{"items":[{"id":"CVE-2026-59267","published":"2026-11-04T11:05:59.742Z","updated":"2026-11-05T04:55:45.872Z","title":"Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption","severity":"MEDIUM","score":5.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90632","published":"2026-11-04T11:05:00.779Z","updated":"2026-11-04T12:13:36.528Z","title":"Apache OpenOffice: Local file inclusion via GStreamer plugin","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90634","published":"2026-11-04T11:04:38.055Z","updated":"2026-11-05T04:55:46.666Z","title":"Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90631","published":"2026-11-04T11:04:29.104Z","updated":"2026-11-04T13:56:02.095Z","title":"Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables","severity":"LOW","score":3.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90629","published":"2026-11-04T11:04:07.403Z","updated":"2026-11-05T04:55:47.427Z","title":"Apache OpenOffice: Out of bounds memory access during WMF import","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90628","published":"2026-11-04T11:03:41.225Z","updated":"2026-11-05T04:55:48.177Z","title":"Apache OpenOffice: Stack overflow in CFF hint handling","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90627","published":"2026-11-04T11:03:29.974Z","updated":"2026-11-04T14:20:48.394Z","title":"Apache OpenOffice: Local file inclusion via SQL provider and flat file database references","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90626","published":"2026-11-04T11:03:17.916Z","updated":"2026-11-05T04:55:48.922Z","title":"Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-90624","published":"2026-11-04T11:03:06.309Z","updated":"2026-11-05T04:55:50.416Z","title":"Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-59268","published":"2026-11-04T11:02:53.963Z","updated":"2026-11-05T04:55:51.133Z","title":"Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-59264","published":"2026-11-04T11:02:42.505Z","updated":"2026-11-05T04:55:51.929Z","title":"Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-59263","published":"2026-11-04T11:01:51.518Z","updated":"2026-11-04T15:18:54.875Z","title":"Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.","severity":"LOW","score":1.9,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-100302","published":"2026-11-04T10:46:20.042Z","updated":"2026-11-04T15:18:55.017Z","title":"Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-115448","published":"2026-11-04T10:45:43.898Z","updated":"2026-11-04T15:18:55.166Z","title":"Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-100300","published":"2026-11-04T10:45:14.858Z","updated":"2026-11-04T15:18:55.306Z","title":"Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-100252","published":"2026-11-04T10:44:17.367Z","updated":"2026-11-05T04:55:52.687Z","title":"Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID","severity":"HIGH","score":8.6,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-100235","published":"2026-11-04T10:43:21.364Z","updated":"2026-11-04T11:09:04.801Z","title":"Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation","severity":"MEDIUM","score":6,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-108500","published":"2026-11-04T10:37:55.532Z","updated":"2026-11-04T11:10:16.981Z","title":"Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-103582","published":"2026-11-04T10:16:45.506Z","updated":"2026-11-04T11:10:00.963Z","title":"Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ NMS OpenWire Client Library","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-108946","published":"2026-11-04T10:14:06.196Z","updated":"2026-11-04T12:11:22.685Z","title":"Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-111822","published":"2026-11-04T10:12:08.183Z","updated":"2026-11-04T12:11:26.492Z","title":"Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-111821","published":"2026-11-04T10:10:31.596Z","updated":"2026-11-04T10:10:41.422Z","title":"Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-108949","published":"2026-11-04T10:09:31.906Z","updated":"2026-11-04T21:12:40.400Z","title":"Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":null,"kevAdded":null},{"id":"CVE-2026-114442","published":"2026-11-03T10:21:06.018Z","updated":"2026-11-03T10:21:06.018Z","title":"Apache HertzBeat: incomplete XPath expression validation in aliasFields","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-119641","published":"2026-11-03T09:41:17.072Z","updated":"2026-11-03T10:07:57.037Z","title":"Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Oozie","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-119724","published":"2026-11-03T09:38:49.421Z","updated":"2026-11-03T10:07:59.286Z","title":"Apache JClouds: XML External Entity (XXE) in provider-response parsing","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache JClouds","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-111959","published":"2026-11-02T13:34:17.835Z","updated":"2026-11-02T20:05:09.522Z","title":"Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Arrow Rust","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-114364","published":"2026-11-02T13:12:27.512Z","updated":"2026-11-02T13:12:27.512Z","title":"Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-113687","published":"2026-11-02T13:10:11.700Z","updated":"2026-11-02T21:05:13.726Z","title":"Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00225,"kevAdded":null},{"id":"CVE-2026-113511","published":"2026-11-02T13:08:12.025Z","updated":"2026-11-02T21:05:12.418Z","title":"Apache Syncope: Delegated administration boundaries can be bypassed for Realm update","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-110535","published":"2026-11-02T13:06:00.159Z","updated":"2026-11-02T21:05:11.104Z","title":"Apache Syncope: AuthProfile value escalation via self-service update","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.0026,"kevAdded":null},{"id":"CVE-2026-109083","published":"2026-11-02T13:04:15.094Z","updated":"2026-11-02T21:05:09.784Z","title":"Apache Syncope: Remote Code Execution via Flowable JUEL expression","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-111089","published":"2026-11-01T22:32:09.104Z","updated":"2026-11-01T22:32:09.104Z","title":"Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-95863","published":"2026-11-01T22:30:47.259Z","updated":"2026-11-01T22:30:47.259Z","title":"Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-87718","published":"2026-11-01T22:28:35.032Z","updated":"2026-11-01T22:28:35.032Z","title":"Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-84231","published":"2026-11-01T22:26:18.525Z","updated":"2026-11-01T22:26:18.525Z","title":"Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00333,"kevAdded":null},{"id":"CVE-2026-84177","published":"2026-11-01T22:25:22.130Z","updated":"2026-11-01T22:25:22.130Z","title":"Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-84172","published":"2026-11-01T22:24:14.937Z","updated":"2026-11-01T22:24:14.937Z","title":"Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-84170","published":"2026-11-01T22:22:48.811Z","updated":"2026-11-01T22:22:48.811Z","title":"Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-83594","published":"2026-11-01T22:21:13.833Z","updated":"2026-11-01T22:21:13.833Z","title":"Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-83559","published":"2026-11-01T22:19:47.951Z","updated":"2026-11-01T22:19:47.951Z","title":"Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-83539","published":"2026-11-01T22:18:13.427Z","updated":"2026-11-01T22:18:13.427Z","title":"Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-82956","published":"2026-11-01T22:16:45.576Z","updated":"2026-11-01T22:16:45.576Z","title":"Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-82898","published":"2026-11-01T22:14:06.838Z","updated":"2026-11-01T22:14:06.838Z","title":"Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-82840","published":"2026-11-01T22:05:07.392Z","updated":"2026-11-01T22:05:07.392Z","title":"Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-82705","published":"2026-11-01T22:03:23.040Z","updated":"2026-11-01T22:03:23.040Z","title":"Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-82704","published":"2026-11-01T22:01:51.169Z","updated":"2026-11-01T22:01:51.169Z","title":"Apache Wicket: A listener is invoked on a page instance the request itself created and never configured","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-82559","published":"2026-11-01T22:00:24.598Z","updated":"2026-11-01T22:00:24.598Z","title":"Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-82558","published":"2026-11-01T21:58:28.610Z","updated":"2026-11-01T21:58:28.610Z","title":"Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-82557","published":"2026-11-01T21:56:01.071Z","updated":"2026-11-01T21:56:01.071Z","title":"Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00295,"kevAdded":null},{"id":"CVE-2026-82115","published":"2026-11-01T21:42:45.222Z","updated":"2026-11-01T21:42:45.222Z","title":"Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-120135","published":"2026-10-31T20:33:00.088Z","updated":"2026-10-31T21:08:29.726Z","title":"Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-118636","published":"2026-10-31T20:17:11.191Z","updated":"2026-10-31T21:08:27.192Z","title":"Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2026-73322","published":"2026-10-30T18:10:09.341Z","updated":"2026-10-30T19:04:44.187Z","title":"Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Pinot","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-64618","published":"2026-10-30T08:29:02.904Z","updated":"2026-10-30T09:10:27.784Z","title":"Apache Fineract: SQL injection vulnerability in Search API","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00624,"kevAdded":null},{"id":"CVE-2026-65874","published":"2026-10-30T08:18:08.619Z","updated":"2026-10-30T09:10:29.643Z","title":"Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2026-71569","published":"2026-10-29T10:31:01.478Z","updated":"2026-10-29T13:07:12.410Z","title":"Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2026-115942","published":"2026-10-29T10:19:58.757Z","updated":"2026-10-29T11:09:37.028Z","title":"Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-114230","published":"2026-10-29T10:19:15.580Z","updated":"2026-10-29T11:09:06.927Z","title":"Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-105042","published":"2026-10-29T10:17:20.853Z","updated":"2026-10-29T11:08:30.677Z","title":"Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-105031","published":"2026-10-29T10:16:41.384Z","updated":"2026-10-29T11:08:28.567Z","title":"Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton C","kev":false,"epss":0.00134,"kevAdded":null},{"id":"CVE-2026-114349","published":"2026-10-28T16:46:54.920Z","updated":"2026-10-29T13:48:26.738Z","title":"Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-112375","published":"2026-10-28T16:46:38.006Z","updated":"2026-10-28T16:46:38.006Z","title":"Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-116593","published":"2026-10-28T16:46:21.415Z","updated":"2026-10-30T12:25:18.712Z","title":"Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-115644","published":"2026-10-28T16:45:36.440Z","updated":"2026-10-28T20:07:00.157Z","title":"Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-111551","published":"2026-10-28T16:45:25.163Z","updated":"2026-10-28T20:06:57.172Z","title":"Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-111496","published":"2026-10-28T16:45:08.114Z","updated":"2026-10-28T20:06:55.726Z","title":"Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-111115","published":"2026-10-28T16:44:53.268Z","updated":"2026-10-28T20:06:54.294Z","title":"Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2026-111108","published":"2026-10-28T16:38:08.524Z","updated":"2026-10-28T20:06:52.812Z","title":"Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00266,"kevAdded":null},{"id":"CVE-2026-111073","published":"2026-10-28T16:37:58.482Z","updated":"2026-10-28T20:06:51.327Z","title":"Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-110985","published":"2026-10-28T16:37:45.688Z","updated":"2026-10-28T16:37:45.688Z","title":"Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00126,"kevAdded":null},{"id":"CVE-2026-110952","published":"2026-10-28T16:37:34.723Z","updated":"2026-10-28T16:37:34.723Z","title":"Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00123,"kevAdded":null},{"id":"CVE-2026-83525","published":"2026-10-28T16:37:19.893Z","updated":"2026-10-28T20:07:03.066Z","title":"Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.","severity":"UNKNOWN","score":null,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-111422","published":"2026-10-26T23:29:30.363Z","updated":"2026-10-29T10:38:09.290Z","title":"Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow SSH provider","kev":false,"epss":0.00643,"kevAdded":null},{"id":"CVE-2026-115748","published":"2026-10-26T15:01:40.644Z","updated":"2026-11-02T21:22:43.925Z","title":"Apache Vysper: Authorization bypass","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Vysper","kev":false,"epss":0.00613,"kevAdded":null},{"id":"CVE-2026-115721","published":"2026-10-26T15:01:18.445Z","updated":"2026-11-02T21:21:31.594Z","title":"Apache Vysper: Unbounded allocation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Vysper","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2026-90885","published":"2026-10-26T14:47:03.155Z","updated":"2026-10-26T15:35:49.414Z","title":"Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2026-94386","published":"2026-10-26T14:46:11.551Z","updated":"2026-10-26T15:35:49.712Z","title":"Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-110748","published":"2026-10-26T14:40:39.690Z","updated":"2026-11-03T17:22:30.459Z","title":"Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache SIS","kev":false,"epss":0.00141,"kevAdded":null},{"id":"CVE-2026-110733","published":"2026-10-26T14:15:55.097Z","updated":"2026-10-26T16:29:01.382Z","title":"Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache SIS","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-95628","published":"2026-10-26T08:48:48.344Z","updated":"2026-10-26T14:35:19.442Z","title":"Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-95629","published":"2026-10-26T08:44:22.849Z","updated":"2026-11-02T20:57:40.733Z","title":"Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-95663","published":"2026-10-26T08:42:17.403Z","updated":"2026-11-02T20:57:13.675Z","title":"Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-95664","published":"2026-10-26T08:40:32.068Z","updated":"2026-11-02T18:25:14.208Z","title":"Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00836,"kevAdded":null},{"id":"CVE-2026-101259","published":"2026-10-26T08:36:47.439Z","updated":"2026-11-02T20:55:56.941Z","title":"Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-113582","published":"2026-10-22T13:27:11.536Z","updated":"2026-10-30T18:46:10.568Z","title":"Apache Abdera: XML external entity expansion in Atom document parsing","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Abdera","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-103634","published":"2026-10-22T06:42:20.454Z","updated":"2026-10-26T13:43:13.987Z","title":"Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache