Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 2345

Browse all 2345 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Apache Software Foundation develops and maintains open-source software, primarily known for the widely deployed Apache HTTP Server and foundational Java frameworks. Its extensive portfolio exposes a significant attack surface, evidenced by the 1717 recorded CVEs. Historically, vulnerabilities frequently involve remote code execution, cross-site scripting, and privilege escalation, often stemming from complex configuration errors or input validation failures in legacy components. While the foundation enforces rigorous security review processes, the sheer volume of projects increases the likelihood of undiscovered flaws. Notable incidents include critical flaws in Log4j, which allowed remote code execution via crafted log messages, highlighting risks in dependency management. The organization relies on community-driven patching, requiring administrators to promptly apply updates to mitigate exploitation. This model ensures transparency but demands active vigilance from users to maintain system integrity against evolving threat vectors.

Top products by Apache Software Foundation: Apache Airflow Apache HTTP Server Apache Tomcat Apache Traffic Server Apache Superset Apache OFBiz Apache CloudStack Apache Camel Apache NiFi Apache CXF Apache InLong Apache Syncope Apache DolphinScheduler Apache Struts Apache Thrift Apache APISIX Apache OpenOffice Apache IoTDB Apache Zeppelin Apache Solr Apache Answer Apache OpenMeetings Apache Ranger Apache JSPWiki Apache Wicket Apache ActiveMQ Apache Fineract Apache Kylin Apache Hive Apache Hadoop
CVE ID Title CVSS Severity Published
CVE-2026-59799 Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow — Apache CloudStack CWE-269 - - 2026-08-21
CVE-2026-61397 Apache CloudStack: OAuth2 Token Cross-Request Leak — Apache CloudStack CWE-200 - - 2026-08-21
CVE-2026-61398 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI — Apache CloudStack CWE-116 - - 2026-08-21
CVE-2026-61399 Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI — Apache CloudStack CWE-116 - - 2026-08-21
CVE-2026-61400 Apache CloudStack: Get and Run Diagnostics Command Injection — Apache CloudStack CWE-77 - - 2026-08-21
CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate — Apache CloudStack CWE-918 - - 2026-08-21
CVE-2026-62440 Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation — Apache CloudStack CWE-284 - - 2026-08-21
CVE-2026-65613 Apache CloudStack: Webhook Deliveries Incorrect Access — Apache CloudStack CWE-200 - - 2026-08-21
CVE-2026-66721 Apache CloudStack: Authorization issue with listHostTags for domain admins — Apache CloudStack CWE-862 - - 2026-08-21
CVE-2026-66722 Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue — Apache CloudStack CWE-285 - - 2026-08-21
CVE-2026-66797 Apache CloudStack: Unauthorised comment creation and disclosure — Apache CloudStack CWE-284 - - 2026-08-21
CVE-2026-68745 Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP — Apache CloudStack CWE-347 - - 2026-08-21
CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection — Apache InLong CWE-918 - - 2026-08-20
CVE-2026-63043 Apache InLong: Agent path traversal via unvalidated file source path — Apache InLong CWE-23 - - 2026-08-20
CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints — Apache InLong CWE-552 - - 2026-08-20
CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete — Apache InLong CWE-552 - - 2026-08-20
CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService — Apache InLong CWE-89 - - 2026-08-20
CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report — Apache InLong CWE-89 - - 2026-08-20
CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint — Apache InLong CWE-89 - - 2026-08-20
CVE-2026-63016 Apache InLong: Ordinary users can create new packages — Apache InLong CWE-400 - - 2026-08-20
CVE-2026-63015 Apache InLong: Non-template responsible persons can view template information — Apache InLong CWE-400 - - 2026-08-20
CVE-2026-34884 Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server — Apache SkyWalking MCP CWE-918 - - 2026-08-18
CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin — Apache Struts CWE-567 - - 2026-08-15
CVE-2026-73631 Apache Struts: Shared parsing state in the JSON plugin — Apache Struts CWE-567 - - 2026-08-15
CVE-2026-73635 Apache Struts: Unbounded growth of localized-text caches driven by the request locale — Apache Struts CWE-770 - - 2026-08-15
CVE-2026-73634 Apache Struts: Unbounded read of a Content Security Policy violation report — Apache Struts CWE-400 - - 2026-08-15
CVE-2026-73633 Apache Struts: Unbounded read of a JSON request body — Apache Struts CWE-400 - - 2026-08-14
CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API) — Apache Shindig Common CWE-502 - - 2026-08-13
CVE-2026-73237 Apache Allura: XSS in markdown pipeline — Apache Allura CWE-80 - - 2026-08-12
CVE-2026-73238 Apache Allura: XSS in code display — Apache Allura CWE-80 - - 2026-08-12

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.