Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1676

Browse all 1676 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CamelApache CXFApache HadoopApache GeodeApache FineractApache JSPWikiApache KylinApache PulsarApache DubboApache AmbariApache HiveApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2025-64401 Apache OpenOffice: Remote documents loaded without prompt via IFrame — Apache OpenOfficeCWE-862 7.7 -2025-11-12
CVE-2025-58337 Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server — Apache Doris-MCP-ServerCWE-284 4.3 -2025-11-05
CVE-2025-62232 Apache APISIX: basic-auth logs plaintext credentials at info level — Apache APISIXCWE-532 6.5 -2025-10-31
CVE-2025-54941 Apache Airflow: Command injection in "example_dag_decorator" — Apache AirflowCWE-78 8.8AIHighAI2025-10-30
CVE-2025-62402 Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API — Apache AirflowCWE-250 8.0AIHighAI2025-10-30
CVE-2025-62503 Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables) — Apache AirflowCWE-250 6.5AIMediumAI2025-10-30
CVE-2025-61795 Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS — Apache TomcatCWE-404 7.5 -2025-10-27
CVE-2025-55752 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled — Apache TomcatCWE-23 9.8AICriticalAI2025-10-27
CVE-2025-55754 Apache Tomcat: console manipulation via escape sequences in log messages — Apache TomcatCWE-150 8.8 -2025-10-27
CVE-2025-57738 Apache Syncope: Remote Code Execution by delegated administrators — Apache SyncopeCWE-653 7.2AIHighAI2025-10-20
CVE-2025-47410 Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system — Apache GeodeCWE-352 8.8AIHighAI2025-10-18
CVE-2025-61581 Apache Traffic Control: ReDoS issue in Traffic Router configuration — Apache Traffic ControlCWE-1333 7.5AIHighAI2025-10-16
CVE-2025-54539 Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data — Apache ActiveMQ NMS AMQP ClientCWE-502 9.8AICriticalAI2025-10-16
CVE-2025-55039 Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks — Apache SparkCWE-347 5.9AIMediumAI2025-10-15
CVE-2024-44088 Apache Geode: Reflected XSS — Apache GeodeCWE-79 6.1AIMediumAI2025-10-14
CVE-2025-30001 Apache StreamPark: Authenticated users can trigger remote command execution — Apache StreamParkCWE-279 8.1AIHighAI2025-10-10
CVE-2025-62228 Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers — Apache Flink CDCCWE-89 8.8AIHighAI2025-10-09
CVE-2025-61735 Apache Kylin: Server-Side Request Forgery — Apache KylinCWE-918 9.1AICriticalAI2025-10-02
CVE-2025-61733 Apache Kylin: Authentication bypass — Apache KylinCWE-288 9.8AICriticalAI2025-10-02
CVE-2025-61734 Apache Kylin: improper restriction of file read — Apache KylinCWE-552 9.1AICriticalAI2025-10-02
CVE-2025-61622 Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory — Apache ForyCWE-502 9.8AICriticalAI2025-10-01
CVE-2025-54831 Apache Airflow: Connection sensitive details exposed to users with READ permissions — Apache AirflowCWE-213 6.5 -2025-09-26
CVE-2025-58457 Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands — Apache ZooKeeperCWE-280 8.8AIHighAI2025-09-24
CVE-2025-48392 Apache IoTDB: DoS Vulnerability — Apache IoTDB 9.8AICriticalAI2025-09-24
CVE-2025-48459 Apache IoTDB: Deserialization of untrusted Data — Apache IoTDBCWE-502 9.8AICriticalAI2025-09-24
CVE-2025-59328 Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data — Apache ForyCWE-502 7.5AIHighAI2025-09-15
CVE-2025-48208 Apache HertzBeat (incubating): Jmx JNDI injection vulnerability — Apache HertzBeat (incubating)CWE-90 8.8AIHighAI2025-09-09
CVE-2025-24404 Apache HertzBeat (incubating): RCE by parse http sitemap xml response — Apache HertzBeat (incubating)CWE-91 8.8AIHighAI2025-09-09
CVE-2025-58782 Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory — Apache Jackrabbit CoreCWE-502 9.8AICriticalAI2025-09-08
CVE-2024-43166 Apache DolphinScheduler 安全漏洞 — Apache DolphinSchedulerCWE-276 9.8AICriticalAI2025-09-03

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.