DataSketches","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-112381","published":"2026-10-21T19:20:38.885Z","updated":"2026-10-23T21:20:44.000Z","title":"Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-111817","published":"2026-10-21T19:20:00.515Z","updated":"2026-10-23T21:21:06.850Z","title":"Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-111812","published":"2026-10-21T19:18:19.526Z","updated":"2026-10-23T11:06:21.577Z","title":"Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-111811","published":"2026-10-21T19:17:32.448Z","updated":"2026-10-23T11:06:21.737Z","title":"Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-111809","published":"2026-10-21T19:16:16.439Z","updated":"2026-10-28T01:34:23.820Z","title":"Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00218,"kevAdded":null},{"id":"CVE-2026-111810","published":"2026-10-21T19:14:50.479Z","updated":"2026-10-23T21:21:35.176Z","title":"Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-111815","published":"2026-10-21T19:13:55.811Z","updated":"2026-10-23T11:06:21.881Z","title":"Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-111814","published":"2026-10-21T19:13:06.888Z","updated":"2026-10-23T11:06:22.026Z","title":"Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00235,"kevAdded":null},{"id":"CVE-2026-111808","published":"2026-10-21T19:11:59.516Z","updated":"2026-10-23T21:22:09.150Z","title":"Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-111805","published":"2026-10-21T19:10:46.319Z","updated":"2026-10-23T21:22:42.961Z","title":"Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-111816","published":"2026-10-21T18:26:32.566Z","updated":"2026-10-23T21:22:57.204Z","title":"Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2025-55702","published":"2026-10-21T18:24:21.377Z","updated":"2026-10-23T11:06:22.172Z","title":"Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2025-31699","published":"2026-10-21T18:22:28.383Z","updated":"2026-10-23T11:06:22.325Z","title":"Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-111804","published":"2026-10-21T18:21:32.055Z","updated":"2026-10-23T21:23:16.760Z","title":"Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-111813","published":"2026-10-21T18:20:22.104Z","updated":"2026-10-23T11:06:22.469Z","title":"Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2026-105945","published":"2026-10-21T18:18:26.687Z","updated":"2026-10-23T21:57:38.167Z","title":"Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00494,"kevAdded":null},{"id":"CVE-2026-105944","published":"2026-10-21T18:17:37.844Z","updated":"2026-10-23T21:57:46.976Z","title":"Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Pulsar Manager","kev":false,"epss":0.00703,"kevAdded":null},{"id":"CVE-2026-105942","published":"2026-10-21T18:14:35.996Z","updated":"2026-10-23T21:58:05.657Z","title":"Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-105938","published":"2026-10-21T18:13:35.337Z","updated":"2026-10-23T21:58:15.976Z","title":"Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-105937","published":"2026-10-21T18:12:51.420Z","updated":"2026-10-23T21:58:44.482Z","title":"Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-105936","published":"2026-10-21T18:11:20.520Z","updated":"2026-10-23T21:59:10.187Z","title":"Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-105935","published":"2026-10-21T18:10:24.056Z","updated":"2026-10-23T21:59:37.544Z","title":"Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-105934","published":"2026-10-21T18:08:43.192Z","updated":"2026-10-23T22:00:04.202Z","title":"Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-105933","published":"2026-10-21T18:07:43.954Z","updated":"2026-10-23T22:00:14.676Z","title":"Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-105932","published":"2026-10-21T18:06:59.228Z","updated":"2026-10-23T22:04:58.691Z","title":"Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-105931","published":"2026-10-21T18:02:31.976Z","updated":"2026-10-30T18:20:46.202Z","title":"Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-105930","published":"2026-10-21T18:01:29.744Z","updated":"2026-10-26T14:35:21.565Z","title":"Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download","severity":"MEDIUM","score":6,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2026-105927","published":"2026-10-21T18:00:31.871Z","updated":"2026-10-30T18:17:18.420Z","title":"Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-105926","published":"2026-10-21T17:59:55.207Z","updated":"2026-10-30T18:15:49.239Z","title":"Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-105869","published":"2026-10-21T17:58:54.385Z","updated":"2026-10-30T18:12:40.695Z","title":"Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-90484","published":"2026-10-21T12:19:37.796Z","updated":"2026-10-26T13:39:12.101Z","title":"Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-87849","published":"2026-10-21T12:18:29.706Z","updated":"2026-10-26T13:54:40.137Z","title":"Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-86249","published":"2026-10-21T12:17:42.903Z","updated":"2026-10-30T17:05:52.803Z","title":"Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00561,"kevAdded":null},{"id":"CVE-2026-86147","published":"2026-10-21T12:16:22.369Z","updated":"2026-10-30T14:45:54.782Z","title":"Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2026-86146","published":"2026-10-21T12:15:26.421Z","updated":"2026-10-30T14:40:59.777Z","title":"Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2026-84748","published":"2026-10-21T12:14:28.591Z","updated":"2026-10-30T14:39:56.499Z","title":"Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-84747","published":"2026-10-21T12:13:28.033Z","updated":"2026-10-30T14:39:07.800Z","title":"Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-84727","published":"2026-10-21T12:11:48.638Z","updated":"2026-10-21T13:18:05.045Z","title":"Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-82953","published":"2026-10-21T12:10:07.391Z","updated":"2026-10-26T13:55:45.295Z","title":"Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2026-82942","published":"2026-10-21T12:07:15.689Z","updated":"2026-10-30T14:35:42.017Z","title":"Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-82425","published":"2026-10-21T12:05:07.045Z","updated":"2026-10-30T14:33:32.475Z","title":"Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-82231","published":"2026-10-21T12:04:19.454Z","updated":"2026-10-30T14:30:01.845Z","title":"Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-82230","published":"2026-10-21T12:03:04.835Z","updated":"2026-10-21T15:11:15.223Z","title":"Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2026-82210","published":"2026-10-21T12:01:31.264Z","updated":"2026-10-30T14:25:54.253Z","title":"Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2026-81755","published":"2026-10-21T11:58:26.104Z","updated":"2026-10-30T14:22:06.684Z","title":"Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2026-80463","published":"2026-10-21T11:57:30.211Z","updated":"2026-10-30T14:18:35.910Z","title":"Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-79704","published":"2026-10-21T11:56:20.309Z","updated":"2026-10-30T17:03:38.510Z","title":"Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-78334","published":"2026-10-21T11:54:24.478Z","updated":"2026-10-30T17:01:12.646Z","title":"Apache bRPC: Missing Authentication for Streaming RPC Frames","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00663,"kevAdded":null},{"id":"CVE-2026-78066","published":"2026-10-21T11:53:42.058Z","updated":"2026-10-30T16:59:10.006Z","title":"Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-78058","published":"2026-10-21T11:52:57.984Z","updated":"2026-10-30T16:55:00.165Z","title":"Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0081,"kevAdded":null},{"id":"CVE-2026-78048","published":"2026-10-21T11:51:58.752Z","updated":"2026-10-30T16:49:25.386Z","title":"Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-74758","published":"2026-10-21T11:48:23.883Z","updated":"2026-10-30T16:47:23.207Z","title":"Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-74757","published":"2026-10-21T11:46:17.285Z","updated":"2026-10-26T13:40:04.776Z","title":"Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-74755","published":"2026-10-21T11:45:25.658Z","updated":"2026-10-30T17:56:42.592Z","title":"Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-66392","published":"2026-10-21T11:43:52.622Z","updated":"2026-10-30T17:54:51.981Z","title":"Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-61916","published":"2026-10-21T11:42:46.023Z","updated":"2026-10-30T14:14:07.721Z","title":"Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-61902","published":"2026-10-21T11:41:56.277Z","updated":"2026-10-30T14:10:48.052Z","title":"Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2026-58064","published":"2026-10-21T11:41:13.666Z","updated":"2026-10-30T14:05:38.961Z","title":"Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-56388","published":"2026-10-21T11:40:41.743Z","updated":"2026-10-30T13:57:52.012Z","title":"Apache bRPC: Out-of-Bounds Write in Redis Command Parser","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00953,"kevAdded":null},{"id":"CVE-2026-56387","published":"2026-10-21T11:39:11.225Z","updated":"2026-10-30T13:56:20.160Z","title":"Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-56386","published":"2026-10-21T11:37:47.458Z","updated":"2026-10-21T13:07:53.942Z","title":"Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-54427","published":"2026-10-21T11:36:40.517Z","updated":"2026-10-30T13:54:26.962Z","title":"Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2026-54426","published":"2026-10-21T11:32:19.591Z","updated":"2026-10-30T13:46:51.555Z","title":"Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2026-54425","published":"2026-10-21T11:31:19.989Z","updated":"2026-10-30T13:45:53.356Z","title":"Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2026-48830","published":"2026-10-21T11:30:15.288Z","updated":"2026-10-30T13:38:36.145Z","title":"Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-59229","published":"2026-10-21T11:11:46.924Z","updated":"2026-10-30T13:33:53.498Z","title":"Apache IoTDB: Legacy Pipe Privilege Escalation","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-59562","published":"2026-10-21T11:10:26.319Z","updated":"2026-10-30T17:53:15.072Z","title":"Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2026-41114","published":"2026-10-21T11:07:24.947Z","updated":"2026-10-30T17:49:40.907Z","title":"Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB JDBC driver","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2026-58663","published":"2026-10-21T11:03:23.887Z","updated":"2026-10-30T17:46:13.409Z","title":"Apache IoTDB: Auth Bypass in pipeTransfer() interface","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2026-107755","published":"2026-10-20T15:41:22.248Z","updated":"2026-10-20T18:09:53.132Z","title":"Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs","severity":"MEDIUM","score":6,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-90800","published":"2026-10-20T15:40:47.497Z","updated":"2026-10-20T18:10:09.013Z","title":"Apache CouchDB: Auth bypass in prefixed _users and _replicator databases","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.00633,"kevAdded":null},{"id":"CVE-2026-90799","published":"2026-10-20T15:40:16.600Z","updated":"2026-10-20T18:10:08.069Z","title":"Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values","severity":"LOW","score":1.3,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-90798","published":"2026-10-20T15:39:52.048Z","updated":"2026-10-20T18:10:07.139Z","title":"Apache CouchDB: Replicator follows redirects indefinitely","severity":"LOW","score":0.6,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2026-90797","published":"2026-10-20T15:39:23.376Z","updated":"2026-10-20T18:10:06.210Z","title":"Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2026-86471","published":"2026-10-20T15:38:09.681Z","updated":"2026-10-21T03:56:24.122Z","title":"Apache CouchDB: Admin credentials leading to code execution as operating system user","severity":"CRITICAL","score":9.3,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.00606,"kevAdded":null},{"id":"CVE-2026-103119","published":"2026-10-20T13:54:13.558Z","updated":"2026-10-20T18:09:52.183Z","title":"Apache Tomcat: AJP response mix-up","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00586,"kevAdded":null},{"id":"CVE-2026-101356","published":"2026-10-20T13:46:50.842Z","updated":"2026-10-20T18:17:42.030Z","title":"Apache Tomcat: HTTP/2 request/response mix-up after error during async processing","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-101296","published":"2026-10-20T13:45:39.959Z","updated":"2026-10-21T06:31:55.233Z","title":"Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2026-93446","published":"2026-10-20T13:44:35.673Z","updated":"2026-10-29T17:57:06.247Z","title":"Apache Tomcat: Possible TLS 1.3 connection failures","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2026-88041","published":"2026-10-20T13:43:28.681Z","updated":"2026-10-29T17:54:59.322Z","title":"Apache Tomcat: HTTP/2 trailer header cross-contamination","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-80353","published":"2026-10-20T13:42:05.844Z","updated":"2026-10-29T17:50:58.393Z","title":"Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-74049","published":"2026-10-20T13:37:43.471Z","updated":"2026-10-29T17:47:31.001Z","title":"Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-74048","published":"2026-10-20T13:36:36.859Z","updated":"2026-10-29T17:45:04.109Z","title":"Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-108089","published":"2026-10-20T10:25:54.169Z","updated":"2026-10-20T18:09:56.937Z","title":"Apache Cocoon: Unauthenticated access to diagnostic interfaces","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2026-108088","published":"2026-10-20T10:25:33.049Z","updated":"2026-10-29T17:33:40.096Z","title":"Apache Cocoon: Cross-user cache poisoning","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-108087","published":"2026-10-20T10:25:12.654Z","updated":"2026-10-29T18:21:55.393Z","title":"Apache Cocoon: SQL Injection","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2026-108086","published":"2026-10-20T10:24:53.426Z","updated":"2026-10-29T18:19:05.421Z","title":"Apache Cocoon: XEE could lead to SSRF and information disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-92287","published":"2026-10-20T08:15:13.747Z","updated":"2026-10-29T18:12:50.412Z","title":"Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Arrow C++","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-86467","published":"2026-10-20T02:37:07.184Z","updated":"2026-10-29T18:02:32.886Z","title":"Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Amazon