CVE-2026-86467 N/A Apache Airflow Amazon Provider — Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication respon… 2026-10-20 CVE-2026-108762 N/A Apache Kylin — Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services tha… 2026-10-19 CVE-2026-108764 N/A Apache Kylin — Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that ar… 2026-10-19 CVE-2026-108766 N/A Apache Kylin — Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are… 2026-10-19 CVE-2026-108771 N/A Apache Kylin — Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. I… 2026-10-19 CVE-2026-108776 N/A Apache Kylin — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache K… 2026-10-19 CVE-2026-108780 N/A Apache Kylin — Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the … 2026-10-19 CVE-2026-108823 N/A Apache Kylin — Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact… 2026-10-19 CVE-2026-108833 N/A Apache Kylin — Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile tu… 2026-10-19 CVE-2026-108837 N/A Apache Kylin — Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got … 2026-10-19 CVE-2026-64943 N/A Apache Answer — Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache … 2026-10-19 CVE-2026-64944 N/A Apache Answer — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache A… 2026-10-19 CVE-2026-64945 N/A Apache Answer — A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation … 2026-10-19 CVE-2026-67249 N/A Apache Answer — A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code iss… 2026-10-19 CVE-2026-68482 N/A Apache Answer — Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An … 2026-10-19 CVE-2026-71253 N/A Apache Johnzon — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Joh… 2026-10-19 CVE-2026-71563 N/A Apache Answer — Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An … 2026-10-19 CVE-2026-76994 N/A Apache Answer — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affec… 2026-10-19 CVE-2026-78162 CRITICAL 10 Apache Camel — Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.… 2026-10-19 CVE-2026-78163 MEDIUM 5.9 Apache Camel — Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Travers… 2026-10-19 CVE-2026-78164 HIGH 8.2 Apache Camel — Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to… 2026-10-19 CVE-2026-78165 HIGH 8.8 Apache Camel — Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects … 2026-10-19 CVE-2026-79613 N/A Apache Answer — vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attacke… 2026-10-19 CVE-2026-79620 N/A Apache Answer — Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects A… 2026-10-19 CVE-2026-79624 N/A Apache Answer — Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2… 2026-10-19 CVE-2026-79633 N/A Apache Answer — vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization c… 2026-10-19 CVE-2026-79983 HIGH 7.4 Apache Camel — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel F… 2026-10-19 CVE-2026-79984 HIGH 7.4 Apache Camel — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel M… 2026-10-19 CVE-2026-79985 HIGH 7.4 Apache Camel — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel S… 2026-10-19 CVE-2026-79986 HIGH 7.4 Apache Camel — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel A… 2026-10-19 CVE-2026-80312 HIGH 8.2 Apache Camel — Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: fro… 2026-10-19 CVE-2026-80343 HIGH 8.2 Apache Camel — Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affect… 2026-10-19 CVE-2026-80344 HIGH 8.2 Apache Camel — Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Cam… 2026-10-19 CVE-2026-83531 HIGH 8.8 Apache Camel — Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in… 2026-10-19 CVE-2026-84176 MEDIUM 6.5 Apache Camel — Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx compon… 2026-10-19 CVE-2026-84178 MEDIUM 6.1 Apache Camel — Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache … 2026-10-19 CVE-2026-84180 MEDIUM 5.3 Apache Camel — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. … 2026-10-19 CVE-2026-84181 MEDIUM 5.9 Apache Camel — Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: fro… 2026-10-19 CVE-2026-85243 MEDIUM 5.9 Apache Camel — Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue a… 2026-10-19 CVE-2026-85245 MEDIUM 5.9 Apache Camel — Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affect… 2026-10-19 CVE-2026-85246 MEDIUM 5.3 Apache Camel — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. Th… 2026-10-19 CVE-2026-85247 MEDIUM 5.9 Apache Camel — Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Ca… 2026-10-19 CVE-2026-85248 MEDIUM 5.9 Apache Camel — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in A… 2026-10-19 CVE-2026-85249 MEDIUM 6.5 Apache Camel — Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from… 2026-10-19 CVE-2026-85250 HIGH 7.5 Apache Camel — Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This