Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1676

Browse all 1676 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CamelApache CXFApache HadoopApache GeodeApache FineractApache JSPWikiApache KylinApache PulsarApache DubboApache AmbariApache HiveApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2024-23454 Apache Hadoop: Temporary File Local Information Disclosure — Apache HadoopCWE-378 5.5AIMediumAI2024-09-25
CVE-2024-40761 Apache Answer: Avatar URL leaked user email addresses — Apache AnswerCWE-326 7.5AIHighAI2024-09-25
CVE-2024-39928 Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability — Apache Linkis Spark EngineConnCWE-326 5.3AIMediumAI2024-09-24
CVE-2024-46544 Apache Tomcat Connectors: mod_jk: local users can view and modify configuration — Apache Tomcat ConnectorsCWE-276 7.8AIHighAI2024-09-23
CVE-2024-42323 Apache HertzBeat: RCE by snakeYaml deser load malicious xml — Apache HertzBeatCWE-502 8.8 -2024-09-21
CVE-2024-45537 Apache Druid: Users can provide MySQL JDBC properties not on allow list — Apache DruidCWE-20 6.5 -2024-09-17
CVE-2024-45384 Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack — Apache Druid 7.5 -2024-09-17
CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server — Apache SeataCWE-502 9.8 -2024-09-16
CVE-2024-45034 Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes — Apache AirflowCWE-250 7.8 -2024-09-07
CVE-2024-45498 Apache Airflow: Command Injection in an example DAG — Apache AirflowCWE-116 8.8 -2024-09-07
CVE-2024-45195 Apache OFBiz: Confused controller-view authorization logic (forced browsing) — Apache OFBizCWE-425 9.1AICriticalAI2024-09-04
CVE-2024-45507 Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE — Apache OFBizCWE-918 9.8AICriticalAI2024-09-04
CVE-2023-49582 Apache Portable Runtime (APR): Unexpected lax shared memory permissions — Apache Portable Runtime (APR)CWE-732 3.3AILowAI2024-08-26
CVE-2024-41937 Apache Airflow: Stored XSS Vulnerability on provider link — Apache AirflowCWE-79 6.1AIMediumAI2024-08-21
CVE-2023-49198 Apache SeaTunnel Web: Arbitrary file read vulnerability — Apache SeaTunnel WebCWE-552 7.5AIHighAI2024-08-21
CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session — Apache Helix Front (UI)CWE-668 9.1AICriticalAI2024-08-20
CVE-2024-43202 Apache DolphinScheduler: Remote Code Execution Vulnerability — Apache DolphinSchedulerCWE-94 9.8AICriticalAI2024-08-20
CVE-2024-41909 Apache MINA SSHD: integrity check bypass — Apache MINA SSHDCWE-354--AI2024-08-12
CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use — Apache AnswerCWE-772 7.5AIHighAI2024-08-09
CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link — Apache AnswerCWE-772 7.5AIHighAI2024-08-09
CVE-2024-30188 Apache DolphinScheduler: Resource File Read And Write Vulnerability — Apache DolphinSchedulerCWE-20 8.1AIHighAI2024-08-09
CVE-2024-29831 Apache DolphinScheduler: RCE by arbitrary js execution — Apache DolphinSchedulerCWE-20 8.2AIHighAI2024-08-09
CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins — Apache CloudStackCWE-863 7.2AIHighAI2024-08-07
CVE-2024-42222 Apache CloudStack: Unauthorised Network List Access — Apache CloudStackCWE-200 4.3AIMediumAI2024-08-07
CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL) — Apache IoTDB WorkbenchCWE-918 9.8AICriticalAI2024-08-05
CVE-2024-38856 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code — Apache OFBizCWE-863 5.6AIMediumAI2024-08-05
CVE-2024-42447 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow — Apache Airflow Providers FABCWE-613 9.1AICriticalAI2024-08-05
CVE-2024-36268 Apache InLong TubeMQ Client: Remote Code Execution vulnerability — Apache InLong TubeMQ ClientCWE-94 9.8AICriticalAI2024-08-02
CVE-2024-27182 Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability — Apache Linkis Basic management servicesCWE-552 6.5AIMediumAI2024-08-02
CVE-2024-27181 Apache Linkis Basic management services: Privilege Escalation Attack vulnerability — Apache Linkis Basic management servicesCWE-269 6.5AIMediumAI2024-08-02

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.