provider","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-88900","published":"2026-10-19T11:07:34.371Z","updated":"2026-10-20T03:55:30.209Z","title":"Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00689,"kevAdded":null},{"id":"CVE-2026-91858","published":"2026-10-19T10:47:48.267Z","updated":"2026-10-19T14:30:10.376Z","title":"Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-88901","published":"2026-10-19T10:44:07.084Z","updated":"2026-10-19T14:30:52.101Z","title":"Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-85317","published":"2026-10-19T10:43:39.184Z","updated":"2026-10-19T14:31:27.611Z","title":"Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-85316","published":"2026-10-19T10:43:00.504Z","updated":"2026-10-19T14:32:09.821Z","title":"Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2026-85315","published":"2026-10-19T10:42:10.032Z","updated":"2026-10-19T14:38:44.708Z","title":"Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-85314","published":"2026-10-19T10:41:45.323Z","updated":"2026-10-19T14:32:46.401Z","title":"Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-85313","published":"2026-10-19T10:40:58.206Z","updated":"2026-10-19T14:33:28.013Z","title":"Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00411,"kevAdded":null},{"id":"CVE-2026-85312","published":"2026-10-19T10:40:26.439Z","updated":"2026-10-19T14:34:13.505Z","title":"Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-85300","published":"2026-10-19T10:40:04.752Z","updated":"2026-10-19T14:35:02.757Z","title":"Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-85301","published":"2026-10-19T10:39:46.650Z","updated":"2026-10-19T14:35:58.104Z","title":"Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-85296","published":"2026-10-19T10:38:11.146Z","updated":"2026-10-19T16:46:25.273Z","title":"Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2026-85260","published":"2026-10-19T10:37:42.980Z","updated":"2026-10-19T16:47:15.565Z","title":"Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2026-85257","published":"2026-10-19T10:37:14.792Z","updated":"2026-10-19T16:47:59.389Z","title":"Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-85254","published":"2026-10-19T10:36:46.283Z","updated":"2026-10-19T16:48:42.551Z","title":"Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00678,"kevAdded":null},{"id":"CVE-2026-71253","published":"2026-10-19T10:36:41.781Z","updated":"2026-10-20T19:34:25.835Z","title":"Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Johnzon","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-85251","published":"2026-10-19T10:36:09.521Z","updated":"2026-10-19T16:49:37.974Z","title":"Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-85250","published":"2026-10-19T10:35:21.670Z","updated":"2026-10-19T16:50:38.120Z","title":"Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00703,"kevAdded":null},{"id":"CVE-2026-85249","published":"2026-10-19T10:34:39.838Z","updated":"2026-10-19T16:53:06.515Z","title":"Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00678,"kevAdded":null},{"id":"CVE-2026-85248","published":"2026-10-19T10:34:16.177Z","updated":"2026-10-19T16:58:32.142Z","title":"Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00424,"kevAdded":null},{"id":"CVE-2026-85247","published":"2026-10-19T10:33:39.667Z","updated":"2026-10-19T17:00:20.717Z","title":"Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00498,"kevAdded":null},{"id":"CVE-2026-85246","published":"2026-10-19T10:33:16.880Z","updated":"2026-10-19T18:31:23.502Z","title":"Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2026-85245","published":"2026-10-19T10:32:44.450Z","updated":"2026-10-19T18:32:37.783Z","title":"Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2026-85243","published":"2026-10-19T10:32:21.246Z","updated":"2026-10-19T18:34:48.550Z","title":"Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-84181","published":"2026-10-19T10:31:41.671Z","updated":"2026-10-19T18:39:02.725Z","title":"Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-84180","published":"2026-10-19T10:31:08.913Z","updated":"2026-10-19T18:35:59.978Z","title":"Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00648,"kevAdded":null},{"id":"CVE-2026-84178","published":"2026-10-19T10:30:42.299Z","updated":"2026-10-19T18:40:29.279Z","title":"Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-84176","published":"2026-10-19T10:30:00.854Z","updated":"2026-10-19T18:42:24.974Z","title":"Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00577,"kevAdded":null},{"id":"CVE-2026-83531","published":"2026-10-19T10:29:33.329Z","updated":"2026-10-20T03:55:30.995Z","title":"Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0085,"kevAdded":null},{"id":"CVE-2026-80344","published":"2026-10-19T10:28:48.809Z","updated":"2026-10-19T18:43:46.791Z","title":"Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00881,"kevAdded":null},{"id":"CVE-2026-80343","published":"2026-10-19T10:27:58.845Z","updated":"2026-10-19T18:44:28.360Z","title":"Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0093,"kevAdded":null},{"id":"CVE-2026-80312","published":"2026-10-19T10:27:34.015Z","updated":"2026-10-19T17:02:55.787Z","title":"Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-79986","published":"2026-10-19T10:25:58.121Z","updated":"2026-11-03T22:13:33.077Z","title":"Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0102,"kevAdded":null},{"id":"CVE-2026-79985","published":"2026-10-19T10:16:14.300Z","updated":"2026-10-20T13:10:15.042Z","title":"Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2026-79984","published":"2026-10-19T10:15:38.348Z","updated":"2026-10-20T13:09:38.995Z","title":"Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2026-79983","published":"2026-10-19T10:08:43.054Z","updated":"2026-10-20T13:09:03.529Z","title":"Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0102,"kevAdded":null},{"id":"CVE-2026-78165","published":"2026-10-19T10:08:06.783Z","updated":"2026-10-20T13:08:03.518Z","title":"Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00727,"kevAdded":null},{"id":"CVE-2026-78164","published":"2026-10-19T10:07:40.078Z","updated":"2026-10-19T18:46:16.020Z","title":"Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2026-78163","published":"2026-10-19T10:07:06.939Z","updated":"2026-10-19T18:49:01.897Z","title":"Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-78162","published":"2026-10-19T10:03:57.474Z","updated":"2026-10-20T03:55:29.414Z","title":"Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01076,"kevAdded":null},{"id":"CVE-2026-90910","published":"2026-10-19T09:35:54.679Z","updated":"2026-10-19T18:50:42.533Z","title":"Apache Answer: Reaction API authorization bypass for restricted content","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-86589","published":"2026-10-19T09:35:27.540Z","updated":"2026-10-30T16:35:36.307Z","title":"Apache Answer: User Center integration does not revoke first-login sessions after central account suspension","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00254,"kevAdded":null},{"id":"CVE-2026-79633","published":"2026-10-19T09:35:05.903Z","updated":"2026-11-03T22:32:39.262Z","title":"Apache Answer: Missing Authorization Allows Mutations of Non-Public Content","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-79624","published":"2026-10-19T09:34:39.806Z","updated":"2026-11-03T22:32:45.632Z","title":"Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-79620","published":"2026-10-19T09:34:11.041Z","updated":"2026-11-03T22:32:51.222Z","title":"Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-79613","published":"2026-10-19T09:33:52.177Z","updated":"2026-11-03T22:32:56.884Z","title":"Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-76994","published":"2026-10-19T09:33:14.033Z","updated":"2026-11-03T22:33:03.747Z","title":"Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-71563","published":"2026-10-19T09:32:40.826Z","updated":"2026-10-20T19:00:27.382Z","title":"Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00224,"kevAdded":null},{"id":"CVE-2026-68482","published":"2026-10-19T09:31:50.762Z","updated":"2026-10-30T20:00:59.721Z","title":"Apache Answer: Improper Authorization in Question Invite User Lookup","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-67249","published":"2026-10-19T09:31:20.492Z","updated":"2026-10-26T13:41:23.891Z","title":"Apache Answer: Email Code Purpose Confusion May Allow Account Takeover","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-64945","published":"2026-10-19T09:30:51.414Z","updated":"2026-11-03T22:33:09.225Z","title":"Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-64944","published":"2026-10-19T09:26:52.224Z","updated":"2026-11-03T22:33:15.016Z","title":"Apache Answer: Stored XSS via unsanitized HTML in imported question content","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00184,"kevAdded":null},{"id":"CVE-2026-64943","published":"2026-10-19T09:26:13.696Z","updated":"2026-10-20T18:57:09.507Z","title":"Apache Answer: API keys logged in plaintext during authentication","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2026-108837","published":"2026-10-19T09:22:03.856Z","updated":"2026-11-03T22:33:20.553Z","title":"Apache Kylin: Potential computed-column resource exhaustion","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2026-108833","published":"2026-10-19T09:21:54.065Z","updated":"2026-11-04T17:47:07.525Z","title":"Apache Kylin: default startup profile miss security settings","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00311,"kevAdded":null},{"id":"CVE-2026-108823","published":"2026-10-19T09:21:30.729Z","updated":"2026-11-03T22:33:31.652Z","title":"Apache Kylin: Potential unauthenticated job metadata replacement","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-108780","published":"2026-10-19T09:21:19.963Z","updated":"2026-10-30T16:34:27.855Z","title":"Apache Kylin: Potential JDBC source configuration validation issue","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-108776","published":"2026-10-19T09:21:09.051Z","updated":"2026-10-30T16:32:51.344Z","title":"Apache Kylin: tables/names SparkSQL injection","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-108771","published":"2026-10-19T09:20:59.076Z","updated":"2026-10-30T16:31:42.241Z","title":"Apache Kylin: unauthenticated broadcast API and polymorphic deserialization","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-108766","published":"2026-10-19T09:20:48.058Z","updated":"2026-10-30T16:30:46.005Z","title":"Apache Kylin: missing JDBC-config authorization","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-108764","published":"2026-10-19T09:18:57.199Z","updated":"2026-10-30T16:29:19.621Z","title":"Apache Kylin: job-driver UI proxy SSRF","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-108762","published":"2026-10-19T09:16:25.736Z","updated":"2026-10-30T16:28:09.058Z","title":"Apache Kylin: delete metadata backup path-confinement bypass","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-108743","published":"2026-10-16T19:44:37.833Z","updated":"2026-10-20T12:58:48.518Z","title":"Apache Kylin: spark job OS command injection","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.01387,"kevAdded":null},{"id":"CVE-2026-108709","published":"2026-10-16T19:38:21.601Z","updated":"2026-10-20T18:06:59.378Z","title":"Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-69080","published":"2026-10-16T19:37:50.174Z","updated":"2026-10-20T18:04:54.819Z","title":"Apache Kylin: Broken Access Control in QuerySQLBlacklistController","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-69077","published":"2026-10-16T19:33:20.218Z","updated":"2026-10-20T18:03:35.109Z","title":"Apache Kylin: JobController allows unauthorized cross-project manipulation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-69076","published":"2026-10-16T19:32:39.538Z","updated":"2026-10-20T18:02:18.110Z","title":"Apache Kylin: Unauthorized cross-project job discard","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-68573","published":"2026-10-16T19:32:22.205Z","updated":"2026-10-20T17:59:10.444Z","title":"Apache Kylin: Unauthenticated Metastore Cleanup","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2026-68572","published":"2026-10-16T19:32:03.193Z","updated":"2026-10-20T17:50:19.415Z","title":"Apache Kylin: Unauthorized SQL execution to Spark SQL env","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-68571","published":"2026-10-16T12:16:12.526Z","updated":"2026-10-19T10:31:10.638Z","title":"Apache Kylin: JDBC URL Whitelist Verification Bypass","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-64959","published":"2026-10-16T12:16:00.359Z","updated":"2026-10-20T15:18:33.054Z","title":"Apache Kylin: Missing authentication on certain cache API endpoints","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-64610","published":"2026-10-16T12:13:18.802Z","updated":"2026-10-20T16:08:34.352Z","title":"Apache Kylin: Redis unsafe Java deserialization","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-63619","published":"2026-10-16T12:11:51.082Z","updated":"2026-10-20T16:49:10.635Z","title":"Apache Kylin: Missing authorization and path-confinement on system meta dump","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-63618","published":"2026-10-16T12:11:35.468Z","updated":"2026-10-16T14:03:00.915Z","title":"Apache Kylin: Low-Privilege Config Exposure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-94135","published":"2026-10-15T21:40:24.810Z","updated":"2026-10-16T14:46:22.385Z","title":"Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow SFTP provider","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-96806","published":"2026-10-15T21:40:20.555Z","updated":"2026-10-16T14:50:50.600Z","title":"Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token","severity":"MEDIUM","score":5.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Keycloak provider","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-94134","published":"2026-10-15T21:39:03.081Z","updated":"2026-10-16T14:53:59.032Z","title":"Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow SSH provider","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-92228","published":"2026-10-15T21:37:54.612Z","updated":"2026-10-16T14:56:07.947Z","title":"Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Keycloak provider","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-107460","published":"2026-10-13T14:16:02.556Z","updated":"2026-10-20T17:39:28.844Z","title":"Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Fesod (Incubating)","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2026-92120","published":"2026-10-12T20:08:15.489Z","updated":"2026-10-16T17:59:19.908Z","title":"Apache Allura: Oauth1 Replay Attack","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-92119","published":"2026-10-12T20:06:52.868Z","updated":"2026-10-16T17:56:57.098Z","title":"Apache Allura: REST API Mass Assignment","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00302,"kevAdded":null},{"id":"CVE-2026-92116","published":"2026-10-12T20:04:28.948Z","updated":"2026-10-16T17:55:16.465Z","title":"Apache Allura: OAuth1 missing callback validation","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-85499","published":"2026-10-12T11:04:44.671Z","updated":"2026-10-16T17:09:57.669Z","title":"Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache SkyWalking BanyanDB","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-103636","published":"2026-10-10T10:23:58.547Z","updated":"2026-10-16T15:32:00.167Z","title":"Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DataSketches","kev":false,"epss":0.0038,"kevAdded":null},{"id":"CVE-2026-103635","published":"2026-10-10T10:23:48.598Z","updated":"2026-10-16T15:28:02.277Z","title":"Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache DataSketches","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-103513","published":"2026-10-10T10:23:20.806Z","updated":"2026-10-16T15:24:57.426Z","title":"Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DataSketches","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-103501","published":"2026-10-10T10:22:55.843Z","updated":"2026-10-16T15:22:14.055Z","title":"Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DataSketches","kev":false,"epss":0.00555,"kevAdded":null},{"id":"CVE-2026-103413","published":"2026-10-09T12:53:56.120Z","updated":"2026-10-15T18:11:10.412Z","title":"Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel Karavan","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-103412","published":"2026-10-09T12:53:13.660Z","updated":"2026-10-15T18:06:53.281Z","title":"Apache Camel Karavan: project file name path traversal when committing a project to Git","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel Karavan","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2026-108039","published":"2026-10-09T10:22:35.457Z","updated":"2026-10-15T17:55:55.468Z","title":"Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2026-107938","published":"2026-10-09T10:20:11.627Z","updated":"2026-10-15T17:49:55.261Z","title":"Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-107937","published":"2026-10-09T10:19:53.377Z","updated":"2026-10-15T17:45:25.955Z","title":"Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-100227","published":"2026-10-09T10:19:40.756Z","updated":"2026-10-15T17:42:03.056Z","title":"Apache CXF: XML Signature wrapping in JAX-RS XML Security","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-97791","published":"2026-10-09T10:19:26.153Z","updated":"2026-10-15T17:32:09.718Z","title":"Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-97468","published":"2026-10-09T10:18:56.568Z","updated":"2026-10-15T16:28:54.151Z","title":"Apache CXF: Authentication bypass via weak cache keys for validated STS tokens","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-86463","published":"2026-10-09T10:18:42.008Z","updated":"2026-10-15T16:26:53.196Z","title":"Apache CXF: FIQL Query Parser Denial of Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-79650","published":"2026-10-09T10:18:21.966Z","updated":"2026-10-15T16:20:11.251Z","title":"Apache CXF: OIDC RP Open Redirect","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-78384","published":"2026-10-09T10:18:00.617Z","updated":"2026-10-15T16:16:44.354Z","title":"Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-73179","published":"2026-10-09T10:17:41.123Z","updated":"2026-10-15T16:10:24.401Z","title":"Apache CXF: JPA authorization-code consume is non-atomic","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-71575","published":"2026-10-09T10:17:18.484Z","updated":"2026-10-15T16:07:39.679Z","title":"Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-71896","published":"2026-10-08T08:39:21.941Z","updated":"2026-10-08T13:08:29.206Z","title":"Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-71895","published":"2026-10-08T08:37:21.833Z","updated":"2026-10-08T13:09:40.924Z","title":"Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.0022,"kevAdded":null},{"id":"CVE-2026-71183","published":"2026-10-08T08:34:48.978Z","updated":"2026-10-08T13:11:45.232Z","title":"Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00215,"kevAdded":null},{"id":"CVE-2026-66087","published":"2026-10-08T08:29:43.553Z","updated":"2026-10-08T20:21:27.148Z","title":"Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-66084","published":"2026-10-08T08:18:19.410Z","updated":"2026-10-08T20:20:39.923Z","title":"Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-66082","published":"2026-10-08T08:16:38.047Z","updated":"2026-10-08T20:19:54.297Z","title":"Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-103371","published":"2026-10-07T18:46:38.719Z","updated":"2026-10-08T17:12:22.037Z","title":"Apache Geode: Management REST API: Insertion of Sensitive Information into Log File","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-92415","published":"2026-10-07T15:47:31.074Z","updated":"2026-10-07T20:29:49.630Z","title":"Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Jackrabbit","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-92414","published":"2026-10-07T15:46:44.549Z","updated":"2026-10-07T20:29:20.098Z","title":"Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens","severity":"CRITICAL","score":9.3,"vendor":"Apache Software Foundation","product":"Apache Jackrabbit","kev":false,"epss":0.00725,"kevAdded":null},{"id":"CVE-2026-97146","published":"2026-10-07T09:16:09.998Z","updated":"2026-10-07T17:58:22.285Z","title":"Apache YuniKorn: Admission control bypass via system label forgery","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache YuniKorn","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-78243","published":"2026-10-07T09:15:41.832Z","updated":"2026-10-07T17:50:51.368Z","title":"Apache YuniKorn: LDAP Group provider panics on lowercase attribute name","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache YuniKorn","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-92393","published":"2026-10-07T09:15:31.679Z","updated":"2026-10-07T17:52:46.087Z","title":"Apache YuniKorn: Admission control bypass via workload UPDATE operation","severity":"LOW","score":2,"vendor":"Apache Software Foundation","product":"Apache YuniKorn","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-93684","published":"2026-10-07T08:48:45.195Z","updated":"2026-10-07T18:45:38.092Z","title":"Apache Impala: Stored XSS in Impala query plans","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00155,"kevAdded":null},{"id":"CVE-2026-90466","published":"2026-10-07T08:47:12.542Z","updated":"2026-10-07T18:46:39.669Z","title":"Apache Impala: Path traversal executes JARs outside trusted paths","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-97720","published":"2026-10-07T08:46:45.118Z","updated":"2026-10-07T18:47:58.840Z","title":"Apache Impala: Impala Executor Webserver Auth Bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-105244","published":"2026-10-06T19:52:31.116Z","updated":"2026-10-07T14:50:49.648Z","title":"Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache log4net","kev":false,"epss":0.00823,"kevAdded":null},{"id":"CVE-2026-105243","published":"2026-10-06T19:51:25.116Z","updated":"2026-10-07T14:49:41.976Z","title":"Apache log4net: Oversize EventLogAppender record silently discarded","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache log4net","kev":false,"epss":0.00807,"kevAdded":null},{"id":"CVE-2026-105242","published":"2026-10-06T19:50:19.075Z","updated":"2026-10-07T14:49:06.441Z","title":"Apache log4net: Request validation failure drops the event in the aspnet-request converter","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache log4net","kev":false,"epss":0.00823,"kevAdded":null},{"id":"CVE-2026-105241","published":"2026-10-06T19:49:03.994Z","updated":"2026-10-07T14:45:58.074Z","title":"Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache log4net","kev":false,"epss":0.00824,"kevAdded":null},{"id":"CVE-2026-105240","published":"2026-10-06T19:47:44.900Z","updated":"2026-10-07T16:27:16.989Z","title":"Apache log4net: NUL character truncates OutputDebugStringAppender records","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache log4net","kev":false,"epss":0.00807,"kevAdded":null},{"id":"CVE-2026-105239","published":"2026-10-06T19:46:33.357Z","updated":"2026-10-07T06:11:55.256Z","title":"Apache log4net: NUL character truncates EventLogAppender records","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache log4net","kev":false,"epss":0.00823,"kevAdded":null},{"id":"CVE-2026-105111","published":"2026-10-06T19:44:18.075Z","updated":"2026-10-07T06:11:54.071Z","title":"Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Commons BCEL","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-94114","published":"2026-10-06T19:42:30.421Z","updated":"2026-10-08T05:26:10.375Z","title":"Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Commons BCEL","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-104714","published":"2026-10-05T18:36:49.472Z","updated":"2026-10-06T14:13:46.615Z","title":"Apache Struts: Shared message formatter exposes date and time values across concurrent requests","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-104713","published":"2026-10-05T18:36:09.420Z","updated":"2026-10-06T14:12:55.065Z","title":"Apache Struts: Unbounded request body read in the REST plugin","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2026-104712","published":"2026-10-05T18:35:41.767Z","updated":"2026-10-06T14:10:31.329Z","title":"Apache Struts: Disproportionate response size when rendering BigDecimal request parameters","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00844,"kevAdded":null},{"id":"CVE-2026-104711","published":"2026-10-05T18:35:10.026Z","updated":"2026-10-06T14:09:06.711Z","title":"Apache Struts: OGNL injection in the legacy RESTful action mapper","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.01394,"kevAdded":null},{"id":"CVE-2026-102795","published":"2026-10-02T17:40:50.648Z","updated":"2026-10-02T18:30:59.242Z","title":"Apache Traffic Server: SNI to Host header matching policy is not properly enforced","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00283,"kevAdded":null},{"id":"CVE-2026-59265","published":"2026-10-02T17:34:06.937Z","updated":"2026-10-08T03:12:11.059Z","title":"Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2026-66054","published":"2026-10-02T12:58:05.610Z","updated":"2026-10-03T15:52:56.354Z","title":"Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-61374","published":"2026-10-02T12:53:00.477Z","updated":"2026-10-03T15:52:56.479Z","title":"Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00248,"kevAdded":null},{"id":"CVE-2026-63772","published":"2026-10-02T12:52:07.427Z","updated":"2026-10-03T15:52:56.607Z","title":"Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-66055","published":"2026-10-02T12:49:40.955Z","updated":"2026-10-03T15:52:56.729Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-66081","published":"2026-10-02T12:33:13.645Z","updated":"2026-10-02T16:52:20.380Z","title":"Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-66331","published":"2026-10-02T12:32:46.166Z","updated":"2026-10-03T15:52:56.858Z","title":"Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-66837","published":"2026-10-02T12:29:09.189Z","updated":"2026-10-02T16:53:09.547Z","title":"Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00349,"kevAdded":null},{"id":"CVE-2026-66858","published":"2026-10-02T12:27:31.412Z","updated":"2026-10-02T16:54:25.933Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-66859","published":"2026-10-02T12:23:48.346Z","updated":"2026-10-02T16:55:19.349Z","title":"Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00316,"kevAdded":null},{"id":"CVE-2026-83632","published":"2026-10-02T12:22:23.617Z","updated":"2026-10-02T16:56:02.571Z","title":"Apache Thrift: C++ THttpTransport grows its line buffer without bound","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-83663","published":"2026-10-02T12:18:16.955Z","updated":"2026-10-02T17:15:19.858Z","title":"Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-83745","published":"2026-10-02T12:16:15.128Z","updated":"2026-10-02T17:16:55.903Z","title":"Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-85476","published":"2026-10-02T12:12:45.468Z","updated":"2026-10-02T17:17:32.106Z","title":"Apache Thrift: c_glib `read_all` spins when the underlying read returns 0","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-96289","published":"2026-10-02T12:07:02.827Z","updated":"2026-10-02T12:30:18.926Z","title":"Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-96287","published":"2026-10-02T12:05:59.449Z","updated":"2026-10-02T17:18:14.952Z","title":"Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-96286","published":"2026-10-02T12:04:28.083Z","updated":"2026-10-02T13:40:01.647Z","title":"Apache Thrift: Perl servers end `serve()` when serving one connection fails","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-96277","published":"2026-10-02T12:03:23.964Z","updated":"2026-10-02T13:44:32.931Z","title":"Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-94658","published":"2026-10-02T12:02:21.823Z","updated":"2026-10-02T17:19:35.065Z","title":"Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-94657","published":"2026-10-02T12:01:36.606Z","updated":"2026-10-02T17:20:01.959Z","title":"Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-94656","published":"2026-10-02T12:00:51.754Z","updated":"2026-10-02T17:20:39.115Z","title":"Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-94655","published":"2026-10-02T11:59:18.277Z","updated":"2026-10-02T17:21:12.862Z","title":"Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-94654","published":"2026-10-02T11:58:49.429Z","updated":"2026-10-02T17:25:06.026Z","title":"Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-94653","published":"2026-10-02T11:56:35.706Z","updated":"2026-10-05T16:15:35.012Z","title":"Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94652","published":"2026-10-02T11:54:41.996Z","updated":"2026-10-05T16:16:18.135Z","title":"Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94648","published":"2026-10-02T11:52:48.907Z","updated":"2026-10-05T16:16:58.679Z","title":"Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94646","published":"2026-10-02T11:52:21.192Z","updated":"2026-10-02T13:50:57.551Z","title":"Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-94638","published":"2026-10-02T11:49:43.765Z","updated":"2026-10-05T16:24:52.177Z","title":"Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94637","published":"2026-10-02T11:49:02.869Z","updated":"2026-10-05T16:24:12.567Z","title":"Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94636","published":"2026-10-02T11:47:54.613Z","updated":"2026-10-02T17:32:21.357Z","title":"Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-92834","published":"2026-10-02T11:45:25.930Z","updated":"2026-10-02T13:54:38.203Z","title":"Apache Thrift: C++ WebSocket server transport does not read a full request length","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-90440","published":"2026-10-02T11:44:11.636Z","updated":"2026-10-02T13:55:52.226Z","title":"Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-87117","published":"2026-10-02T11:43:11.832Z","updated":"2026-10-02T17:33:40.379Z","title":"Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-86537","published":"2026-10-02T11:40:51.704Z","updated":"2026-10-02T14:02:10.469Z","title":"Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-86536","published":"2026-10-02T11:40:06.911Z","updated":"2026-10-02T17:31:43.876Z","title":"Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.003,"kevAdded":null},{"id":"CVE-2026-86535","published":"2026-10-02T11:38:16.628Z","updated":"2026-10-02T17:31:02.660Z","title":"Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-85088","published":"2026-10-02T11:37:14.749Z","updated":"2026-10-02T17:40:12.995Z","title":"Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0017,"kevAdded":null},{"id":"CVE-2026-85087","published":"2026-10-02T11:35:44.871Z","updated":"2026-10-02T17:42:03.809Z","title":"Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-85086","published":"2026-10-02T11:34:00.954Z","updated":"2026-10-02T17:42:45.420Z","title":"Apache Thrift: Perl TLS client disables certificate verification by default","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-82459","published":"2026-10-02T11:32:30.148Z","updated":"2026-10-02T17:43:27.436Z","title":"Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-82458","published":"2026-10-02T11:30:51.264Z","updated":"2026-10-02T17:43:54.788Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-96288","published":"2026-10-02T11:18:37.005Z","updated":"2026-10-02T16:10:05.301Z","title":"Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-96292","published":"2026-10-02T11:11:33.256Z","updated":"2026-10-02T17:41:13.432Z","title":"Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-96294","published":"2026-10-02T11:09:56.230Z","updated":"2026-10-02T16:11:02.440Z","title":"Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-61373","published":"2026-10-02T11:07:29.248Z","updated":"2026-10-05T16:22:39.230Z","title":"Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-96990","published":"2026-10-02T11:00:27.495Z","updated":"2026-10-05T16:21:55.037Z","title":"Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-94642","published":"2026-10-02T10:57:14.927Z","updated":"2026-10-05T16:21:26.933Z","title":"Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-94644","published":"2026-10-02T10:53:37.255Z","updated":"2026-10-05T16:20:46.026Z","title":"Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-94645","published":"2026-10-02T10:51:40.324Z","updated":"2026-10-05T16:26:26.249Z","title":"Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-94650","published":"2026-10-02T10:49:37.521Z","updated":"2026-10-02T16:12:08.924Z","title":"Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-94651","published":"2026-10-02T10:48:38.084Z","updated":"2026-10-07T22:06:45.057Z","title":"Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2026-85483","published":"2026-10-02T10:46:55.174Z","updated":"2026-10-02T16:12:58.415Z","title":"Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-85493","published":"2026-10-02T10:45:57.857Z","updated":"2026-10-02T16:13:53.000Z","title":"Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-85494","published":"2026-10-02T10:42:44.813Z","updated":"2026-10-07T22:06:51.804Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2026-91135","published":"2026-10-02T10:28:50.745Z","updated":"2026-10-02T17:47:39.521Z","title":"Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-91137","published":"2026-10-02T10:18:38.062Z","updated":"2026-10-02T10:44:20.527Z","title":"Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-93925","published":"2026-10-02T10:16:17.913Z","updated":"2026-10-02T10:53:48.170Z","title":"Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-93926","published":"2026-10-02T10:13:55.957Z","updated":"2026-10-02T10:56:42.390Z","title":"Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94633","published":"2026-10-02T10:13:00.027Z","updated":"2026-10-02T11:28:58.258Z","title":"Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-94634","published":"2026-10-02T10:11:20.762Z","updated":"2026-10-02T11:30:20.016Z","title":"Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-103885","published":"2026-10-02T10:09:51.901Z","updated":"2026-10-08T13:06:15.159Z","title":"Apache Directory LDAP API: Denial of service via crafted telephone number values","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2026-103877","published":"2026-10-02T10:08:42.494Z","updated":"2026-10-07T22:07:09.152Z","title":"Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-103880","published":"2026-10-02T10:03:48.296Z","updated":"2026-10-05T18:47:17.198Z","title":"Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2026-103878","published":"2026-10-02T10:02:38.002Z","updated":"2026-10-05T18:48:08.150Z","title":"Apache Directory LDAP API: Injection of plaintext responses during StartTLS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-103552","published":"2026-10-02T09:48:05.132Z","updated":"2026-10-02T21:07:19.881Z","title":"Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-94639","published":"2026-10-02T09:33:52.165Z","updated":"2026-10-05T16:18:03.807Z","title":"Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-102731","published":"2026-10-02T09:22:00.813Z","updated":"2026-10-05T18:10:33.132Z","title":"Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.0043,"kevAdded":null},{"id":"CVE-2026-94635","published":"2026-10-02T09:07:56.691Z","updated":"2026-10-02T17:06:12.309Z","title":"Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-63686","published":"2026-10-01T16:20:14.360Z","updated":"2026-10-01T20:09:31.181Z","title":"Apache HTTP Server: mod_xml2enc crash on charset conversion failure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-93546","published":"2026-10-01T16:19:32.662Z","updated":"2026-10-01T20:09:35.921Z","title":"Apache HTTP Server: mod_dav_fs namespace overflow","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-79768","published":"2026-10-01T16:18:57.661Z","updated":"2026-10-01T20:09:34.983Z","title":"Apache HTTP Server: mod_userdir information disclosure","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2026-73637","published":"2026-10-01T16:18:30.190Z","updated":"2026-10-01T20:09:34.038Z","title":"Apache HTTP Server: mod_auth_digest DoS attack","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-73636","published":"2026-10-01T16:17:59.618Z","updated":"2026-10-01T20:09:33.050Z","title":"Apache HTTP Server: mod_auth_digest one-time-nonce replay attack","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2026-63718","published":"2026-10-01T16:17:06.585Z","updated":"2026-10-01T20:09:32.103Z","title":"Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-63292","published":"2026-10-01T16:11:47.911Z","updated":"2026-10-01T20:09:30.262Z","title":"Apache HTTP Server: mod_vhost_alias stack overflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00948,"kevAdded":null},{"id":"CVE-2026-63045","published":"2026-10-01T16:09:07.643Z","updated":"2026-10-01T20:09:29.345Z","title":"Apache HTTP Server: mod_proxy_ftp PASV address handling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-59797","published":"2026-10-01T16:08:31.362Z","updated":"2026-10-01T20:09:28.423Z","title":"Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-59685","published":"2026-10-01T16:07:51.182Z","updated":"2026-10-01T20:09:27.502Z","title":"Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-58415","published":"2026-10-01T16:07:20.338Z","updated":"2026-10-01T20:09:26.575Z","title":"Apache HTTP Server: mod_dav_fs property database read access","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-57941","published":"2026-10-01T16:06:53.028Z","updated":"2026-10-01T20:09:25.619Z","title":"Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2026-56449","published":"2026-10-01T16:06:24.050Z","updated":"2026-10-21T07:59:33.661Z","title":"Apache HTTP Server: mod_proxy_html: crash in dump_content","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2026-56154","published":"2026-10-01T16:03:52.280Z","updated":"2026-10-01T20:09:23.709Z","title":"Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-56153","published":"2026-10-01T16:03:25.568Z","updated":"2026-10-01T20:09:22.770Z","title":"Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-48005","published":"2026-10-01T16:01:35.559Z","updated":"2026-10-01T20:09:21.826Z","title":"Apache HTTP Server: mod_auth_digest reauthentication attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00565,"kevAdded":null},{"id":"CVE-2026-47360","published":"2026-10-01T16:00:51.682Z","updated":"2026-10-01T20:09:20.908Z","title":"Apache HTTP Server: mod_session: Session cookie not removed during internal redirect","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-46729","published":"2026-10-01T15:55:27.083Z","updated":"2026-10-01T20:09:19.923Z","title":"Apache HTTP Server: mod_heartmonitor denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-42356","published":"2026-10-01T15:54:35.649Z","updated":"2026-10-01T20:09:17.981Z","title":"Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-42528","published":"2026-10-01T15:52:51.682Z","updated":"2026-10-01T20:09:18.998Z","title":"Apache HTTP Server: mod_dav shared lock overflow","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-94276","published":"2026-10-01T11:02:36.855Z","updated":"2026-10-01T14:44:30.267Z","title":"Apache APISIX: Openid-connect introspection validation issue","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-94269","published":"2026-10-01T11:02:20.117Z","updated":"2026-10-01T14:50:27.791Z","title":"Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00298,"kevAdded":null},{"id":"CVE-2026-94250","published":"2026-10-01T11:01:41.275Z","updated":"2026-10-01T14:51:08.084Z","title":"Apache APISIX: Batch response aggregation can exhaust worker memory","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00315,"kevAdded":null},{"id":"CVE-2026-94220","published":"2026-10-01T11:01:26.938Z","updated":"2026-10-01T14:51:30.180Z","title":"Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00196,"kevAdded":null},{"id":"CVE-2026-94212","published":"2026-10-01T11:01:11.697Z","updated":"2026-10-01T14:52:48.202Z","title":"Apache APISIX: unauthenticated impersonation issue in saml-auth","severity":"MEDIUM","score":6.4,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-82806","published":"2026-10-01T10:58:32.654Z","updated":"2026-10-01T14:57:12.282Z","title":"Apache APISIX: cross-request permission pollution via static permission list mutation","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-78242","published":"2026-10-01T10:58:13.262Z","updated":"2026-10-01T14:57:34.379Z","title":"Apache APISIX: data-mask may fail to redact request headers in logger output","severity":"MEDIUM","score":5.7,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00133,"kevAdded":null},{"id":"CVE-2026-88789","published":"2026-10-01T10:51:22.899Z","updated":"2026-10-01T14:56:28.388Z","title":"Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening","severity":"HIGH","score":8.6,"vendor":"Apache Software Foundation","product":"Apache Camel Quarkus","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-95616","published":"2026-09-30T12:25:28.399Z","updated":"2026-09-30T13:17:31.672Z","title":"Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2026-92899","published":"2026-09-30T12:02:41.497Z","updated":"2026-09-30T12:49:57.226Z","title":"Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-92121","published":"2026-09-30T12:01:55.697Z","updated":"2026-09-30T19:51:55.272Z","title":"Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00548,"kevAdded":null},{"id":"CVE-2026-89238","published":"2026-09-30T11:59:09.820Z","updated":"2026-09-30T19:50:20.299Z","title":"Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-88920","published":"2026-09-30T11:58:00.040Z","updated":"2026-09-30T19:48:53.545Z","title":"Apache WSS4J: SAML Sender-Vouches Authentication Bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-87830","published":"2026-09-30T11:57:01.017Z","updated":"2026-09-30T19:47:41.782Z","title":"Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-85532","published":"2026-09-30T11:55:53.392Z","updated":"2026-09-30T19:46:00.962Z","title":"Apache WSS4J: Insufficient Validation of Derived-Key Parameters","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache WSS4J","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-77185","published":"2026-09-30T09:47:03.852Z","updated":"2026-09-30T16:52:13.274Z","title":"Apache MINA SSHD: Asynchronous authentication can bypass signature verification","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-93994","published":"2026-09-30T09:45:32.561Z","updated":"2026-09-30T14:29:38.124Z","title":"Apache MINA SSHD: Repeated-publickey policy bypass on server","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00303,"kevAdded":null},{"id":"CVE-2026-94053","published":"2026-09-30T09:43:47.477Z","updated":"2026-09-30T14:30:10.327Z","title":"Apache MINA SSHD: LDAP injection in sshd-ldap","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-93995","published":"2026-09-30T09:38:47.654Z","updated":"2026-09-30T14:30:58.296Z","title":"Apache MINA SSHD: Remote execution of JGit \"archive -o=file.zip\" can write file on the server","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-93996","published":"2026-09-30T09:37:42.595Z","updated":"2026-09-30T14:31:21.957Z","title":"Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-94002","published":"2026-09-30T09:37:01.922Z","updated":"2026-09-30T14:31:45.869Z","title":"Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00359,"kevAdded":null},{"id":"CVE-2026-94029","published":"2026-09-30T09:35:51.711Z","updated":"2026-09-30T19:42:56.102Z","title":"Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2026-94052","published":"2026-09-30T09:34:43.917Z","updated":"2026-09-30T14:32:12.688Z","title":"Apache MINA SSHD: LDAP password authentication ineffective","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-102511","published":"2026-09-30T08:03:04.359Z","updated":"2026-09-30T16:43:46.020Z","title":"Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache PLC4X","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-102510","published":"2026-09-30T08:01:43.024Z","updated":"2026-09-30T14:40:31.604Z","title":"Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache PLC4X","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-102509","published":"2026-09-30T08:00:27.709Z","updated":"2026-09-30T14:40:06.881Z","title":"Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache PLC4X","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-102508","published":"2026-09-30T07:42:43.537Z","updated":"2026-09-30T14:39:33.687Z","title":"Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache PLC4X","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-97395","published":"2026-09-29T13:57:32.682Z","updated":"2026-10-01T16:13:41.152Z","title":"Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Polaris","kev":false,"epss":0.00278,"kevAdded":null},{"id":"CVE-2026-71897","published":"2026-09-29T13:14:09.274Z","updated":"2026-09-29T15:44:29.941Z","title":"Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-71898","published":"2026-09-29T13:11:17.886Z","updated":"2026-09-29T15:45:34.658Z","title":"Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-71899","published":"2026-09-29T13:09:38.692Z","updated":"2026-10-01T16:00:06.850Z","title":"Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-78214","published":"2026-09-29T13:07:34.133Z","updated":"2026-09-29T15:46:35.676Z","title":"Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-81569","published":"2026-09-29T13:05:36.254Z","updated":"2026-09-29T15:53:10.086Z","title":"Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-82804","published":"2026-09-29T13:01:20.872Z","updated":"2026-09-29T20:17:24.648Z","title":"Apache DolphinScheduler: Command Injection in the Alert Script Plugin","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-66083","published":"2026-09-29T11:46:40.533Z","updated":"2026-09-29T20:16:17.508Z","title":"Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00305,"kevAdded":null},{"id":"CVE-2026-102497","published":"2026-09-29T11:34:17.292Z","updated":"2026-09-29T20:13:56.826Z","title":"Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XMLSchema","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2026-102496","published":"2026-09-29T11:34:04.111Z","updated":"2026-09-29T20:12:07.164Z","title":"Apache XMLSchema: Denial of service through deeply nested schema structures","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XMLSchema","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2026-102495","published":"2026-09-29T11:33:51.375Z","updated":"2026-09-29T20:06:21.263Z","title":"Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XMLSchema","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2026-86843","published":"2026-09-29T10:00:34.961Z","updated":"2026-09-29T18:28:37.380Z","title":"Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Airflow Teradata provider","kev":false,"epss":0.00559,"kevAdded":null},{"id":"CVE-2026-81930","published":"2026-09-29T10:00:23.666Z","updated":"2026-09-29T18:29:50.020Z","title":"Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Airflow Snowflake provider","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-81862","published":"2026-09-29T09:59:35.774Z","updated":"2026-09-29T20:04:41.683Z","title":"Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Teradata provider","kev":false,"epss":0.00401,"kevAdded":null},{"id":"CVE-2026-81914","published":"2026-09-29T09:58:12.848Z","updated":"2026-09-29T20:03:23.525Z","title":"Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow Google provider","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-92142","published":"2026-09-29T08:40:07.961Z","updated":"2026-10-01T14:24:03.845Z","title":"Apache Karaf: Authorization bypass in JMX MBean lifecycle operations","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00604,"kevAdded":null},{"id":"CVE-2026-91085","published":"2026-09-29T08:39:33.209Z","updated":"2026-10-01T14:18:12.957Z","title":"Apache Karaf: config:install missing ACL entry allows privilege escalation to admin","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-91048","published":"2026-09-29T08:34:47.193Z","updated":"2026-10-01T14:13:30.717Z","title":"Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2026-91012","published":"2026-09-29T08:34:11.409Z","updated":"2026-10-01T14:10:47.838Z","title":"Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2026-91006","published":"2026-09-28T10:44:32.652Z","updated":"2026-09-29T21:03:21.368Z","title":"Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.01135,"kevAdded":null},{"id":"CVE-2026-90979","published":"2026-09-28T09:34:33.253Z","updated":"2026-09-30T19:53:57.685Z","title":"Apache Karaf: LDAP filter injection in JAAS LDAP login modules","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-86507","published":"2026-09-28T08:27:20.763Z","updated":"2026-09-28T13:31:29.940Z","title":"Apache Roller: Stored XSS in comment moderation via comment author URL","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-82379","published":"2026-09-28T07:53:00.862Z","updated":"2026-09-29T15:39:42.128Z","title":"Apache Roller: WSSE digest authentication headers can be replayed","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-82380","published":"2026-09-28T07:52:27.872Z","updated":"2026-09-28T13:31:30.215Z","title":"Apache Roller: CSRF protection bypass via self-generated salt validation","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2026-82381","published":"2026-09-28T07:51:54.776Z","updated":"2026-09-28T13:31:30.345Z","title":"Apache Roller: Stored cross-site scripting in the authoring UI","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-82382","published":"2026-09-28T07:51:31.108Z","updated":"2026-09-28T13:31:30.477Z","title":"Apache Roller: Reflected cross-site scripting in the frontpage directory parameter","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-82383","published":"2026-09-28T07:48:34.394Z","updated":"2026-09-28T13:31:30.607Z","title":"Apache Roller: Anonymous setup action allows frontpage configuration tampering","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2026-82384","published":"2026-09-28T07:47:43.768Z","updated":"2026-09-29T03:55:21.491Z","title":"Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00994,"kevAdded":null},{"id":"CVE-2026-82375","published":"2026-09-28T07:46:48.496Z","updated":"2026-09-28T13:31:30.860Z","title":"Apache Roller: Server-side request forgery via entry trackback and enclosure URLs","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-82376","published":"2026-09-28T07:46:10.284Z","updated":"2026-09-29T14:50:39.661Z","title":"Apache Roller: XML external entity processing in trackback response parser","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-82377","published":"2026-09-28T07:45:40.162Z","updated":"2026-09-29T15:39:42.299Z","title":"Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers","severity":"CRITICAL","score":9.9,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2026-82378","published":"2026-09-28T07:45:10.950Z","updated":"2026-09-29T15:39:42.425Z","title":"Apache Roller: OAuth authorization endpoint trusts request-supplied identity","severity":"CRITICAL","score":9,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-82385","published":"2026-09-28T07:44:07.273Z","updated":"2026-09-29T14:54:38.330Z","title":"Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-82386","published":"2026-09-28T07:43:31.795Z","updated":"2026-09-29T14:56:22.416Z","title":"Apache Roller: XML external entity processing in OPML bookmark import","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00291,"kevAdded":null},{"id":"CVE-2026-82348","published":"2026-09-28T07:36:45.897Z","updated":"2026-09-29T14:57:34.336Z","title":"Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00308,"kevAdded":null},{"id":"CVE-2026-82387","published":"2026-09-28T07:36:12.427Z","updated":"2026-09-29T14:58:22.334Z","title":"Apache Roller: Stored cross-site scripting via uploaded media content type","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-82546","published":"2026-09-28T07:35:38.234Z","updated":"2026-09-30T11:41:21.436Z","title":"Apache Roller: Stored cross-site scripting through incoming Trackback links","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-91204","published":"2026-09-28T07:34:33.187Z","updated":"2026-09-30T11:39:14.237Z","title":"Apache Roller: Stored javascript: URI in HTML comments","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-91206","published":"2026-09-28T07:33:13.837Z","updated":"2026-09-30T11:38:21.208Z","title":"Apache Roller: Reflected XSS in the optional LDAP comment authenticator","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-92550","published":"2026-09-25T08:17:38.849Z","updated":"2026-09-25T12:58:07.911Z","title":"Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-92560","published":"2026-09-25T08:17:01.277Z","updated":"2026-09-25T13:11:31.985Z","title":"Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2026-92573","published":"2026-09-25T08:11:12.150Z","updated":"2026-09-25T13:13:26.442Z","title":"Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-92564","published":"2026-09-25T07:59:30.710Z","updated":"2026-09-29T16:07:02.432Z","title":"Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-92608","published":"2026-09-25T07:44:26.468Z","updated":"2026-09-25T15:36:03.892Z","title":"Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-92609","published":"2026-09-25T07:44:10.137Z","updated":"2026-09-25T13:25:46.744Z","title":"Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-97636","published":"2026-09-24T21:54:58.005Z","updated":"2026-09-25T16:38:16.529Z","title":"Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow HashiCorp provider","kev":false,"epss":0.00374,"kevAdded":null},{"id":"CVE-2026-57590","published":"2026-09-24T09:13:45.800Z","updated":"2026-09-24T17:07:41.930Z","title":"Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-86247","published":"2026-09-23T12:31:53.210Z","updated":"2026-09-23T18:10:50.704Z","title":"Apache Tomcat Native: Client certificate requirements can be down-graded","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.00202,"kevAdded":null},{"id":"CVE-2026-86246","published":"2026-09-23T12:26:40.789Z","updated":"2026-09-23T18:10:49.726Z","title":"Apache Tomcat Native: Insecure OpenSSL options enabled","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-86243","published":"2026-09-23T12:24:55.119Z","updated":"2026-09-23T18:10:48.694Z","title":"Apache Tomcat Native: DoS via TLS handshake","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-87022","published":"2026-09-23T11:32:55.485Z","updated":"2026-09-23T18:10:52.633Z","title":"Apache Tomcat: WebSocket message smuggling with per-message-deflate","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2026-86350","published":"2026-09-23T11:31:36.328Z","updated":"2026-09-23T16:17:11.408Z","title":"Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-86248","published":"2026-09-23T11:29:35.479Z","updated":"2026-09-23T16:14:59.897Z","title":"Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00496,"kevAdded":null},{"id":"CVE-2026-79677","published":"2026-09-23T11:28:03.338Z","updated":"2026-09-23T18:10:47.712Z","title":"Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-78437","published":"2026-09-23T11:26:29.362Z","updated":"2026-09-23T18:10:46.744Z","title":"Apache Tomcat: HTTP/2 DoS via malformed request","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00511,"kevAdded":null},{"id":"CVE-2026-78383","published":"2026-09-23T11:23:15.477Z","updated":"2026-09-23T18:10:45.708Z","title":"Apache Tomcat: AJP DoS via missing request body","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-77791","published":"2026-09-23T11:20:50.457Z","updated":"2026-09-23T18:10:44.739Z","title":"Apache Tomcat: DoS via busy wait during WebSocket close","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00679,"kevAdded":null},{"id":"CVE-2026-77762","published":"2026-09-23T11:19:28.370Z","updated":"2026-09-30T14:50:02.042Z","title":"Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-77756","published":"2026-09-23T11:18:02.672Z","updated":"2026-09-23T18:10:42.842Z","title":"Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-76183","published":"2026-09-23T11:16:09.907Z","updated":"2026-09-30T14:54:21.515Z","title":"Apache Tomcat: Bypass of security constraints for WebSocket endpoints","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2026-75973","published":"2026-09-23T11:14:07.995Z","updated":"2026-09-23T18:10:40.767Z","title":"Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00518,"kevAdded":null},{"id":"CVE-2026-73581","published":"2026-09-23T11:08:53.212Z","updated":"2026-10-29T10:01:34.970Z","title":"Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-94243","published":"2026-09-23T09:43:49.174Z","updated":"2026-09-23T17:08:16.712Z","title":"Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Sling Security Bundle","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-94251","published":"2026-09-23T09:42:27.928Z","updated":"2026-09-23T17:08:17.694Z","title":"Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Sling Security Bundle","kev":false,"epss":0.00637,"kevAdded":null},{"id":"CVE-2026-91928","published":"2026-09-23T09:37:49.295Z","updated":"2026-09-23T17:08:13.709Z","title":"Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling XSS","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-96443","published":"2026-09-23T09:35:33.800Z","updated":"2026-09-23T17:09:06.824Z","title":"Apache Doris: JDBC driver URL validation bypass leads to remote code execution","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-91852","published":"2026-09-23T09:29:11.099Z","updated":"2026-09-23T17:08:12.737Z","title":"Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling XSS","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2026-91999","published":"2026-09-23T09:23:22.037Z","updated":"2026-09-23T17:08:14.732Z","title":"Apache Sling XSS: Improper escaping in the XSS Webconsole plugin","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling XSS","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-92001","published":"2026-09-23T09:20:52.311Z","updated":"2026-09-23T17:08:15.717Z","title":"Apache Sling XSS: Missing parser resource limits","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling XSS","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-73192","published":"2026-09-23T09:09:43.637Z","updated":"2026-09-23T17:08:11.709Z","title":"Apache Sling XSS: XSS possible through XSSAPI.getValidHref()","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling XSS","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-31377","published":"2026-09-23T09:04:56.122Z","updated":"2026-09-23T17:08:10.651Z","title":"Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00672,"kevAdded":null},{"id":"CVE-2026-82331","published":"2026-09-23T06:58:21.546Z","updated":"2026-09-23T16:08:58.171Z","title":"Apache BuildStream: tar source extraction escape","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache BuildStream","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-70410","published":"2026-09-22T15:39:14.408Z","updated":"2026-09-22T19:19:02.893Z","title":"Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Calcite Avatica","kev":false,"epss":0.00638,"kevAdded":null},{"id":"CVE-2026-94301","published":"2026-09-21T14:35:59.952Z","updated":"2026-09-22T03:55:53.783Z","title":"Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-86473","published":"2026-09-21T14:33:26.110Z","updated":"2026-11-03T07:00:53.240Z","title":"Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00747,"kevAdded":null},{"id":"CVE-2026-75158","published":"2026-09-21T14:32:47.818Z","updated":"2026-11-03T07:00:41.233Z","title":"Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00636,"kevAdded":null},{"id":"CVE-2026-82355","published":"2026-09-21T14:32:04.932Z","updated":"2026-11-03T07:00:47.198Z","title":"Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation","severity":"MEDIUM","score":4.2,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00735,"kevAdded":null},{"id":"CVE-2026-91867","published":"2026-09-21T11:27:45.131Z","updated":"2026-09-21T13:15:19.316Z","title":"Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2026-91866","published":"2026-09-21T11:27:15.767Z","updated":"2026-09-21T13:17:25.639Z","title":"Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-91865","published":"2026-09-21T11:26:52.788Z","updated":"2026-09-21T13:17:03.972Z","title":"Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-91864","published":"2026-09-21T11:26:20.054Z","updated":"2026-09-21T13:27:39.838Z","title":"Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-91863","published":"2026-09-21T11:25:26.648Z","updated":"2026-09-21T13:36:42.505Z","title":"Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.00758,"kevAdded":null},{"id":"CVE-2026-47321","published":"2026-09-21T07:43:24.769Z","updated":"2026-09-21T18:09:30.104Z","title":"Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-75157","published":"2026-09-18T07:51:23.246Z","updated":"2026-11-03T07:00:34.737Z","title":"Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-92230","published":"2026-09-17T18:38:29.556Z","updated":"2026-09-18T13:33:04.842Z","title":"Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-70469","published":"2026-09-16T19:38:42.341Z","updated":"2026-09-17T19:38:26.785Z","title":"Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00622,"kevAdded":null},{"id":"CVE-2026-81866","published":"2026-09-16T19:38:04.543Z","updated":"2026-09-17T12:27:36.279Z","title":"Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration","severity":"LOW","score":0.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00564,"kevAdded":null},{"id":"CVE-2026-82561","published":"2026-09-16T19:37:20.973Z","updated":"2026-09-17T19:12:38.557Z","title":"Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-86089","published":"2026-09-16T19:35:01.274Z","updated":"2026-09-17T19:12:58.905Z","title":"Apache NiFi: Missing Process Group Authorization for Connector Migration","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-87976","published":"2026-09-16T19:32:56.293Z","updated":"2026-09-17T19:13:23.645Z","title":"Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache NiFi Registry","kev":false,"epss":0.00791,"kevAdded":null},{"id":"CVE-2026-76646","published":"2026-09-16T19:17:01.801Z","updated":"2026-09-17T19:13:59.659Z","title":"Apache MyFaces: Denial of Service via Unbounded Request Parsing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MyFaces","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2026-68536","published":"2026-09-16T18:40:17.043Z","updated":"2026-09-17T20:08:09.598Z","title":"Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MyFaces","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2026-84501","published":"2026-09-16T09:28:10.294Z","updated":"2026-09-16T19:43:09.161Z","title":"Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00742,"kevAdded":null},{"id":"CVE-2026-84439","published":"2026-09-16T09:27:46.439Z","updated":"2026-09-17T19:14:53.953Z","title":"Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00742,"kevAdded":null},{"id":"CVE-2026-79993","published":"2026-09-16T09:27:22.516Z","updated":"2026-09-17T19:16:04.241Z","title":"Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2026-59969","published":"2026-09-16T09:27:00.726Z","updated":"2026-09-17T19:17:01.444Z","title":"Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.0033,"kevAdded":null},{"id":"CVE-2026-59739","published":"2026-09-16T09:26:37.690Z","updated":"2026-09-17T19:19:17.226Z","title":"Apache ZooKeeper: Information disclosure via SetWatches reconnect replay","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-86466","published":"2026-09-16T09:12:51.849Z","updated":"2026-09-17T19:21:08.487Z","title":"Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-76187","published":"2026-09-16T09:10:57.704Z","updated":"2026-09-17T19:21:54.927Z","title":"Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Keycloak provider","kev":false,"epss":0.00977,"kevAdded":null},{"id":"CVE-2026-76186","published":"2026-09-16T09:09:57.800Z","updated":"2026-09-17T19:22:48.731Z","title":"Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow Keycloak provider","kev":false,"epss":0.00811,"kevAdded":null},{"id":"CVE-2026-82310","published":"2026-09-16T09:09:07.539Z","updated":"2026-09-17T19:23:48.335Z","title":"Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.01004,"kevAdded":null},{"id":"CVE-2026-86792","published":"2026-09-16T09:08:20.184Z","updated":"2026-09-17T19:39:11.786Z","title":"Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Apache Kafka provider","kev":false,"epss":0.01189,"kevAdded":null},{"id":"CVE-2026-86462","published":"2026-09-16T09:05:42.066Z","updated":"2026-09-17T19:24:52.871Z","title":"Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00828,"kevAdded":null},{"id":"CVE-2026-82311","published":"2026-09-16T09:00:38.459Z","updated":"2026-09-17T19:27:29.873Z","title":"Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00977,"kevAdded":null},{"id":"CVE-2026-86465","published":"2026-09-16T08:58:05.539Z","updated":"2026-09-17T19:31:28.101Z","title":"Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Akeyless provider","kev":false,"epss":0.0081,"kevAdded":null},{"id":"CVE-2026-82427","published":"2026-09-14T14:19:16.027Z","updated":"2026-09-14T19:56:39.893Z","title":"Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.00153,"kevAdded":null},{"id":"CVE-2026-82428","published":"2026-09-14T14:18:09.921Z","updated":"2026-09-14T19:59:04.884Z","title":"Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Storm Client","kev":false,"epss":0.00693,"kevAdded":null},{"id":"CVE-2026-82429","published":"2026-09-14T14:16:45.617Z","updated":"2026-09-14T20:00:03.659Z","title":"Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Storm Worker Launcher","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-82430","published":"2026-09-14T14:15:58.744Z","updated":"2026-09-14T20:00:53.152Z","title":"Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Storm Worker Launcher","kev":false,"epss":0.00137,"kevAdded":null},{"id":"CVE-2026-82431","published":"2026-09-14T14:14:48.439Z","updated":"2026-09-14T20:01:54.073Z","title":"Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Storm Client","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-82433","published":"2026-09-14T14:12:23.796Z","updated":"2026-09-14T20:02:43.408Z","title":"Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-82432","published":"2026-09-14T14:11:27.374Z","updated":"2026-09-14T20:03:24.941Z","title":"Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-82434","published":"2026-09-14T14:10:15.326Z","updated":"2026-09-14T19:50:34.074Z","title":"Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.00501,"kevAdded":null},{"id":"CVE-2026-82435","published":"2026-09-14T14:09:20.374Z","updated":"2026-09-14T19:55:40.664Z","title":"Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Storm Worker","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-82437","published":"2026-09-14T14:05:07.981Z","updated":"2026-09-14T19:54:36.871Z","title":"Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Storm Logviewer","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-82426","published":"2026-09-14T14:04:16.954Z","updated":"2026-09-14T19:53:45.290Z","title":"Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-82438","published":"2026-09-14T14:02:07.213Z","updated":"2026-09-14T19:52:48.724Z","title":"Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Storm Webapp","kev":false,"epss":0.0021,"kevAdded":null},{"id":"CVE-2026-82439","published":"2026-09-14T14:00:09.318Z","updated":"2026-09-14T19:51:25.795Z","title":"Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Storm DRPC","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2026-82441","published":"2026-09-14T13:58:56.249Z","updated":"2026-09-14T19:44:33.448Z","title":"Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-84179","published":"2026-09-14T13:57:59.045Z","updated":"2026-09-14T19:49:29.948Z","title":"Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Storm Nimbus","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-73191","published":"2026-09-14T13:24:22.654Z","updated":"2026-09-14T19:32:54.329Z","title":"Apache Syncope: CAS service URL injection via Forwarded HTTP headers","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-73195","published":"2026-09-14T13:23:47.800Z","updated":"2026-09-14T18:09:01.626Z","title":"Apache Syncope: CSV export spreadsheet formula injection","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-73236","published":"2026-09-14T13:23:17.877Z","updated":"2026-09-14T19:31:48.348Z","title":"Apache Syncope: Cross-Realm authorization bypass in delegated administration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-73370","published":"2026-09-14T13:07:58.300Z","updated":"2026-09-14T19:30:54.811Z","title":"Apache Syncope: Cross-Realm boundaries reconciliation bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-73178","published":"2026-09-14T13:06:19.901Z","updated":"2026-09-14T19:29:51.690Z","title":"Apache Syncope: JWT Access Token takeover","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-73470","published":"2026-09-14T12:58:51.370Z","updated":"2026-09-14T19:28:54.807Z","title":"Apache Syncope: Delegating users can grant unowned Roles","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-73579","published":"2026-09-14T12:56:31.968Z","updated":"2026-09-14T19:27:56.971Z","title":"Apache Syncope: Non-recursive Any search could skip Realms restrictions","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-75015","published":"2026-09-14T12:55:27.674Z","updated":"2026-09-14T19:26:59.920Z","title":"Apache Syncope: Nested secrets leak cleartext into audit records readable","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-75030","published":"2026-09-14T12:54:22.279Z","updated":"2026-09-14T19:25:52.804Z","title":"Apache Syncope: Incomplete authorization checks for Group members deprovisioning","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00621,"kevAdded":null},{"id":"CVE-2026-77051","published":"2026-09-14T12:52:49.991Z","updated":"2026-09-14T19:25:08.227Z","title":"Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00602,"kevAdded":null},{"id":"CVE-2026-73668","published":"2026-09-14T12:51:46.076Z","updated":"2026-09-14T19:14:24.680Z","title":"Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-77147","published":"2026-09-14T12:49:41.648Z","updated":"2026-09-14T18:09:13.433Z","title":"Apache Syncope: Groovy Sandbox escape for empty CommandArgs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-77181","published":"2026-09-14T12:48:01.288Z","updated":"2026-09-14T19:15:22.159Z","title":"Apache Syncope: ClientApp update entitlement not effective","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-77883","published":"2026-09-14T12:30:53.819Z","updated":"2026-09-14T19:16:45.603Z","title":"Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00391,"kevAdded":null},{"id":"CVE-2026-78318","published":"2026-09-14T12:29:34.139Z","updated":"2026-09-14T19:17:58.065Z","title":"Apache Syncope: Unauthenticated reflected XSS in Console and Enduser","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-78330","published":"2026-09-14T12:24:56.656Z","updated":"2026-09-14T19:20:54.424Z","title":"Apache Syncope: Privilege escalation for admin user via JWT authentication","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00642,"kevAdded":null},{"id":"CVE-2026-78336","published":"2026-09-14T12:23:51.971Z","updated":"2026-09-14T19:21:38.676Z","title":"Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-82232","published":"2026-09-14T10:45:44.771Z","updated":"2026-09-14T19:48:20.965Z","title":"Apache Syncope: SQL injection via sort parameter in Task search","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00602,"kevAdded":null},{"id":"CVE-2026-86460","published":"2026-09-14T10:43:58.914Z","updated":"2026-09-14T19:47:16.698Z","title":"Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2026-87779","published":"2026-09-14T10:42:56.292Z","updated":"2026-09-14T19:46:26.633Z","title":"Apache Syncope: AES Secret Key disclosure via log output","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-87785","published":"2026-09-14T10:38:12.389Z","updated":"2026-09-14T19:45:29.921Z","title":"Apache Syncope: JWT subject spoofing","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00549,"kevAdded":null},{"id":"CVE-2026-87802","published":"2026-09-14T10:22:29.574Z","updated":"2026-09-14T19:39:26.483Z","title":"Apache Syncope: SRA OAuth2 JWT signature verification bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-68570","published":"2026-09-14T10:00:20.881Z","updated":"2026-09-14T19:38:35.447Z","title":"Apache Doris: Authorization bypass leading to unauthorized data access","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-72524","published":"2026-09-14T09:58:50.635Z","updated":"2026-09-14T19:37:24.986Z","title":"Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-82617","published":"2026-09-11T17:50:53.639Z","updated":"2026-09-11T21:07:10.400Z","title":"Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.00767,"kevAdded":null},{"id":"CVE-2026-67211","published":"2026-09-11T17:49:07.499Z","updated":"2026-09-14T18:50:04.110Z","title":"Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-80354","published":"2026-09-10T07:43:23.231Z","updated":"2026-09-10T16:00:59.953Z","title":"Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Camel K","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-80351","published":"2026-09-10T07:42:57.856Z","updated":"2026-09-10T16:00:02.698Z","title":"Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel K","kev":false,"epss":0.01013,"kevAdded":null},{"id":"CVE-2026-80352","published":"2026-09-10T07:41:33.842Z","updated":"2026-09-10T15:59:02.944Z","title":"Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel K","kev":false,"epss":0.00836,"kevAdded":null},{"id":"CVE-2026-84939","published":"2026-09-10T05:07:24.045Z","updated":"2026-09-10T15:58:02.810Z","title":"Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache FreeMarker","kev":false,"epss":0.00854,"kevAdded":null},{"id":"CVE-2026-49362","published":"2026-09-10T04:56:19.952Z","updated":"2026-09-10T15:56:53.805Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.00821,"kevAdded":null},{"id":"CVE-2026-49363","published":"2026-09-10T04:51:56.614Z","updated":"2026-09-10T15:55:22.267Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.00804,"kevAdded":null},{"id":"CVE-2026-49364","published":"2026-09-10T04:49:27.014Z","updated":"2026-09-10T15:54:25.139Z","title":"Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2026-57822","published":"2026-09-10T04:46:52.192Z","updated":"2026-09-10T15:53:35.376Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2026-57967","published":"2026-09-10T04:43:10.313Z","updated":"2026-10-09T15:36:10.600Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.01468,"kevAdded":null},{"id":"CVE-2026-67593","published":"2026-09-10T04:40:29.793Z","updated":"2026-09-10T15:51:10.430Z","title":"Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2026-75880","published":"2026-09-10T04:36:08.059Z","updated":"2026-09-18T14:37:28.641Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-74761","published":"2026-09-09T11:10:16.065Z","updated":"2026-09-10T18:00:51.191Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.00623,"kevAdded":null},{"id":"CVE-2026-73334","published":"2026-09-09T10:48:46.250Z","updated":"2026-09-10T17:55:48.179Z","title":"Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Parquet Hadoop","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2026-41871","published":"2026-09-09T10:45:47.005Z","updated":"2026-09-10T17:56:50.962Z","title":"Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Nutch","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-41869","published":"2026-09-09T10:44:30.167Z","updated":"2026-09-10T18:44:48.446Z","title":"Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Nutch","kev":false,"epss":0.00719,"kevAdded":null},{"id":"CVE-2026-41870","published":"2026-09-09T10:43:04.894Z","updated":"2026-09-10T18:03:38.898Z","title":"Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Nutch","kev":false,"epss":0.00665,"kevAdded":null},{"id":"CVE-2026-65181","published":"2026-09-09T10:40:51.317Z","updated":"2026-09-09T20:22:07.658Z","title":"Apache Impala: RCE via External Data Source Class Loading","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-57866","published":"2026-09-09T10:39:47.244Z","updated":"2026-09-10T18:13:02.052Z","title":"Apache Impala: Secrets Exfiltration via SSRF","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-56207","published":"2026-09-09T10:36:55.238Z","updated":"2026-09-10T17:58:21.228Z","title":"Apache Impala: SAML authentication bypass via forged bearer token","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-54048","published":"2026-09-09T10:34:01.432Z","updated":"2026-09-10T17:59:38.994Z","title":"Apache Impala: Avro Schema URL Server-Side Request Forgery","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2026-75156","published":"2026-09-08T16:47:48.290Z","updated":"2026-09-16T14:57:01.780Z","title":"Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-78254","published":"2026-09-07T07:41:54.077Z","updated":"2026-09-08T15:45:11.304Z","title":"Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Ant","kev":false,"epss":0.0052,"kevAdded":null},{"id":"CVE-2026-52691","published":"2026-09-04T13:39:10.779Z","updated":"2026-09-08T18:55:35.369Z","title":"Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Griffin Hive Metastore Module","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2026-80190","published":"2026-09-04T07:06:19.844Z","updated":"2026-09-04T19:42:07.044Z","title":"Apache Allura: Stored XSS via code repositories","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-85229","published":"2026-09-04T07:01:39.869Z","updated":"2026-09-08T18:57:06.433Z","title":"Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache SkyWalking","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2026-81270","published":"2026-09-04T06:59:49.532Z","updated":"2026-09-04T19:42:56.685Z","title":"Apache Allura: Information exposure via search","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-71216","published":"2026-09-04T06:55:59.485Z","updated":"2026-09-08T14:40:32.188Z","title":"Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache SkyWalking","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-80181","published":"2026-09-04T06:52:42.990Z","updated":"2026-09-08T18:57:42.971Z","title":"Apache Allura: Server-side request forgery","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-80180","published":"2026-09-04T06:50:14.773Z","updated":"2026-09-04T19:43:36.978Z","title":"Apache Allura: Stored XSS via markdown HTML processing","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2026-32773","published":"2026-09-02T10:51:17.197Z","updated":"2026-09-02T12:43:56.359Z","title":"Apache Spark: XSS Vulnerability in Spark Web 3.5.4","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2026-76986","published":"2026-08-31T13:25:10.416Z","updated":"2026-08-31T14:22:31.760Z","title":"Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-76985","published":"2026-08-31T13:22:18.540Z","updated":"2026-08-31T14:21:50.678Z","title":"Apache Wicket: XSS in Palette via getAdditionalAttributes","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-76983","published":"2026-08-31T11:56:38.210Z","updated":"2026-08-31T14:19:51.510Z","title":"Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-76984","published":"2026-08-31T11:56:15.981Z","updated":"2026-08-31T14:19:30.897Z","title":"Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-76982","published":"2026-08-31T11:52:26.161Z","updated":"2026-08-31T14:19:06.921Z","title":"Apache Wicket: XSS in Button via its model object","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-75802","published":"2026-08-31T11:52:17.041Z","updated":"2026-08-31T14:18:40.358Z","title":"Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-71378","published":"2026-08-31T11:46:27.806Z","updated":"2026-08-31T19:03:03.334Z","title":"Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener","severity":"MEDIUM","score":4.6,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00251,"kevAdded":null},{"id":"CVE-2026-71257","published":"2026-08-31T11:45:49.528Z","updated":"2026-09-01T18:01:24.791Z","title":"Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-70449","published":"2026-08-31T11:44:14.929Z","updated":"2026-08-31T19:01:32.771Z","title":"Apache Wicket: Path traversal in resource style/variation/locale","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00914,"kevAdded":null},{"id":"CVE-2026-58301","published":"2026-08-31T07:40:37.337Z","updated":"2026-08-31T15:29:49.700Z","title":"Apache Shiro: Server-side POST request may be steered to an alternate host","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-74848","published":"2026-08-27T09:16:06.985Z","updated":"2026-08-27T12:05:30.790Z","title":"Apache APISIX: Cross-user response poisoning in serverless plugins","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-75005","published":"2026-08-27T09:15:32.196Z","updated":"2026-08-27T12:06:27.060Z","title":"Apache APISIX: Unauthenticated CPU-exhaustion DoS","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-75020","published":"2026-08-27T09:14:33.099Z","updated":"2026-08-27T12:09:54.558Z","title":"Apache APISIX: ldap-auth plugin cross-subtree identity impersonation","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-63041","published":"2026-08-26T11:34:59.724Z","updated":"2026-08-26T12:31:31.308Z","title":"Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-73180","published":"2026-08-25T22:01:58.000Z","updated":"2026-08-26T18:35:13.414Z","title":"Apache Tomcat: Authenticated WebSocket session survives end of HTTP session","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2026-68763","published":"2026-08-25T22:00:37.047Z","updated":"2026-08-26T18:36:43.341Z","title":"Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2026-68569","published":"2026-08-25T21:59:17.438Z","updated":"2026-09-21T11:06:13.066Z","title":"Apache Tomcat: Principal lookup can fail open in some cases","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-68525","published":"2026-08-25T21:57:18.557Z","updated":"2026-08-26T18:40:55.312Z","title":"Apache Tomcat: Redirect after FORM auth may bypass method specific constraints","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00643,"kevAdded":null},{"id":"CVE-2026-66422","published":"2026-08-25T21:55:16.928Z","updated":"2026-08-26T18:52:26.487Z","title":"Apache Tomcat: Servlet role references can bypass declarative role constraints","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-65927","published":"2026-08-25T21:53:05.852Z","updated":"2026-08-26T15:22:01.843Z","title":"Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-65905","published":"2026-08-25T21:51:33.307Z","updated":"2026-08-26T15:21:11.604Z","title":"Apache Tomcat: Limited replay attack possible with DIGEST