iss… 2026-10-19 CVE-2026-85251 HIGH 7.5 Apache Camel — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This… 2026-10-19 CVE-2026-85254 MEDIUM 6.5 Apache Camel — Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affec… 2026-10-19 CVE-2026-85257 MEDIUM 5.3 Apache Camel — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. Thi… 2026-10-19 CVE-2026-85260 MEDIUM 5.5 Apache Camel — Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue aff… 2026-10-19 CVE-2026-85296 MEDIUM 6.5 Apache Camel — Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apa… 2026-10-19 CVE-2026-85300 MEDIUM 5.5 Apache Camel — Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: f… 2026-10-19 CVE-2026-85301 MEDIUM 4.8 Apache Camel — Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: fr… 2026-10-19 CVE-2026-85312 MEDIUM 4.8 Apache Camel — Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from… 2026-10-19 CVE-2026-85313 MEDIUM 4.3 Apache Camel — Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This iss… 2026-10-19 CVE-2026-85314 MEDIUM 6.5 Apache Camel — Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from… 2026-10-19 CVE-2026-85315 MEDIUM 5.3 Apache Camel — Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. Th… 2026-10-19 CVE-2026-85316 MEDIUM 4.8 Apache Camel — Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue … 2026-10-19 CVE-2026-85317 MEDIUM 4.8 Apache Camel — Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affect… 2026-10-19 CVE-2026-86589 N/A Apache Answer — Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apa… 2026-10-19 CVE-2026-88900 HIGH 8.8 Apache Camel — Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects… 2026-10-19 CVE-2026-88901 HIGH 8.2 Apache Camel — Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apa… 2026-10-19 CVE-2026-90910 CRITICAL 9.8 Apache Answer — Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answ… 2026-10-19 CVE-2026-91858 MEDIUM 6.5 Apache Camel — FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory t… 2026-10-19 CVE-2026-108709 N/A Apache Kylin — Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are dire… 2026-10-16 CVE-2026-108743 N/A Apache Kylin — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ap… 2026-10-16 CVE-2026-63618 HIGH 7.5 Apache Kylin — Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in … 2026-10-16 CVE-2026-63619 N/A Apache Kylin — Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorizati… 2026-10-16 CVE-2026-64610 N/A Apache Kylin — Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from… 2026-10-16 CVE-2026-64959 N/A Apache Kylin — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication f… 2026-10-16 CVE-2026-68571 HIGH 8.8 Apache Kylin — Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in … 2026-10-16 CVE-2026-68572 N/A Apache Kylin — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affect… 2026-10-16 CVE-2026-68573 N/A Apache Kylin — Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actio… 2026-10-16 CVE-2026-69076 N/A Apache Kylin — Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin servi… 2026-10-16 CVE-2026-69077 N/A Apache Kylin — Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kyli… 2026-10-16 CVE-2026-69080 N/A Apache Kylin — Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apach… 2026-10-16 CVE-2026-92228 MEDIUM 6.5 Apache Airflow Keycloak Provider — The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team… 2026-10-15 CVE-2026-94134 CRITICAL 9.1 Apache Airflow Ssh Provider — The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is confi… 2026-10-15 CVE-2026-94135 MEDIUM 4.3 Apache Airflow Sftp Provider — The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) di… 2026-10-15 CVE-2026-96806 MEDIUM 5.8 Apache Airflow Keycloak Provider — The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the prese… 2026-10-15 CVE-2026-107460 N/A Apache Fesod (Incubating) — Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) … 2026-10-13 CVE-2026-85499 CRITICAL 9.1 Apache Skywalking Banyandb — Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of… 2026-10-12 CVE-2026-92116 CRITICAL 9.1 Apache Allura — OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0… 2026-10-12 CVE-2026-92119 CRITICAL 9.1 Apache Allura — REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. … 2026-10-12 CVE-2026-92120 CRITICAL 9.1 Apache Allura — OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21… 2026-10-12 CVE-2026-103501 CRITICAL 9.8 Apache Datasketches — Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). W… 2026-10-10 CVE-2026-103513 CRITICAL 9.8 Apache Datasketches — Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-… 2026-10-10 CVE-2026-103635 CRITICAL 9.1 Apache Datasketches — Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-… 2026-10-10 CVE-2026-103636 HIGH 7.5 Apache Datasketches — Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). v… 2026-10-10 CVE-2026-100227 HIGH 7.5 Apache Cxf — Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The… 2026-10-09 CVE-2026-103412 HIGH 8.8 Apache Camel Karavan — Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel K… 2026-10-09 CVE-2026-103413 HIGH 8.8 Apache Camel Karavan — Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unm… 2026-10-09 CVE-2026-107937 HIGH 7.5 Apache Cxf — In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured atta… 2026-10-09 CVE-2026-107938 CRITICAL 9.1 Apache Cxf — In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that… 2026-10-09 CVE-2026-108039 HIGH 7.5 Apache Cxf — By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an … 2026-10-09 CVE-2026-71575 CRITICAL 9.1 Apache Cxf — The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a millisecond… 2026-10-09 CVE-2026-73179 HIGH 8.1 Apache Cxf — Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant pro… 2026-10-09 CVE-2026-78384 HIGH 7.5 Apache Cxf — CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB… 2026-10-09 CVE-2026-79650 MEDIUM 6.1 Apache Cxf — Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful … 2026-10-09 CVE-2026-86463 HIGH 7.5 Apache Cxf — Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The … 2026-10-09 CVE-2026-97468 CRITICAL 9.1 Apache Cxf — Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-c… 2026-10-09 CVE-2026-97791 HIGH 7.5 Apache Cxf — In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before dec… 2026-10-09 CVE-2026-66082 MEDIUM 6.5 Apache Dolphinscheduler — An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unautho… 2026-10-08 CVE-2026-66084 HIGH 8.1 Apache Dolphinscheduler — An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task def… 2026-10-08 CVE-2026-66087 HIGH 8.1 Apache Dolphinscheduler — An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task in… 2026-10-08 CVE-2026-71183 HIGH 7.1 Apache Dolphinscheduler — An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information abo… 2026-10-08 CVE-2026-71895 HIGH 7.1 Apache Dolphinscheduler — An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kub… 2026-10-08 CVE-2026-71896 MEDIUM 6.5 Apache Dolphinscheduler — An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' … 2026-10-08 CVE-2026-103371 HIGH 7.5 Apache Geode — Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache … 2026-10-07 CVE-2026-78243 LOW 2.1 Apache Yunikorn — Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds r… 2026-10-07 CVE-2026-90466 MEDIUM 6.5 Apache Impala — Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a rel… 2026-10-07 CVE-2026-92393 LOW 2 Apache Yunikorn — Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE acti… 2026-10-07 CVE-2026-92414 CRITICAL 9.3 Apache Jackrabbit — : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV serve… 2026-10-07 CVE-2026-92415 MEDIUM 6.9 Apache Jackrabbit — — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Dav… 2026-10-07 CVE-2026-93684 MEDIUM 5.4 Apache Impala — An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a… 2026-10-07 CVE-2026-97146 MEDIUM 4.8 Apache Yunikorn — Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary la… 2026-10-07 CVE-2026-97720 CRITICAL 9.1 Apache Impala — Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and i… 2026-10-07 CVE-2026-105111 LOW 2.3 Apache Commons Bcel — Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache C… 2026-10-06 CVE-2026-105239 MEDIUM 5.3 Apache Log4net — Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.… 2026-10-06 CVE-2026-105240 MEDIUM 5.3 Apache Log4net — Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache… 2026-10-06 CVE-2026-105241 MEDIUM 5.3 Apache Log4net — Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content t… 2026-10-06 CVE-2026-105242 MEDIUM 5.3 Apache Log4net — Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache lo… 2026-10-06 CVE-2026-105243 MEDIUM 5.3 Apache Log4net — Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to… 2026-10-06 CVE-2026-105244 MEDIUM 5.3 Apache Log4net — Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every ch… 2026-10-06 CVE-2026-94114 HIGH 8.2 Apache Commons Bcel — Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declar… 2026-10-06 CVE-2026-104711 CRITICAL 9.8 Apache Struts — Improper neutralization of special elements used in an expression language statement ('Expression Language Inj… 2026-10-05 CVE-2026-104712 HIGH 7.5 Apache Struts — Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bo… 2026-10-05 CVE-2026-104713 MEDIUM 6.5 Apache Struts — Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request… 2026-10-05 CVE-2026-104714 HIGH 8.8 Apache Struts — Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in A… 2026-10-05 CVE-2026-102731 HIGH 7.5 Apache Directory Ldap Api — Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (o… 2026-10-02 CVE-2026-102795 HIGH 7 Apache Traffic Server — Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: f… 2026-10-02 CVE-2026-103552 HIGH 7.3 Apache Directory Ldap Api — Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply neste… 2026-10-02 CVE-2026-103877 CRITICAL 9.8 Apache Directory Ldap Api — Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP serv… 2026-10-02 CVE-2026-103878 HIGH 7.5 Apache Directory Ldap Api — Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS exte… 2026-10-02 CVE-2026-103880 HIGH 7.5 Apache Directory Ldap Api — Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bc… 2026-10-02 CVE-2026-103885 HIGH 7.5 Apache Directory Ldap Api — Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP AP… 2026-10-02 CVE-2026-59265 HIGH 8.8 Apache Openoffice — A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untru… 2026-10-02 CVE-2026-61373 HIGH 8.7 Apache Thrift — Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServe… 2026-10-02 CVE-2026-61374 HIGH 7.1 Apache Thrift — Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This iss… 2026-10-02 CVE-2026-63772 HIGH 8.7 Apache Thrift — Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue… 2026-10-02 CVE-2026-66054 MEDIUM 6.9 Apache Thrift — Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplif… 2026-10-02 CVE-2026-66055 HIGH 8.2 Apache Thrift — Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Pyt… 2026-10-02 CVE-2026-66081 HIGH 8.7 Apache Thrift — Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache T… 2026-10-02 CVE-2026-66331 MEDIUM 6.9 Apache Thrift — Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered t… 2026-10-02 CVE-2026-66837 HIGH 8.7 Apache Thrift — Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. Th… 2026-10-02 CVE-2026-66858 HIGH 8.7 Apache Thrift — The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a … 2026-10-02 CVE-2026-66859 HIGH 8.7 Apache Thrift — NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings. Thi… 2026-10-02 CVE-2026-82458 HIGH 8.7 Apache Thrift — Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerabilit… 2026-10-02 CVE-2026-82459 HIGH 8.2 Apache Thrift — Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderT… 2026-10-02 CVE-2026-83632 CRITICAL 9.2 Apache Thrift — Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overfl… 2026-10-02 CVE-2026-83663 HIGH 8.7 Apache Thrift — Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of… 2026-10-02 CVE-2026-83745 HIGH 8.7 Apache Thrift — Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability… 2026-10-02 CVE-2026-85086 MEDIUM 6.9 Apache Thrift — Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache… 2026-10-02 CVE-2026-85087 MEDIUM 6.9 Apache Thrift — Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. … 2026-10-02 CVE-2026-85088 MEDIUM 6.9 Apache Thrift — Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both lib… 2026-10-02 CVE-2026-85476 HIGH 8.2 Apache Thrift — Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings. This… 2026-10-02 CVE-2026-85483 MEDIUM 6.3 Apache Thrift — Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. … 2026-10-02 CVE-2026-85493 HIGH 8.7 Apache Thrift — Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache … 2026-10-02 CVE-2026-85494 HIGH 8.7 Apache Thrift — Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, M… 2026-10-02 CVE-2026-86535 HIGH 8.7 Apache Thrift — Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype… 2026-10-02 CVE-2026-86536 MEDIUM 6.3 Apache Thrift — Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apa… 2026-10-02 CVE-2026-86537 HIGH 8.7 Apache Thrift — Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparo… 2026-10-02 CVE-2026-87117 HIGH 8.7 Apache Thrift — NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: bef… 2026-10-02 CVE-2026-90440 HIGH 8.2 Apache Thrift — Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in A… 2026-10-02 CVE-2026-91135 CRITICAL 9.2 Apache Thrift — Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables… 2026-10-02 CVE-2026-91137 HIGH 8.7 Apache Thrift — Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Exce… 2026-10-02 CVE-2026-92834 MEDIUM 6.3 Apache Thrift — Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server… 2026-10-02 CVE-2026-93925 HIGH 8.7 Apache Thrift — Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProt… 2026-10-02 CVE-2026-93926 HIGH 8.7 Apache Thrift — Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulne… 2026-10-02 CVE-2026-94633 HIGH 8.7 Apache Thrift — Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability… 2026-10-02 CVE-2026-94634 HIGH 8.2 Apache Thrift — Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vu… 2026-10-02 CVE-2026-94635 HIGH 8.7 Apache Thrift — Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vuln… 2026-10-02 CVE-2026-94636 HIGH 8.2 Apache Thrift — Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arg… 2026-10-02 CVE-2026-94637 HIGH 8.2 Apache Thrift — Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. … 2026-10-02 CVE-2026-94638 MEDIUM 6.3 Apache Thrift — Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issu… 2026-10-02 CVE-2026-94639 HIGH 8.2 Apache Thrift — improper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught ex… 2026-10-02 CVE-2026-94642 HIGH 8.7 Apache Thrift — Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.