apache security advisories
60 threat alerts tracking vulnerabilities and security advisories that affect apache products.
Vulnios monitors apache CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent apache security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-53677 — apache — struts
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can
criticalCVE-2024-53677Critical Vulnerability: CVE-2024-36104 — apache — ofbiz
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to ver
criticalCVE-2024-36104Critical Vulnerability: CVE-2024-50379 — apache, netapp — tomcat, bootstrap_os
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (n
criticalCVE-2024-50379Critical Vulnerability: CVE-2026-78162 — apache — camel
Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a def
criticalCVE-2026-78162Critical Vulnerability: CVE-2026-64618 — apache — fineract
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPe
criticalCVE-2026-64618Critical Vulnerability: CVE-2026-42779 — apache — mina
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one
criticalCVE-2026-42779Critical Vulnerability: CVE-2026-42778 — apache — mina
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was inco
criticalCVE-2026-42778Critical Vulnerability: CVE-2026-41409 — apache — mina
The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in
criticalCVE-2026-41409Critical Vulnerability: CVE-2026-41635 — apache — mina
Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing
criticalCVE-2026-41635Critical Vulnerability: CVE-2026-41873 — apache — pony_mail
** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover. This issue affects all v
criticalCVE-2026-41873Critical Vulnerability: CVE-2026-25199 — apache — cloudstack
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmo
criticalCVE-2026-25199Critical Vulnerability: CVE-2026-42812 — apache — polaris
In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. `write.metadata.path` is an optional table p
criticalCVE-2026-42812Critical Vulnerability: CVE-2026-42809 — apache — polaris
Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary creden
criticalCVE-2026-42809Critical Vulnerability: CVE-2026-40010 — apache — wicket
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0
criticalCVE-2026-40010Critical Vulnerability: CVE-2026-42810 — apache — polaris
Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unes
criticalCVE-2026-42810Critical Vulnerability: CVE-2026-42811 — apache — polaris
In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across t
criticalCVE-2026-42811Critical Vulnerability: CVE-2026-50203 — apache — apache-airflow-providers-sftp
A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destina
criticalCVE-2026-50203Critical Vulnerability: CVE-2026-32967 — apache — dolphinscheduler
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to versio
criticalCVE-2026-32967Critical Vulnerability: CVE-2026-49268 — apache — shiro
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN tem
criticalCVE-2026-49268Critical Vulnerability: CVE-2026-32966 — apache — dolphinscheduler
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommen
criticalCVE-2026-32966Critical Vulnerability: CVE-2023-31039 — apache — brpc
Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can influence the ServerOptions pid_file paramete
criticalCVE-2023-31039Critical Vulnerability: CVE-2026-97468 — apache — cxf
Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cac
criticalCVE-2026-97468Critical Vulnerability: CVE-2026-31986 — apache — ofbiz
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
criticalCVE-2026-31986Critical Vulnerability: CVE-2026-45434 — apache — ofbiz
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgra
criticalCVE-2026-45434Critical Vulnerability: CVE-2026-41919 — apache — ofbiz
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade
criticalCVE-2026-41919Critical Vulnerability: CVE-2026-92414 — apache — jackrabbit
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/I
criticalCVE-2026-92414Critical Vulnerability: CVE-2025-54539 — apache — activemq_nms_amqp
A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishi
criticalCVE-2025-54539Critical Vulnerability: CVE-2025-61622 — apache — fory
Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulner
criticalCVE-2025-61622Critical Vulnerability: CVE-2025-55754 — apache — tomcat
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Wind
criticalCVE-2025-55754Critical Vulnerability: CVE-2025-54947 — apache — streampark
In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for e
criticalCVE-2025-54947Critical Vulnerability: CVE-2025-58130 — apache — fineract
Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1. Users are encouraged to upgrade to ve
criticalCVE-2025-58130Critical Vulnerability: CVE-2015-6420 — apache — commons_collections
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices
criticalCVE-2015-6420Critical Vulnerability: CVE-2025-57735 — apache — airflow
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanis
criticalCVE-2025-57735Critical Vulnerability: CVE-2025-68637 — apache — uniffle
The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle C
criticalCVE-2025-68637Critical Vulnerability: CVE-2026-86473 — apache — airflow
Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, th
criticalCVE-2026-86473Critical Vulnerability: CVE-2026-71290 — apache — httpclient
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient.
criticalCVE-2026-71290Critical Vulnerability: CVE-2026-82311 — apache — apache-airflow-providers-fab
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string ident
criticalCVE-2026-82311Critical Vulnerability: CVE-2026-86462 — apache — apache-airflow-providers-fab
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a co
criticalCVE-2026-86462Critical Vulnerability: CVE-2026-76187 — apache — apache-airflow-providers-keycloak
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for
criticalCVE-2026-76187Critical Vulnerability: CVE-2026-76186 — apache — apache-airflow-providers-keycloak
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for eve
criticalCVE-2026-76186Critical Vulnerability: CVE-2026-75156 — apache — apache-airflow-providers-fab
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is c
criticalCVE-2026-75156Critical Vulnerability: CVE-2026-59243 — apache — apache-airflow-providers-fab
The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callba
criticalCVE-2026-59243Critical Vulnerability: CVE-2026-82617 — apache — opennlp
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifier
criticalCVE-2026-82617Critical Vulnerability: CVE-2026-67593 — apache — artemis
A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any tim
criticalCVE-2026-67593Critical Vulnerability: CVE-2026-57967 — apache — artemis
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue af
criticalCVE-2026-57967Critical Vulnerability: CVE-2026-49364 — apache — artemis
An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: f
criticalCVE-2026-49364Critical Vulnerability: CVE-2026-80351 — apache — camel
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven confi
criticalCVE-2026-80351Critical Vulnerability: CVE-2026-80352 — apache — camel
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject a
criticalCVE-2026-80352Critical Vulnerability: CVE-2026-84939 — apache — freemarker
Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration
criticalCVE-2026-84939Critical Vulnerability: CVE-2026-56207 — apache — impala
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Imp
criticalCVE-2026-56207Critical Vulnerability: CVE-2026-41871 — apache — nutch
Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: fr
criticalCVE-2026-41871Critical Vulnerability: CVE-2026-41869 — apache — nutch
Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are
criticalCVE-2026-41869Critical Vulnerability: CVE-2026-42027 — apache — opennlp
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantia
criticalCVE-2026-42027Critical Vulnerability: CVE-2026-40860 — apache — camel
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() w
criticalCVE-2026-40860Critical Vulnerability: CVE-2026-61486 — apache — lucy
** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a ve
criticalCVE-2026-61486Critical Vulnerability: CVE-2026-61484 — apache — lucy
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to releas
criticalCVE-2026-61484Critical Vulnerability: CVE-2026-34884 — apache — skywalking_mcp
SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to ver
criticalCVE-2026-34884Critical Vulnerability: CVE-2026-40682 — apache — opennlp
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 Description: The DictionaryEntryPersistor c
criticalCVE-2026-40682Critical Vulnerability: CVE-2026-55976 — apache — hive
Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an
criticalCVE-2026-55976Critical Vulnerability: CVE-2026-65182 — apache — tomcat
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint
criticalCVE-2026-65182
Showing the 60 most recent. Older alerts are archived but still reachable via search and the main feed.
Track apache exposure across your environment
Vulnios automatically cross-references your asset inventory against new apache CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan