs
- Apache Submarine - 2 CVEs
- Apache Submarine Server Core - 2 CVEs
- Apache Tika Pdf Parser Module - 2 CVEs
- Apache Uima - 2 CVEs
- Apache Unomi - 2 CVEs
- Apache Vcl - 2 CVEs
- Apache Vysper - 2 CVEs
- Apache Xerces C - 2 CVEs
- Apache Xml Graphics Batik - 2 CVEs
- Pyarrow - 2 CVEs
- Apache APISIX - 1 CVEs
- Apache Abdera - 1 CVEs
- Apache Activemq All Module - 1 CVEs
- Apache Activemq Amqp - 1 CVEs
- Apache Activemq Artemis Stomp Protocol - 1 CVEs
- Apache Activemq Legacy Openwire Module - 1 CVEs
- Apache Activemq Mqtt - 1 CVEs
- Apache Activemq Mqtt Module - 1 CVEs
- Apache Activemq Nms Amqp Client - 1 CVEs
- Apache Activemq Nms Openwire Client - 1 CVEs
- Apache Activemq Web Console - 1 CVEs
- Apache Age - 1 CVEs
- Apache Airavata Django Portal - 1 CVEs
- Apache Airflow Akeyless Provider - 1 CVEs
- Apache Airflow Apache Kafka Provider - 1 CVEs
- Apache Airflow Aws Provider - 1 CVEs
- Apache Airflow Celery Provider - 1 CVEs
- Apache Airflow Common Sql Provider - 1 CVEs
- Apache Airflow Git Provider - 1 CVEs
- Apache Airflow Hashicorp Provider - 1 CVEs
- Apache Airflow Hdfs Provider - 1 CVEs
- Apache Airflow Imap Provider - 1 CVEs
- Apache Airflow Jdbc Provider - 1 CVEs
- Apache Airflow Microsoft Azure Provider - 1 CVEs
- Apache Airflow Mongo Provider - 1 CVEs
- Apache Airflow Mssql Provider - 1 CVEs
- Apache Airflow Pinot Provider - 1 CVEs
- Apache Airflow Provider For Databricks - 1 CVEs
- Apache Airflow Providers Amazon - 1 CVEs
- Apache Airflow Providers Edge3 - 1 CVEs
- Apache Airflow Providers Elasticsearch - 1 CVEs
- Apache Airflow Providers Fab - 1 CVEs
- Apache Airflow Providers Http - 1 CVEs
- Apache Airflow Providers Keycloak - 1 CVEs
- Apache Airflow Providers Opensearch - 1 CVEs
- Apache Airflow Providers Smtp - 1 CVEs
- Apache Airflow Providers Snowflake - 1 CVEs
- Apache Airflow Samba Provider - 1 CVEs
- Apache Airflow Smtp Provider - 1 CVEs
- Apache Airflow Snowflake Provider - 1 CVEs
- Apache Airflow Yandex Provider - 1 CVEs
- Apache Airlfow Pig Provider - 1 CVEs
- Apache Apisix Java Plugin Runner - 1 CVEs
- Apache Arrow C - 1 CVEs
- Apache Arrow R Package - 1 CVEs
- Apache Arrow Rust Object Store - 1 CVEs
- Apache Artemis Stomp Protocol - 1 CVEs
- Apache Asterixdb - 1 CVEs
- Apache Aurora - 1 CVEs
- Apache Axis2java - 1 CVEs
- Apache Bookkeeper - 1 CVEs
- Apache Buildstream - 1 CVEs
- Apache Camel Atmosphere Websocket - 1 CVEs
- Apache Camel Aws2 Sns - 1 CVEs
- Apache Camel Coap - 1 CVEs
- Apache Camel Dapr - 1 CVEs
- Apache Camel Dns - 1 CVEs
- Apache Camel Google Pubsub - 1 CVEs
- Apache Camel Iggy - 1 CVEs
- Apache Camel Jms - 1 CVEs
- Apache Camel Keycloak - 1 CVEs
- Apache Camel Leveldb - 1 CVEs
- Apache Camel Lucene - 1 CVEs
- Apache Camel Mail - 1 CVEs
- Apache Camel Mina - 1 CVEs
- Apache Camel Neo4j - 1 CVEs
- Apache Camel Platform Http Main - 1 CVEs
- Apache Camel Pqc - 1 CVEs
- Apache Camel Quarkus - 1 CVEs
- Apache Camel Salesforce - 1 CVEs
- Apache Camel Undertow - 1 CVEs
- Apache Camel Vertx Websocket - 1 CVEs
- Apache Causeway - 1 CVEs
- Apache Chainsaw - 1 CVEs
- Apache Cloudstack Quota Plugin - 1 CVEs
- Apache Commons Beanutils 1.x - 1 CVEs
- Apache Commons Beanutils 2.x - 1 CVEs
- Apache Commons Jelly - 1 CVEs
- Apache Commons Lang - 1 CVEs
- Apache Commons Net - 1 CVEs
- Apache Commons Ognl - 1 CVEs
- Apache Commons Text - 1 CVEs
- Apache Continuum - 1 CVEs
- Apache Db Ddlutils - 1 CVEs
- Apache Deltaspike - 1 CVEs
- Apache Directory - 1 CVEs
- Apache Directory Studio - 1 CVEs
- Apache Doris-mcp-server - 1 CVEs
- Apache Dorisincubating - 1 CVEs
- Apache Echarts - 1 CVEs
- Apache Eventmesh - 1 CVEs
- Apache Eventmesh Incubating Rabbitmq Connector - 1 CVEs
- Apache Eventmesh Runtime - 1 CVEs
- Apache Felix Healthcheck Webconsole Plugin - 1 CVEs