… 2026-10-02 CVE-2026-94644 HIGH 8.2 Apache Thrift — Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issu… 2026-10-02 CVE-2026-94645 HIGH 8.2 Apache Thrift — Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulne… 2026-10-02 CVE-2026-94646 HIGH 8.7 Apache Thrift — Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of … 2026-10-02 CVE-2026-94648 HIGH 8.2 Apache Thrift — Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This iss… 2026-10-02 CVE-2026-94650 HIGH 8.2 Apache Thrift — Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: be… 2026-10-02 CVE-2026-94651 HIGH 8.2 Apache Thrift — improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerabilit… 2026-10-02 CVE-2026-94652 MEDIUM 6.3 Apache Thrift — Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings. This issue … 2026-10-02 CVE-2026-94653 HIGH 8.2 Apache Thrift — Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache T… 2026-10-02 CVE-2026-94654 HIGH 8.2 Apache Thrift — Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This… 2026-10-02 CVE-2026-94655 HIGH 8.2 Apache Thrift — Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apac… 2026-10-02 CVE-2026-94656 HIGH 8.2 Apache Thrift — Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This iss… 2026-10-02 CVE-2026-94657 HIGH 8.2 Apache Thrift — Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This i… 2026-10-02 CVE-2026-94658 HIGH 8.7 Apache Thrift — Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache T… 2026-10-02 CVE-2026-96277 HIGH 8.7 Apache Thrift — Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. … 2026-10-02 CVE-2026-96286 HIGH 8.2 Apache Thrift — Uncaught exception vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0… 2026-10-02 CVE-2026-96287 HIGH 8.2 Apache Thrift — Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache … 2026-10-02 CVE-2026-96288 HIGH 8.2 Apache Thrift — Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Er… 2026-10-02 CVE-2026-96289 HIGH 8.2 Apache Thrift — Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: befor… 2026-10-02 CVE-2026-96292 HIGH 8.2 Apache Thrift — Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift L… 2026-10-02 CVE-2026-96294 HIGH 8.7 Apache Thrift — Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings… 2026-10-02 CVE-2026-96990 HIGH 8.2 Apache Thrift — Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This i… 2026-10-02 CVE-2026-42356 LOW 3.7 Apache Http Server — Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects f… 2026-10-01 CVE-2026-42528 MEDIUM 4.3 Apache Http Server — A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to c… 2026-10-01 CVE-2026-46729 HIGH 7.5 Apache Http Server — NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This … 2026-10-01 CVE-2026-47360 HIGH 7.5 Apache Http Server — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_c… 2026-10-01 CVE-2026-48005 HIGH 7.5 Apache Http Server — Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.6… 2026-10-01 CVE-2026-56153 HIGH 7.5 Apache Http Server — Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP … 2026-10-01 CVE-2026-56154 CRITICAL 9.8 Apache Http Server — Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) Th… 2026-10-01 CVE-2026-56449 HIGH 7.5 Apache Http Server — Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. … 2026-10-01 CVE-2026-57941 CRITICAL 9.8 Apache Http Server — Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This i… 2026-10-01 CVE-2026-58415 MEDIUM 5.3 Apache Http Server — Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Se… 2026-10-01 CVE-2026-59685 HIGH 7.5 Apache Http Server — Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that … 2026-10-01 CVE-2026-59797 CRITICAL 9.8 Apache Http Server — Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related ex… 2026-10-01 CVE-2026-63045 HIGH 7.5 Apache Http Server — Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Serve… 2026-10-01 CVE-2026-63292 HIGH 7.5 Apache Http Server — Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68… 2026-10-01 CVE-2026-63686 HIGH 7.5 Apache Http Server — A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on al… 2026-10-01 CVE-2026-63718 HIGH 7.5 Apache Http Server — Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerabil… 2026-10-01 CVE-2026-73636 HIGH 8.1 Apache Http Server — Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.… 2026-10-01 CVE-2026-73637 HIGH 7.3 Apache Http Server — Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platfo… 2026-10-01 CVE-2026-78242 MEDIUM 5.7 Apache Apisix — Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cau… 2026-10-01 CVE-2026-79768 MEDIUM 5.3 Apache Http Server — Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when c… 2026-10-01 CVE-2026-82806 MEDIUM 5.3 Apache Apisix — Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX:… 2026-10-01 CVE-2026-88789 HIGH 8.6 Apache Camel Quarkus — Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xal… 2026-10-01 CVE-2026-93546 HIGH 8.8 Apache Http Server — Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with… 2026-10-01 CVE-2026-94212 MEDIUM 6.4 Apache Apisix — Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attack… 2026-10-01 CVE-2026-94220 LOW 2.1 Apache Apisix — Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. … 2026-10-01 CVE-2026-94250 HIGH 8.2 Apache Apisix — Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. … 2026-10-01 CVE-2026-94269 MEDIUM 6.3 Apache Apisix — Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configur… 2026-10-01 CVE-2026-94276 MEDIUM 5.1 Apache Apisix — Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote in… 2026-10-01 CVE-2026-102508 CRITICAL 9.2 Apache Plc4x — Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of A… 2026-09-30 CVE-2026-102509 HIGH 8.7 Apache Plc4x — Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursio… 2026-09-30 CVE-2026-102510 HIGH 8.7 Apache Plc4x — Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excess… 2026-09-30 CVE-2026-102511 HIGH 8.5 Apache Plc4x — Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Ap… 2026-09-30 CVE-2026-77185 CRITICAL 9.1 Apache Mina Sshd — Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a… 2026-09-30 CVE-2026-85532 HIGH 7.5 Apache Wss4j — Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could … 2026-09-30 CVE-2026-87830 CRITICAL 9.1 Apache Wss4j — In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be co… 2026-09-30 CVE-2026-88920 CRITICAL 9.8 Apache Wss4j — An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers… 2026-09-30 CVE-2026-89238 CRITICAL 9.1 Apache Wss4j — WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted … 2026-09-30 CVE-2026-92121 HIGH 7.5 Apache Wss4j — In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an intern… 2026-09-30 CVE-2026-92899 MEDIUM 4.8 Apache Wss4j — Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It st… 2026-09-30 CVE-2026-93994 HIGH 8.1 Apache Mina Sshd — Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to requi… 2026-09-30 CVE-2026-93995 MEDIUM 6.5 Apache Mina Sshd — Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apa… 2026-09-30 CVE-2026-93996 MEDIUM 6.5 Apache Mina Sshd — Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 t… 2026-09-30 CVE-2026-94002 HIGH 7.5 Apache Mina Sshd — Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD vers… 2026-09-30 CVE-2026-94029 MEDIUM 6.5 Apache Mina Sshd — Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sft… 2026-09-30 CVE-2026-94052 CRITICAL 9.1 Apache Mina Sshd — A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19… 2026-09-30 CVE-2026-94053 CRITICAL 9.1 Apache Mina Sshd — Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 a… 2026-09-30 CVE-2026-95616 HIGH 7.5 Apache Wss4j — An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticat… 2026-09-30 CVE-2026-102495 HIGH 7.5 Apache Xmlschema — Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can… 2026-09-29 CVE-2026-102496 HIGH 7.5 Apache Xmlschema — Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so … 2026-09-29 CVE-2026-102497 HIGH 7.5 Apache Xmlschema — The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, … 2026-09-29 CVE-2026-66083 MEDIUM 6.5 Apache Dolphinscheduler — The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authentica… 2026-09-29 CVE-2026-71897 MEDIUM 4.3 Apache Dolphinscheduler — An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy … 2026-09-29 CVE-2026-71898 MEDIUM 4.3 Apache Dolphinscheduler — An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permis… 2026-09-29 CVE-2026-71899 MEDIUM 6.5 Apache Dolphinscheduler — A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinSchedul… 2026-09-29 CVE-2026-78214 MEDIUM 5.3 Apache Dolphinscheduler — An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determi… 2026-09-29 CVE-2026-81569 MEDIUM 4.3 Apache Dolphinscheduler — An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user wh… 2026-09-29 CVE-2026-81862 MEDIUM 6.5 Apache Airflow Teradata Provider — Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTerad… 2026-09-29 CVE-2026-81914 MEDIUM 4.3 Apache Airflow Google Provider — Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names … 2026-09-29 CVE-2026-81930 MEDIUM 6.3 Apache Airflow Snowflake Provider — Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before int… 2026-09-29 CVE-2026-82804 HIGH 8.8 Apache Dolphinscheduler — The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell … 2026-09-29 CVE-2026-86843 MEDIUM 6.3 Apache Airflow