Apache vulnerabilities
We track 1,499 vulnerabilities in Apache products across 60+ products. 1,499 are rated high or critical, and 46 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Apache vulnerabilities
- 7.5 High severity
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill…
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.
- 9.8 Critical severity
Apache Airflow Hive Provider: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.
- 7.8 High severity
Apache James server: Missing Authorization
Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that versio
- 8.8 High severity
Apache UIMA DUCC: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA,
- 9.8 Critical severity
Apache OpenMeetings: Missing Authentication for Critical Functionality
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
- 8.1 High severity
Apache Fineract: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from
- 8.8 High severity
Apache InLong: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability. This issue affects Apache InLong: from 1.1.0 thro
- 7.8 High severity
Apache OpenOffice documents can contain links that call internal macros with arbitrary…
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject t
- 7.8 High severity
Apache OpenOffice: Improper Control of Generation of Code
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
- 7.5 High severity
Apache Sling Resource Merger: Excessive Iteration
Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.
- 7.5 High severity
Apache Log4j: Deserialization of Untrusted Data
** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on whi
- 9.8 Critical severity
Apache Dubbo: Deserialization of Untrusted Data
A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x v
- 7.5 High severity
Apache HTTP Server: Inconsistent Interpretation of HTTP Requests
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
- 9.8 Critical severity
Apache HTTP Server: Inconsistent Interpretation of HTTP Requests
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern
- 7.5 High severity
Apache Airflow AWS Provider: Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1.
- 7.5 High severity
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
- 9.8 Critical severity
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
- 7.5 High severity
Apache Commons FileUpload: Allocation of Resources Without Limits or Throttling
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new co
- 8.8 High severity
Apache ShenYu: Improper Privilege Management
Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache S
- 7.5 High severity
Apache Sling JCR Base: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in RepositoryAccessor. The functions getRepository and getRepositoryFromURL allow an application to access
- 7.5 High severity
Apache NiFi: Improper Restriction of XML External Entity Reference
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type
- 8.8 High severity
Apache Kafka Connect API: Deserialization of Untrusted Data
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security proto
- 8.1 High severity
Apache AGE: Improper Neutralization of Special Elements used in an SQL Command
There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Go
- 9.8 Critical severity
Apache InLong: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlo
- 7.5 High severity
Apache InLong: Out-of-bounds Read
Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 ht
- 9.8 Critical severity
Apache Portable Runtime (APR): Integer Overflow or Wraparound
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
- 9.8 Critical severity
Apache Portable Runtime (APR): Integer Overflow or Wraparound
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
- 8.8 High severity
Apache IoTDB Workbench: Incorrect Authorization
Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. Thi
- 8.8 High severity
Apache Linkis (incubating): Deserialization of Untrusted Data
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and maliciou
- 7.5 High severity
Apache IoTDB Workbench: Improper Authentication
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3.
- 9.8 Critical severity
Apache Airflow: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Air
- 9.0 Critical severity
Apache HTTP Server: Inconsistent Interpretation of HTTP Requests
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Ser
- 8.8 High severity
Apache Superset: Cross-Site Request Forgery
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
- 7.5 High severity
Apache Shiro: Interpretation Conflict
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro a
- 9.8 Critical severity
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid…
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be
- 7.5 High severity
Apache Tomcat: Improper Encoding or Escaping of Output
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to su
- 8.8 High severity
Apache Kylin: Incomplete List of Disallowed Inputs
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
- 9.8 Critical severity
Apache ShardingSphere-Proxy: Incomplete Cleanup
Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This
- 9.8 Critical severity
This vulnerable is about a potential code injection when an attacker has control of the target…
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.l
- 9.8 Critical severity
Apache Airflow Hive Provider: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.