Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 2345

Browse all 2345 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Apache Software Foundation develops and maintains open-source software, primarily known for the widely deployed Apache HTTP Server and foundational Java frameworks. Its extensive portfolio exposes a significant attack surface, evidenced by the 1717 recorded CVEs. Historically, vulnerabilities frequently involve remote code execution, cross-site scripting, and privilege escalation, often stemming from complex configuration errors or input validation failures in legacy components. While the foundation enforces rigorous security review processes, the sheer volume of projects increases the likelihood of undiscovered flaws. Notable incidents include critical flaws in Log4j, which allowed remote code execution via crafted log messages, highlighting risks in dependency management. The organization relies on community-driven patching, requiring administrators to promptly apply updates to mitigate exploitation. This model ensures transparency but demands active vigilance from users to maintain system integrity against evolving threat vectors.

Found 145 results / 2345 Clear Filters
Top products by Apache Software Foundation: Apache Airflow Apache HTTP Server Apache Tomcat Apache Traffic Server Apache Superset Apache OFBiz Apache CloudStack Apache Camel Apache NiFi Apache CXF Apache InLong Apache Syncope Apache DolphinScheduler Apache Struts Apache Thrift Apache APISIX Apache OpenOffice Apache IoTDB Apache Zeppelin Apache Solr Apache Answer Apache OpenMeetings Apache Ranger Apache JSPWiki Apache Wicket Apache ActiveMQ Apache Fineract Apache Kylin Apache Hive Apache Hadoop
CVE ID Title CVSS Severity Published
CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry — Apache Airflow CWE-613 - - 2026-09-21
CVE-2026-75158 Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter — Apache Airflow CWE-200 - - 2026-09-21
CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation — Apache Airflow CWE-384 - - 2026-09-21
CVE-2026-75157 Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) — Apache Airflow CWE-863 - - 2026-09-18
CVE-2026-59244 Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI — Apache Airflow CWE-312 - - 2026-08-12
CVE-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server — Apache Airflow CWE-502 - - 2026-08-12
CVE-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint — Apache Airflow CWE-502 - - 2026-08-12
CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users — Apache Airflow CWE-200 - - 2026-08-12
CVE-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization — Apache Airflow CWE-502 - - 2026-08-12
CVE-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget — Apache Airflow CWE-502 - - 2026-08-12
CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) — Apache Airflow CWE-200 - - 2026-08-12
CVE-2026-68968 Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id — Apache Airflow CWE-436 - - 2026-08-12
CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext — Apache Airflow CWE-532 - - 2026-08-12
CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI — Apache Airflow CWE-312 - - 2026-08-12
CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints — Apache Airflow CWE-862 - - 2026-08-12
CVE-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection — Apache Airflow CWE-639 - - 2026-08-12
CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() — Apache Airflow CWE-502 - - 2026-07-07
CVE-2026-49487 Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs — Apache Airflow CWE-200 - - 2026-07-07
CVE-2026-48828 Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key — Apache Airflow CWE-200 - - 2026-07-07
CVE-2026-49296 Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} — Apache Airflow CWE-639 - - 2026-07-07
CVE-2026-48891 Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target — Apache Airflow CWE-200 - - 2026-07-07
CVE-2026-48892 Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options — Apache Airflow CWE-200 - - 2026-07-07
CVE-2026-40861 Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler — Apache Airflow CWE-59 - - 2026-06-01
CVE-2026-40961 Apache Airflow: Open Redirect Bypass Vulnerability — Apache Airflow CWE-601 - - 2026-06-01
CVE-2026-40963 Apache Airflow: DAG authorization bypass on /ui/structure/structure_data — Apache Airflow CWE-285 - - 2026-06-01
CVE-2026-41014 Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints — Apache Airflow CWE-862 - - 2026-06-01
CVE-2026-49267 Apache Airflow: No certificate validation on SMTP STARTTLS connections — Apache Airflow CWE-295 - - 2026-06-01
CVE-2026-41017 Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy — Apache Airflow CWE-614 - - 2026-06-01
CVE-2026-41084 Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation — Apache Airflow CWE-639 - - 2026-06-01
CVE-2026-42252 Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern — Apache Airflow CWE-1336 - - 2026-06-01

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.