Teradata Provider — The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unc… 2026-09-29 CVE-2026-91012 CRITICAL 9.8 Apache Karaf — org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean… 2026-09-29 CVE-2026-91048 CRITICAL 9.8 Apache Karaf — The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredS… 2026-09-29 CVE-2026-91085 MEDIUM 6.3 Apache Karaf — Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.kar… 2026-09-29 CVE-2026-92142 HIGH 8.8 Apache Karaf — Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access cont… 2026-09-29 CVE-2026-97395 HIGH 8.1 Apache Polaris — Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties … 2026-09-29 CVE-2026-82348 HIGH 7.7 Apache Roller — Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with auth… 2026-09-28 CVE-2026-82375 HIGH 7.4 Apache Roller — Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing righ… 2026-09-28 CVE-2026-82376 HIGH 7.7 Apache Roller — Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing … 2026-09-28 CVE-2026-82377 CRITICAL 9.9 Apache Roller — Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog co… 2026-09-28 CVE-2026-82378 CRITICAL 9 Apache Roller — Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthentica… 2026-09-28 CVE-2026-82379 HIGH 7.7 Apache Roller — Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE di… 2026-09-28 CVE-2026-82380 HIGH 8.1 Apache Roller — Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to… 2026-09-28 CVE-2026-82381 MEDIUM 5.4 Apache Roller — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 al… 2026-09-28 CVE-2026-82382 MEDIUM 6.1 Apache Roller — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 al… 2026-09-28 CVE-2026-82383 HIGH 8.2 Apache Roller — Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker … 2026-09-28 CVE-2026-82384 CRITICAL 9.8 Apache Roller — Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause de… 2026-09-28 CVE-2026-82385 MEDIUM 6.5 Apache Roller — Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrato… 2026-09-28 CVE-2026-82386 HIGH 7.7 Apache Roller — Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to … 2026-09-28 CVE-2026-82387 MEDIUM 5.4 Apache Roller — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 al… 2026-09-28 CVE-2026-82546 MEDIUM 6.1 Apache Roller — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 al… 2026-09-28 CVE-2026-86507 MEDIUM 6.1 Apache Roller — Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted… 2026-09-28 CVE-2026-90979 HIGH 7.3 Apache Karaf — LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substit… 2026-09-28 CVE-2026-91006 HIGH 8.8 Apache Karaf — Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a chil… 2026-09-28 CVE-2026-91204 MEDIUM 6.1 Apache Roller — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 al… 2026-09-28 CVE-2026-91206 MEDIUM 6.1 Apache Roller — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 al… 2026-09-28 CVE-2026-92550 HIGH 7.5 Apache Qpid Broker J — A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to… 2026-09-25 CVE-2026-92560 HIGH 7.5 Apache Qpid Broker J — A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to… 2026-09-25 CVE-2026-92564 HIGH 7.5 Apache Qpid Broker J — A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to… 2026-09-25 CVE-2026-92573 MEDIUM 6.5 Apache Qpid Broker J — Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10… 2026-09-25 CVE-2026-92608 HIGH 7.5 Apache Qpid Broker J — Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authentic… 2026-09-25 CVE-2026-92609 CRITICAL 9.8 Apache Qpid Broker J — Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an a… 2026-09-25 CVE-2026-57590 HIGH 8.1 Apache Dolphinscheduler — A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected A… 2026-09-24 CVE-2026-97636 MEDIUM 6.5 Apache Airflow Hashicorp Provider — Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with… 2026-09-24 CVE-2026-31377 HIGH 7.5 Apache Doris — An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthentica… 2026-09-23 CVE-2026-73192 MEDIUM 6.1 Apache Sling Xss — An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability… 2026-09-23 CVE-2026-73581 MEDIUM 6.5 Apache Tomcat — Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS… 2026-09-23 CVE-2026-75973 HIGH 7.3 Apache Tomcat — Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with Simple… 2026-09-23 CVE-2026-76183 CRITICAL 9.8 Apache Tomcat — Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for an… 2026-09-23 CVE-2026-77756 LOW 3.7 Apache Tomcat — Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomca… 2026-09-23 CVE-2026-77762 HIGH 8.1 Apache Tomcat — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in A… 2026-09-23 CVE-2026-77791 HIGH 7.5 Apache Tomcat — Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message ena… 2026-09-23 CVE-2026-78383 HIGH 7.5 Apache Tomcat — Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated … 2026-09-23