Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1668

Browse all 1668 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CXFApache HadoopApache JSPWikiApache FineractApache GeodeApache PulsarApache DubboApache AmbariApache KylinApache HiveApache CamelApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2026-41635 Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE — Apache MINACWE-502 9.8 Critical2026-04-27
CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection — Apache Camel JMSCWE-178--2026-04-27
CVE-2026-40860 Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp — Apache CamelCWE-502--2026-04-27
CVE-2026-40048 Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager — Apache Camel PQCCWE-502--2026-04-27
CVE-2026-40473 Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP — Apache Camel MinaCWE-502--2026-04-27
CVE-2026-38743 Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities — Apache AirflowCWE-1220 4.3AIMediumAI2026-04-24
CVE-2026-40690 Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users — Apache AirflowCWE-1220 4.3AIMediumAI2026-04-24
CVE-2026-23902 Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. — Apache DolphinSchedulerCWE-863 8.8AIHighAI2026-04-24
CVE-2025-62233 Apache DolphinScheduler: Deserialization of untrusted data in RPC — Apache DolphinSchedulerCWE-502 8.8AIHighAI2026-04-24
CVE-2026-41044 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia — Apache ActiveMQCWE-20 7.2AIHighAI2026-04-24
CVE-2026-41043 Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues — Apache ActiveMQCWE-79 5.4AIMediumAI2026-04-24
CVE-2026-40466 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI — Apache ActiveMQ BrokerCWE-20 8.8AIHighAI2026-04-24
CVE-2026-40542 Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification — Apache HttpClientCWE-304 9.1AICriticalAI2026-04-22
CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication — Apache KafkaCWE-1285 9.1AICriticalAI2026-04-20
CVE-2025-66335 Apache Doris MCP Server: MCP SQL inject — Apache Doris MCP ServerCWE-89 9.8AICriticalAI2026-04-20
CVE-2026-33558 Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output — Apache KafkaCWE-533 5.9AIMediumAI2026-04-20
CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager — Apache Airflow Providers KeycloakCWE-352 7.3AIHighAI2026-04-18
CVE-2026-32690 Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 — Apache AirflowCWE-668 7.5AIHighAI2026-04-18
CVE-2026-30898 Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf — Apache AirflowCWE-77 8.8AIHighAI2026-04-18
CVE-2026-30912 Apache Airflow: Exposing stack trace in case of constraint error — Apache AirflowCWE-668 7.5AIHighAI2026-04-18
CVE-2026-25917 Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) — Apache AirflowCWE-502 9.8AICriticalAI2026-04-18
CVE-2026-32228 Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to — Apache AirflowCWE-863 7.1AIHighAI2026-04-18
CVE-2026-31987 Apache Airflow: JWT token appearing in logs — Apache AirflowCWE-532 6.5AIMediumAI2026-04-16
CVE-2026-25219 Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access — Apache AirflowCWE-200 6.5 -2026-04-15
CVE-2026-30778 Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. — Apache SkyWalkingCWE-202 7.5 -2026-04-15
CVE-2025-54550 Apache Airflow: RCE by race condition in example_xcom dag — Apache AirflowCWE-94 8.8 -2026-04-15
CVE-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default — Apache APISIXCWE-319 7.5 -2026-04-14
CVE-2026-33929 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code — Apache PDFBox ExamplesCWE-22 7.5 -2026-04-14
CVE-2026-31924 Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP — Apache APISIXCWE-319 7.5 -2026-04-14
CVE-2026-31908 Apache APISIX: forward auth plugin allows header injection — Apache APISIXCWE-75 8.2 -2026-04-14

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.