- Apache Felix Http Webconsole Plugin - 1 CVEs
- Apache Felix Webconsole - 1 CVEs
- Apache Flex Blaze Ds - 1 CVEs
- Apache Flink Cdc - 1 CVEs
- Apache Flink Kubernetes Operator - 1 CVEs
- Apache Flink Stateful Functions - 1 CVEs
- Apache Fluss Incubating - 1 CVEs
- Apache Fop - 1 CVEs
- Apache Freemarker - 1 CVEs
- Apache Griffin Hive Metastore Module - 1 CVEs
- Apache Groovy - 1 CVEs
- Apache Hama - 1 CVEs
- Apache Helix Front/ui/ - 1 CVEs
- Apache Helix Front Ui - 1 CVEs
- Apache Helix Rest - 1 CVEs
- Apache Heron Incubating - 1 CVEs
- Apache Hop Engine - 1 CVEs
- Apache Httpclient - 1 CVEs
- Apache Httpcomponents - 1 CVEs
- Apache Hugegraph-hubble - 1 CVEs
- Apache Hupa - 1 CVEs
- Apache Inlong Tubemq Client - 1 CVEs
- Apache Iotdb C Client - 1 CVEs
- Apache Jackrabbit Core - 1 CVEs
- Apache Jackrabbit Jcr Commons - 1 CVEs
- Apache Jackrabbit Oak - 1 CVEs
- Apache Jackrabbit Standalone Jackrabbit-standalone And Jackrabbit-standalone-components - 1 CVEs
- Apache Jackrabbit Webapp Jackrabbit-webapp - 1 CVEs
- Apache Jena Sdb - 1 CVEs
- Apache Kafka Client - 1 CVEs
- Apache Kafka Connect Api - 1 CVEs
- Apache Karaf Cave - 1 CVEs
- Apache Kerby Ldap Backend - 1 CVEs
- Apache Linkis Metadata Query Service Jdbc - 1 CVEs
- Apache Linkis Spark Engineconn - 1 CVEs
- Apache Livy Incubating - 1 CVEs
- Apache Log4cxx Brew - 1 CVEs
- Apache Log4cxx Conan - 1 CVEs
- Apache Lucene.net.replicator - 1 CVEs
- Apache Lucene Replicator - 1 CVEs
- Apache Manifoldcf - 1 CVEs
- Apache Myfaces Core - 1 CVEs
- Apache Netbeans - 1 CVEs
- Apache Nifi - Minifi C - 1 CVEs
- Apache Nifi Minifi C - 1 CVEs
- Apache Nuttx - 1 CVEs
- Apache Nuttx Rtos Toolsbdf-converter. - 1 CVEs
- Apache Ode - 1 CVEs
- Apache Olingo - 1 CVEs
- Apache Opennlp Core Ml Libsvm - 1 CVEs
- Apache Parquet - 1 CVEs
- Apache Parquet Hadoop - 1 CVEs
- Apache Pekko Management - 1 CVEs
- Apache Pony Mail - 1 CVEs
- Apache Portable Runtime Utility Apr-util - 1 CVEs
- Apache Pulsar Broker - 1 CVEs
- Apache Pulsar Function Worker - 1 CVEs
- Apache Pulsar Io Kafka Connect Adaptor - 1 CVEs
- Apache Pulsar Io Kafka Connector - 1 CVEs
- Apache Pulsar Manager - 1 CVEs
- Apache Pulsar Websocket Proxy - 1 CVEs
- Apache Qpid Dispatch Router - 1 CVEs
- Apache Qpid Proton - 1 CVEs
- Apache Ranger Hive Plugin - 1 CVEs
- Apache Seata - 1 CVEs
- Apache Seatunnel - 1 CVEs
- Apache Sentry - 1 CVEs
- Apache Servicecomb - 1 CVEs
- Apache Servicecomb-java-chassis - 1 CVEs
- Apache Shardingsphere-proxy - 1 CVEs
- Apache Shardingsphere-ui - 1 CVEs
- Apache Shardingsphereincubator - 1 CVEs
- Apache Shenyu Admin - 1 CVEs
- Apache Shindig Common - 1 CVEs
- Apache Shindig Social-api - 1 CVEs
- Apache Shiro Jakarta Ee Module - 1 CVEs
- Apache Skywalking Banyandb - 1 CVEs
- Apache Skywalking Nodejs Agent - 1 CVEs
- Apache Sling Commons Messaging Mail - 1 CVEs
- Apache Sling Engine - 1 CVEs
- Apache Sling Jcr Base - 1 CVEs
- Apache Sling Resource Merger - 1 CVEs
- Apache Sling Servlets Resolver - 1 CVEs
- Apache Solr Operator - 1 CVEs
- Apache Storm Drpc - 1 CVEs
- Apache Storm Logviewer - 1 CVEs
- Apache Storm Prometheus Reporter - 1 CVEs
- Apache Storm Webapp - 1 CVEs
- Apache Storm Worker - 1 CVEs
- Apache Struts Extras - 1 CVEs
- Apache Submarine Commons Utils - 1 CVEs
- Apache Synapse - 1 CVEs
- Apache Systemds - 1 CVEs
- Apache Tika Core - 1 CVEs
- Apache Tika Parsers - 1 CVEs
- Apache Tiles - 1 CVEs
- Apache Tomee - 1 CVEs
- Apache Uima Ducc - 1 CVEs
- Apache Uima Java Sdk Core - 1 CVEs
- Apache Uima Java Sdk Cpe - 1 CVEs
- Apache Uima Java Sdk Tools - 1 CVEs
- Apache Uima Java Sdk Vinci Adapter - 1 CVEs
- Apache Uniffle - 1 CVEs
- Apache Velocity Engine - 1 CVEs
- Apache Velocity Tools - 1 CVEs
- Apache Xalan-j - 1 CVEs
