Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1668

Browse all 1668 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CXFApache HadoopApache JSPWikiApache FineractApache GeodeApache PulsarApache DubboApache AmbariApache KylinApache HiveApache CamelApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2026-32588 Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing — Apache CassandraCWE-400 6.5AIMediumAI2026-04-07
CVE-2026-27315 Apache Cassandra: cqlsh history sensitive information leak — Apache CassandraCWE-532 6.5AIMediumAI2026-04-07
CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass — Apache CassandraCWE-267 8.8AIHighAI2026-04-07
CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition — Apache Kafka ClientsCWE-416 7.4AIHighAI2026-04-07
CVE-2026-33227 Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory — Apache ActiveMQ ClientCWE-22 6.5AIMediumAI2026-04-07
CVE-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans — Apache ActiveMQ BrokerCWE-20 8.8AIHighAI2026-04-07
CVE-2025-65114 Apache Traffic Server: Malformed chunked message body allows request smuggling — Apache Traffic ServerCWE-444 7.5AIHighAI2026-04-02
CVE-2025-58136 Apache Traffic Server: A simple legitimate POST request causes a crash — Apache Traffic ServerCWE-670 7.5AIHighAI2026-04-02
CVE-2026-32794 Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange — Apache Airflow Provider for DatabricksCWE-295 7.4 -2026-03-30
CVE-2026-32642 Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission — Apache ArtemisCWE-863 6.5 -2026-03-24
CVE-2026-28563 Apache Airflow: DAG authorization bypass — Apache AirflowCWE-732 4.3 -2026-03-17
CVE-2026-26929 Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata — Apache AirflowCWE-732 5.3AIMediumAI2026-03-17
CVE-2026-30911 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization — Apache AirflowCWE-862 8.1AIHighAI2026-03-17
CVE-2026-28779 Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications — Apache AirflowCWE-668 9.8AICriticalAI2026-03-17
CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability — Apache SparkCWE-502 8.8 -2026-03-14
CVE-2025-60012 Apache Livy: Restrict file access — Apache LivyCWE-20 6.5 -2026-03-13
CVE-2025-66249 Apache Livy: Unauthorized directory access — Apache LivyCWE-22 6.5 -2026-03-13
CVE-2026-23907 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code — Apache PDFBox ExamplesCWE-22 7.1 -2026-03-10
CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass — Apache Airflow Providers AmazonCWE-346 9.8AICriticalAI2026-03-09
CVE-2025-69219 Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator — Apache Airflow Providers HttpCWE-913 8.8AIHighAI2026-03-09
CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability — Apache IoTDBCWE-20 9.1AICriticalAI2026-03-09
CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability — Apache IoTDBCWE-1327 9.1AICriticalAI2026-03-09
CVE-2026-24308 Apache ZooKeeper: Sensitive information disclosure in client configuration handling — Apache ZooKeeperCWE-532 7.5 -2026-03-07
CVE-2026-24281 Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager — Apache ZooKeeperCWE-350 7.4 -2026-03-07
CVE-2026-27446 Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation — Apache ArtemisCWE-306 6.5 -2026-03-04
CVE-2025-66168 Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated — Apache ActiveMQCWE-190 5.4 Medium2026-03-04
CVE-2025-59060 Apache Ranger: Hostname verification bypass in NiFiRegistryClient and NifiClient — Apache RangerCWE-297 5.3AIMediumAI2026-03-03
CVE-2025-59059 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator — Apache RangerCWE-94 9.8AICriticalAI2026-03-03
CVE-2026-23969 Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering — Apache SupersetCWE-89 9.8 -2026-02-24
CVE-2026-23980 Apache Superset: Improper Neutralization of Special Elements used in a SQL Command — Apache SupersetCWE-89 8.8 -2026-02-24

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.