Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 2345

Browse all 2345 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Apache Software Foundation develops and maintains open-source software, primarily known for the widely deployed Apache HTTP Server and foundational Java frameworks. Its extensive portfolio exposes a significant attack surface, evidenced by the 1717 recorded CVEs. Historically, vulnerabilities frequently involve remote code execution, cross-site scripting, and privilege escalation, often stemming from complex configuration errors or input validation failures in legacy components. While the foundation enforces rigorous security review processes, the sheer volume of projects increases the likelihood of undiscovered flaws. Notable incidents include critical flaws in Log4j, which allowed remote code execution via crafted log messages, highlighting risks in dependency management. The organization relies on community-driven patching, requiring administrators to promptly apply updates to mitigate exploitation. This model ensures transparency but demands active vigilance from users to maintain system integrity against evolving threat vectors.

Found 41 results / 2345 Clear Filters
Top products by Apache Software Foundation: Apache Airflow Apache HTTP Server Apache Tomcat Apache Traffic Server Apache Superset Apache OFBiz Apache CloudStack Apache Camel Apache NiFi Apache CXF Apache InLong Apache Syncope Apache DolphinScheduler Apache Struts Apache Thrift Apache APISIX Apache OpenOffice Apache IoTDB Apache Zeppelin Apache Solr Apache Answer Apache OpenMeetings Apache Ranger Apache JSPWiki Apache Wicket Apache ActiveMQ Apache Fineract Apache Kylin Apache Hive Apache Hadoop
CVE ID Title CVSS Severity Published
CVE-2026-63046 Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials — Apache InLong CWE-88 - - 2026-08-21
CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection — Apache InLong CWE-918 - - 2026-08-20
CVE-2026-63043 Apache InLong: Agent path traversal via unvalidated file source path — Apache InLong CWE-23 - - 2026-08-20
CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints — Apache InLong CWE-552 - - 2026-08-20
CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete — Apache InLong CWE-552 - - 2026-08-20
CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService — Apache InLong CWE-89 - - 2026-08-20
CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report — Apache InLong CWE-89 - - 2026-08-20
CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint — Apache InLong CWE-89 - - 2026-08-20
CVE-2026-63016 Apache InLong: Ordinary users can create new packages — Apache InLong CWE-400 - - 2026-08-20
CVE-2026-63015 Apache InLong: Non-template responsible persons can view template information — Apache InLong CWE-400 - - 2026-08-20
CVE-2025-27531 Apache InLong: An arbitrary file read vulnerability for JDBC — Apache InLong CWE-502 6.5AI Medium AI 2025-06-06
CVE-2025-27528 Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read — Apache InLong CWE-502 7.5AI High AI 2025-05-28
CVE-2025-27526 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass — Apache InLong CWE-502 9.8AI Critical AI 2025-05-28
CVE-2025-27522 Apache InLong: JDBC Vulnerability during verification processing — Apache InLong CWE-502 8.1AI High AI 2025-05-28
CVE-2024-26579 Apache Inlong JDBC Vulnerability — Apache InLong CWE-502 9.8AI Critical AI 2024-05-08
CVE-2024-26580 Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability — Apache InLong CWE-502 9.1AI Critical AI 2024-03-06
CVE-2023-51784 Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager — Apache InLong CWE-94 9.8AI Critical AI 2024-01-03
CVE-2023-51785 Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager — Apache InLong CWE-502 7.5AI High AI 2024-01-03
CVE-2023-46227 Apache inlong has an Arbitrary File Read Vulnerability — Apache InLong CWE-502 9.8 - 2023-10-19
CVE-2023-43666 Apache InLong: General user Unauthorized access User Management — Apache InLong CWE-345 6.5 - 2023-10-16
CVE-2023-43667 Apache InLong: Log Injection in Global functions — Apache InLong CWE-74 5.3 - 2023-10-16
CVE-2023-43668 Apache InLong: Jdbc Connection Security Bypass in InLong — Apache InLong CWE-639 9.8 - 2023-10-16
CVE-2023-35088 Apache InLong: SQL injection in audit endpoint — Apache InLong CWE-89 9.8 - 2023-07-25
CVE-2023-34434 Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param — Apache InLong CWE-502 7.5 - 2023-07-25
CVE-2023-34189 Apache InLong: General user can delete and update process — Apache InLong CWE-668 9.1 - 2023-07-25
CVE-2023-31062 Apache InLong: Privilege escalation vulnerability for InLong — Apache InLong CWE-269 8.8 - 2023-05-22
CVE-2023-31064 Apache InLong: Insecurity direct object references cancelling applications — Apache InLong CWE-552 6.5 - 2023-05-22
CVE-2023-31065 Apache InLong: Insufficient Session Expiration in InLong — Apache InLong CWE-613 9.8 - 2023-05-22
CVE-2023-31066 Apache InLong: Insecure direct object references for inlong sources — Apache InLong CWE-552 8.1 - 2023-05-22
CVE-2023-31098 Apache InLong: Weak Password Implementation in InLong — Apache InLong CWE-521 7.4 - 2023-05-22

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.