- Apache Xerces - 1 CVEs
- Apache Xerces-c - 1 CVEs
- Apache Xml Graphics Fop - 1 CVEs
- Apache Xmlbeans - 1 CVEs
- Apache Zeppelin Sap - 1 CVEs
- Cordova Plugin Inappbrowser - 1 CVEs
- Docker Skeleton Runtime For Apache Openwhisk - 1 CVEs
- Hdfs Native Client - 1 CVEs
- Impala - 1 CVEs
- Juddi - 1 CVEs
- Karaf - 1 CVEs
- Libapreq2 - 1 CVEs
- Log4j - 1 CVEs
- Maven Archetype Plugin - 1 CVEs
- Org.apache.sling.commons.json - 1 CVEs
- Php Runtime For Apache Openwhisk - 1 CVEs
- Poi-scratchpad - 1 CVEs
- Pony Mail - 1 CVEs
- Shardingsphere-agent - 1 CVEs
- Wicket-jquery-ui - 1 CVEs
- Wicket Jquery Ui - 1 CVEs
- Tomcat - 0 CVEs
Newest CVEs of Apache Software Foundation
- CVE-2026-114349, 2026-10-28: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that…
- CVE-2026-112375, 2026-10-28: An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the…
- CVE-2026-116593, 2026-10-28: Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka…
- CVE-2026-115644, 2026-10-28: Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener…
- CVE-2026-111551, 2026-10-28: Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no…
- CVE-2026-111496, 2026-10-28: Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp +…
- CVE-2026-111115, 2026-10-28: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for…
- CVE-2026-111108, 2026-10-28: Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only…
- CVE-2026-111073, 2026-10-28: The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before…
- CVE-2026-110985, 2026-10-28: A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation…
- CVE-2026-110952, 2026-10-28: A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further…
- CVE-2026-83525, 2026-10-28: Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an…
- CVE-2026-111422, 2026-10-26: In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are…
- CVE-2026-115748 - CVSS 8.8 (high), 2026-10-26: **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band…
- CVE-2026-115721 - CVSS 7.5 (high), 2026-10-26: **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects…
- CVE-2026-90885 - CVSS 7.5 (high), 2026-10-26: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before…
- CVE-2026-94386 - CVSS 4.8 (medium), 2026-10-26: Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component. This issue affects Apache Camel: from 4.19.0 before 4.22.2.…
- CVE-2026-110748, 2026-10-26: This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless…
- CVE-2026-110733 - CVSS 5.4 (medium), 2026-10-26: Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier…
- CVE-2026-95628 - CVSS 5.4 (medium), 2026-10-26: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache…
- CVE-2026-95629 - CVSS 5.4 (medium), 2026-10-26: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache…
- CVE-2026-95663 - CVSS 4.8 (medium), 2026-10-26: Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0…
- CVE-2026-95664 - CVSS 5.4 (medium), 2026-10-26: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3…
- CVE-2026-101259 - CVSS 5.3 (medium), 2026-10-26: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before…
- CVE-2026-113582 - CVSS 8.7 (high), 2026-10-22: UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make…
- CVE-2026-103634 - CVSS 5.3 (medium), 2026-10-22: Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did…
- CVE-2026-112381 - CVSS 8.2 (high), 2026-10-21: Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is…
- CVE-2026-111817 - CVSS 6.9 (medium), 2026-10-21: Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the…
- CVE-2026-111812 - CVSS 10 (critical), 2026-10-21: Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This…
- CVE-2026-111811 - CVSS 9.4 (critical), 2026-10-21: Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects…
