Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 2370

Browse all 2370 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Apache Software Foundation develops and maintains open-source software, primarily known for the widely deployed Apache HTTP Server and foundational Java frameworks. Its extensive portfolio exposes a significant attack surface, evidenced by the 1717 recorded CVEs. Historically, vulnerabilities frequently involve remote code execution, cross-site scripting, and privilege escalation, often stemming from complex configuration errors or input validation failures in legacy components. While the foundation enforces rigorous security review processes, the sheer volume of projects increases the likelihood of undiscovered flaws. Notable incidents include critical flaws in Log4j, which allowed remote code execution via crafted log messages, highlighting risks in dependency management. The organization relies on community-driven patching, requiring administrators to promptly apply updates to mitigate exploitation. This model ensures transparency but demands active vigilance from users to maintain system integrity against evolving threat vectors.

Top products by Apache Software Foundation: Apache Airflow Apache Tomcat Apache HTTP Server Apache Traffic Server Apache Superset Apache OFBiz Apache CloudStack Apache Camel Apache NiFi Apache CXF Apache InLong Apache Syncope Apache DolphinScheduler Apache Struts Apache Thrift Apache APISIX Apache OpenOffice Apache Zeppelin Apache IoTDB Apache Answer Apache Solr Apache OpenMeetings Apache Ranger Apache JSPWiki Apache Wicket Apache Fineract Apache ActiveMQ Apache Kylin Apache Hadoop Apache Hive
CVE ID Title CVSS Severity Published
CVE-2026-31379 Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager — Apache OFBiz CWE-79 - - 2026-05-19
CVE-2026-31378 Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution — Apache OFBiz CWE-20 - - 2026-05-19
CVE-2026-29226 Apache OFBiz: Low-Privilege SSRF in Content Component — Apache OFBiz CWE-918 - - 2026-05-19
CVE-2026-29207 Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component — Apache OFBiz CWE-1336 - - 2026-05-19
CVE-2026-29220 Apache OFBiz: Low-Privilege LFI in Content Component — Apache OFBiz CWE-22 - - 2026-05-19
CVE-2026-35194 Apache Flink: Remote code execution via SQL injection in code generation — Apache Flink CWE-94 - - 2026-05-15
CVE-2026-45205 Apache Commons Configuration: StackOverflowError for YAML input with cycles — Apache Commons Configuration CWE-674 - - 2026-05-14
CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied — Apache Tomcat CWE-285 - - 2026-05-12
CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time — Apache Tomcat CWE-208 - - 2026-05-12
CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive — Apache Tomcat CWE-178 - - 2026-05-12
CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user — Apache Tomcat CWE-592 - - 2026-05-12
CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated — Apache Tomcat CWE-20 - - 2026-05-12
CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure — Apache Tomcat CWE-200 - - 2026-05-12
CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling — Apache Tomcat CWE-770 - - 2026-05-12
CVE-2026-41018 Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL — Apache Airflow Providers Elasticsearch CWE-532 - - 2026-05-11
CVE-2026-43826 Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL — Apache Airflow Providers OpenSearch CWE-532 - - 2026-05-11
CVE-2026-39816 Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService — Apache NiFi CWE-862 8.8AI High AI 2026-05-08
CVE-2026-25199 Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access — Apache CloudStack CWE-200 10.0AI Critical AI 2026-05-08
CVE-2026-25077 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates — Apache CloudStack CWE-94 8.8AI High AI 2026-05-08
CVE-2025-69233 Apache CloudStack: Domain/account resources limits not honored — Apache CloudStack CWE-367 6.5 Medium 2026-05-08
CVE-2025-66467 Apache CloudStack: MinIO policy remains intact on bucket deletion — Apache CloudStack CWE-459 8.0 High 2026-05-08
CVE-2025-66172 Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to — Apache CloudStack CWE-359 6.5AI Medium AI 2026-05-08
CVE-2025-66171 Apache CloudStack: Any user can create a new VM from backups they should not have access to — Apache CloudStack CWE-359 6.5AI Medium AI 2026-05-08
CVE-2025-66170 Apache CloudStack: Any user can list backups that they should not have access to — Apache CloudStack CWE-863 4.3AI Medium AI 2026-05-08
CVE-2026-40010 Apache Wicket: possible session fixation using AuthenticatedWebSession — Apache Wicket 9.8AI Critical AI 2026-05-06
CVE-2026-42509 Apache Wicket: crafted strings can break out of the JavaScript sequence — Apache Wicket CWE-79 6.1AI Medium AI 2026-05-06
CVE-2026-43646 Apache Wicket: crafted URLs can bypass PackageResourceGuard — Apache Wicket CWE-200 7.5AI High AI 2026-05-06
CVE-2026-43975 Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager — Apache Wicket CWE-22 9.1AI Critical AI 2026-05-06
CVE-2026-28780 Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() — Apache HTTP Server CWE-122 9.8 - 2026-05-05
CVE-2026-29168 Apache HTTP Server: mod_md unrestricted OCSP response — Apache HTTP Server CWE-770 7.5 - 2026-05-05

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.