Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1668

Browse all 1668 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CXFApache HadoopApache JSPWikiApache FineractApache GeodeApache PulsarApache DubboApache AmbariApache KylinApache HiveApache CamelApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2026-33858 Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API — Apache AirflowCWE-502 9.8 -2026-04-13
CVE-2025-66236 Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI — Apache AirflowCWE-532 9.6 -2026-04-13
CVE-2026-34476 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server — Apache SkyWalking MCPCWE-918 9.1 -2026-04-13
CVE-2026-35337 Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling — Apache Storm ClientCWE-502 8.8 -2026-04-13
CVE-2026-35565 Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI — Apache Storm UICWE-79 5.4 -2026-04-13
CVE-2026-40023 Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters — Apache Log4cxxCWE-116 5.3 -2026-04-10
CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters — Apache Log4netCWE-116 9.1 -2026-04-10
CVE-2026-34481 Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout — Apache Log4j JSON Template LayoutCWE-116 4.8 -2026-04-10
CVE-2026-34480 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters — Apache Log4j CoreCWE-116 5.8AIMediumAI2026-04-10
CVE-2026-34479 Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters — Apache Log4j 1 to Log4j 2 bridgeCWE-116 6.5AIMediumAI2026-04-10
CVE-2026-34478 Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility — Apache Log4j CoreCWE-684 8.2AIHighAI2026-04-10
CVE-2026-34477 Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass — Apache Log4j CoreCWE-297 8.2AIHighAI2026-04-10
CVE-2026-39304 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM — Apache ActiveMQ Client 7.5 -2026-04-10
CVE-2026-34500 Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled — Apache Tomcat 8.1AIHighAI2026-04-09
CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token — Apache TomcatCWE-532 7.5AIHighAI2026-04-09
CVE-2026-34486 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor — Apache TomcatCWE-311 7.5AIHighAI2026-04-09
CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs — Apache TomcatCWE-116 9.8AICriticalAI2026-04-09
CVE-2026-32990 Apache Tomcat: Fix for CVE-2025-66614 is incomplete — Apache TomcatCWE-20 9.1AICriticalAI2026-04-09
CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default — Apache Tomcat 9.1AICriticalAI2026-04-09
CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled — Apache Tomcat 9.8AICriticalAI2026-04-09
CVE-2026-29129 Apache Tomcat: TLS cipher order is not preserved — Apache Tomcat 7.5AIHighAI2026-04-09
CVE-2026-25854 Apache Tomcat: Occasionally open redirect — Apache TomcatCWE-601 6.1AIMediumAI2026-04-09
CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension — Apache TomcatCWE-444 9.1AICriticalAI2026-04-09
CVE-2026-40046 Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated — Apache ActiveMQCWE-190 9.8AICriticalAI2026-04-09
CVE-2026-33005 Apache OpenMeetings: Insufficient checks in FileWebService — Apache OpenMeetingsCWE-274 4.3AIMediumAI2026-04-09
CVE-2026-33266 Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt — Apache OpenMeetingsCWE-321 9.8AICriticalAI2026-04-09
CVE-2026-34020 Apache OpenMeetings: Login Credentials Passed via GET Query Parameters — Apache OpenMeetingsCWE-598 7.5AIHighAI2026-04-09
CVE-2025-57735 Apache Airflow: Airflow Logout Not Invalidating JWT — Apache AirflowCWE-613 9.1AICriticalAI2026-04-09
CVE-2025-62188 Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. — Apache DolphinSchedulerCWE-200 7.5AIHighAI2026-04-09
CVE-2026-34538 Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) — Apache AirflowCWE-668 6.5AIMediumAI2026-04-09

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.