authentication","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00755,"kevAdded":null},{"id":"CVE-2026-65637","published":"2026-08-25T21:49:13.127Z","updated":"2026-08-26T15:20:30.366Z","title":"Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00751,"kevAdded":null},{"id":"CVE-2026-65183","published":"2026-08-25T21:44:49.363Z","updated":"2026-08-26T15:19:19.234Z","title":"Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-65182","published":"2026-08-25T21:43:37.040Z","updated":"2026-08-26T15:18:16.813Z","title":"Apache Tomcat: Bypass longest prefix security constraint","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00654,"kevAdded":null},{"id":"CVE-2026-49845","published":"2026-08-25T10:13:49.998Z","updated":"2026-11-03T22:13:26.174Z","title":"Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.00891,"kevAdded":null},{"id":"CVE-2026-55976","published":"2026-08-25T10:13:27.529Z","updated":"2026-08-26T18:50:58.145Z","title":"Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01038,"kevAdded":null},{"id":"CVE-2026-53561","published":"2026-08-25T10:12:53.804Z","updated":"2026-08-26T18:49:03.614Z","title":"Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.00339,"kevAdded":null},{"id":"CVE-2026-49050","published":"2026-08-25T09:57:48.064Z","updated":"2026-08-25T14:40:07.589Z","title":"Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-75099","published":"2026-08-24T16:42:20.920Z","updated":"2026-08-24T18:08:37.753Z","title":"Apache Allura: Unauthenticated REST disclosure","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-78329","published":"2026-08-24T16:22:17.528Z","updated":"2026-08-26T18:47:32.653Z","title":"Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2026-71300","published":"2026-08-24T16:21:17.218Z","updated":"2026-08-25T19:39:50.077Z","title":"Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2026-63621","published":"2026-08-24T16:17:26.499Z","updated":"2026-08-25T19:39:09.091Z","title":"Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00588,"kevAdded":null},{"id":"CVE-2026-66908","published":"2026-08-24T16:14:18.202Z","updated":"2026-08-25T19:38:28.088Z","title":"Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0061,"kevAdded":null},{"id":"CVE-2026-66907","published":"2026-08-24T16:13:04.957Z","updated":"2026-08-25T19:37:45.023Z","title":"Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2026-66906","published":"2026-08-24T16:12:09.993Z","updated":"2026-08-25T19:37:02.605Z","title":"Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00776,"kevAdded":null},{"id":"CVE-2026-60093","published":"2026-08-24T16:11:23.500Z","updated":"2026-08-25T19:36:10.880Z","title":"Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-59230","published":"2026-08-24T16:09:44.229Z","updated":"2026-08-25T19:35:08.113Z","title":"Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-59654","published":"2026-08-21T12:33:00.577Z","updated":"2026-08-24T13:01:27.125Z","title":"Apache CloudStack: DoS caused by database connections leak","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00591,"kevAdded":null},{"id":"CVE-2026-63046","published":"2026-08-21T08:37:57.457Z","updated":"2026-08-21T18:42:34.370Z","title":"Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-47359","published":"2026-08-21T08:30:07.701Z","updated":"2026-08-26T14:17:31.535Z","title":"Apache CloudStack: OS Command Injection due to unsanitized mount command","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.02033,"kevAdded":null},{"id":"CVE-2026-50112","published":"2026-08-21T08:29:41.036Z","updated":"2026-08-22T03:56:23.094Z","title":"Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00723,"kevAdded":null},{"id":"CVE-2026-50222","published":"2026-08-21T08:29:17.886Z","updated":"2026-08-25T19:34:16.076Z","title":"Apache CloudStack: Improper access control in Userdata reference APIs","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00539,"kevAdded":null},{"id":"CVE-2026-59085","published":"2026-08-21T08:28:51.468Z","updated":"2026-08-25T19:25:43.874Z","title":"Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00586,"kevAdded":null},{"id":"CVE-2026-59655","published":"2026-08-21T08:28:14.209Z","updated":"2026-08-25T19:24:58.263Z","title":"Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-59657","published":"2026-08-21T08:27:53.211Z","updated":"2026-08-25T19:24:10.749Z","title":"Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-59780","published":"2026-08-21T08:27:16.849Z","updated":"2026-08-25T19:23:16.262Z","title":"Apache CloudStack: LDAP provider configuration disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-59799","published":"2026-08-21T08:26:52.001Z","updated":"2026-08-24T15:58:06.019Z","title":"Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00604,"kevAdded":null},{"id":"CVE-2026-61397","published":"2026-08-21T08:26:25.472Z","updated":"2026-08-25T19:22:14.318Z","title":"Apache CloudStack: OAuth2 Token Cross-Request Leak","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-61398","published":"2026-08-21T08:25:47.657Z","updated":"2026-08-25T19:21:10.214Z","title":"Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00568,"kevAdded":null},{"id":"CVE-2026-61399","published":"2026-08-21T08:25:23.403Z","updated":"2026-08-24T17:04:44.124Z","title":"Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00502,"kevAdded":null},{"id":"CVE-2026-61400","published":"2026-08-21T08:25:02.951Z","updated":"2026-08-22T03:56:24.167Z","title":"Apache CloudStack: Get and Run Diagnostics Command Injection","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.02907,"kevAdded":null},{"id":"CVE-2026-61422","published":"2026-08-21T08:24:38.323Z","updated":"2026-08-24T17:03:52.112Z","title":"Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00415,"kevAdded":null},{"id":"CVE-2026-62440","published":"2026-08-21T08:23:55.427Z","updated":"2026-08-25T19:20:14.393Z","title":"Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2026-65613","published":"2026-08-21T08:23:30.843Z","updated":"2026-08-24T17:05:33.247Z","title":"Apache CloudStack: Webhook Deliveries Incorrect Access","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00452,"kevAdded":null},{"id":"CVE-2026-66721","published":"2026-08-21T08:23:00.807Z","updated":"2026-08-24T17:06:30.824Z","title":"Apache CloudStack: Authorization issue with listHostTags for domain admins","severity":"LOW","score":2.7,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-66722","published":"2026-08-21T08:22:36.337Z","updated":"2026-08-25T03:56:49.706Z","title":"Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2026-66797","published":"2026-08-21T08:21:58.452Z","updated":"2026-08-21T19:45:45.850Z","title":"Apache CloudStack: Unauthorised comment creation and disclosure","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-68745","published":"2026-08-21T08:21:29.200Z","updated":"2026-08-24T16:58:39.257Z","title":"Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00204,"kevAdded":null},{"id":"CVE-2026-63044","published":"2026-08-20T15:57:02.234Z","updated":"2026-08-21T18:57:30.703Z","title":"Apache InLong: Authenticated SSRF via POST /api/node/testConnection","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-63043","published":"2026-08-20T15:53:11.930Z","updated":"2026-08-24T16:57:47.311Z","title":"Apache InLong: Agent path traversal via unvalidated file source path","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2026-63042","published":"2026-08-20T15:50:06.733Z","updated":"2026-08-24T16:57:08.270Z","title":"Apache InLong: Missing authorization on DataNode management endpoints","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-63040","published":"2026-08-20T15:48:53.042Z","updated":"2026-08-24T16:56:31.345Z","title":"Apache InLong: Missing authorization in StreamSource forceDelete","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-63039","published":"2026-08-20T15:43:55.637Z","updated":"2026-08-24T16:55:35.826Z","title":"Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2026-63038","published":"2026-08-20T15:42:47.028Z","updated":"2026-08-24T16:55:01.857Z","title":"Apache InLong: SQL Injection via String Concatenation Vulnerability Report","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2026-63037","published":"2026-08-20T15:37:35.375Z","updated":"2026-08-24T16:54:16.354Z","title":"Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2026-63016","published":"2026-08-20T15:33:01.461Z","updated":"2026-08-20T17:09:14.898Z","title":"Apache InLong: Ordinary users can create new packages","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00634,"kevAdded":null},{"id":"CVE-2026-63015","published":"2026-08-20T15:31:28.560Z","updated":"2026-08-20T17:09:13.663Z","title":"Apache InLong: Non-template responsible persons can view template information","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00559,"kevAdded":null},{"id":"CVE-2026-34884","published":"2026-08-18T07:26:38.352Z","updated":"2026-08-19T13:28:04.910Z","title":"Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache SkyWalking MCP","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2026-73632","published":"2026-08-15T10:38:53.381Z","updated":"2026-08-17T12:40:45.499Z","title":"Apache Struts: Shared serialization state in the JSON plugin","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-73631","published":"2026-08-15T10:38:28.497Z","updated":"2026-08-17T12:42:11.591Z","title":"Apache Struts: Shared parsing state in the JSON plugin","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-73635","published":"2026-08-15T10:38:08.227Z","updated":"2026-08-17T12:43:26.618Z","title":"Apache Struts: Unbounded growth of localized-text caches driven by the request locale","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-73634","published":"2026-08-15T10:37:37.892Z","updated":"2026-08-17T12:44:54.972Z","title":"Apache Struts: Unbounded read of a Content Security Policy violation report","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-73633","published":"2026-08-14T13:48:44.821Z","updated":"2026-08-14T14:38:07.397Z","title":"Apache Struts: Unbounded read of a JSON request body","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00698,"kevAdded":null},{"id":"CVE-2026-66256","published":"2026-08-13T13:53:34.930Z","updated":"2026-08-13T16:18:21.390Z","title":"Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Shindig Common","kev":false,"epss":0.00935,"kevAdded":null},{"id":"CVE-2026-73237","published":"2026-08-12T16:42:27.363Z","updated":"2026-08-12T18:56:52.515Z","title":"Apache Allura: XSS in markdown pipeline","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2026-73238","published":"2026-08-12T16:41:58.661Z","updated":"2026-08-12T18:59:25.833Z","title":"Apache Allura: XSS in code display","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2026-73239","published":"2026-08-12T16:41:41.094Z","updated":"2026-08-13T15:49:39.802Z","title":"Apache Allura: Missing permission checks IDOR","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00622,"kevAdded":null},{"id":"CVE-2026-73240","published":"2026-08-12T16:41:19.253Z","updated":"2026-08-13T15:50:18.980Z","title":"Apache Allura: Git command injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.01043,"kevAdded":null},{"id":"CVE-2026-59244","published":"2026-08-12T15:43:17.373Z","updated":"2026-11-03T06:58:57.180Z","title":"Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-58076","published":"2026-08-12T15:40:59.934Z","updated":"2026-11-03T06:58:44.859Z","title":"Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2026-59242","published":"2026-08-12T15:35:00.763Z","updated":"2026-11-03T06:58:51.061Z","title":"Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-54183","published":"2026-08-12T15:34:22.966Z","updated":"2026-11-03T06:58:38.940Z","title":"Apache Airflow: Airflow Variables were not masked in the UI for authenticated users","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-67260","published":"2026-08-12T15:33:02.858Z","updated":"2026-11-03T06:59:09.280Z","title":"Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00779,"kevAdded":null},{"id":"CVE-2026-67587","published":"2026-08-12T15:32:10.565Z","updated":"2026-11-03T06:59:15.615Z","title":"Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2026-65017","published":"2026-08-12T15:31:26.092Z","updated":"2026-11-03T06:59:03.183Z","title":"Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-68968","published":"2026-08-12T15:27:46.731Z","updated":"2026-11-03T07:00:06.532Z","title":"Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-68969","published":"2026-08-12T15:26:40.095Z","updated":"2026-11-03T07:00:16.212Z","title":"Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-68970","published":"2026-08-12T15:24:53.217Z","updated":"2026-11-03T07:00:22.374Z","title":"Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-68971","published":"2026-08-12T15:24:10.679Z","updated":"2026-11-03T07:00:28.577Z","title":"Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00328,"kevAdded":null},{"id":"CVE-2026-68076","published":"2026-08-12T15:23:22.930Z","updated":"2026-11-03T06:59:58.489Z","title":"Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-68868","published":"2026-08-12T10:27:56.154Z","updated":"2026-09-16T14:56:15.356Z","title":"Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Google provider","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2026-71290","published":"2026-08-11T20:33:56.947Z","updated":"2026-09-24T03:55:24.916Z","title":"Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HttpComponents Client","kev":false,"epss":0.00331,"kevAdded":null},{"id":"CVE-2026-69223","published":"2026-08-11T17:03:04.815Z","updated":"2026-08-12T19:19:20.765Z","title":"Apache Allura: Server-side request forgery","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00781,"kevAdded":null},{"id":"CVE-2026-68872","published":"2026-08-10T18:21:19.745Z","updated":"2026-09-16T14:56:32.688Z","title":"Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Amazon provider","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2026-68871","published":"2026-08-10T18:18:20.026Z","updated":"2026-09-16T14:56:26.393Z","title":"Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Yandex provider","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-68870","published":"2026-08-10T18:10:33.022Z","updated":"2026-09-16T14:56:18.601Z","title":"Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow Microsoft Azure provider","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-61899","published":"2026-08-10T10:36:03.160Z","updated":"2026-08-10T19:53:45.112Z","title":"Apache Tapestry: Possible classpath file download through URL manipulation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tapestry","kev":false,"epss":0.00713,"kevAdded":null},{"id":"CVE-2026-28672","published":"2026-08-10T10:26:32.654Z","updated":"2026-08-12T15:49:07.214Z","title":"Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.02631,"kevAdded":null},{"id":"CVE-2026-32227","published":"2026-08-10T10:26:06.331Z","updated":"2026-08-12T15:50:08.598Z","title":"Apache Ranger: SQL Injection vulnerability in lookup functionality","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2026-40920","published":"2026-08-10T10:25:49.563Z","updated":"2026-08-12T15:20:12.224Z","title":"Apache Ranger: Privilege Escalation via URL Parameter","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-42537","published":"2026-08-10T10:24:34.478Z","updated":"2026-08-12T15:20:52.287Z","title":"Apache Ranger: Remote Code Execution via JDBC URL Injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.01289,"kevAdded":null},{"id":"CVE-2026-44416","published":"2026-08-10T10:23:50.893Z","updated":"2026-08-12T15:19:33.507Z","title":"Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.01242,"kevAdded":null},{"id":"CVE-2026-55799","published":"2026-08-10T10:23:28.335Z","updated":"2026-08-12T15:18:52.023Z","title":"Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.01216,"kevAdded":null},{"id":"CVE-2026-55814","published":"2026-08-10T10:21:28.398Z","updated":"2026-08-10T19:57:30.694Z","title":"Apache Ranger: Download APIs expose plugin data without authentication","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00657,"kevAdded":null},{"id":"CVE-2026-65942","published":"2026-08-10T10:21:05.273Z","updated":"2026-08-10T19:58:09.112Z","title":"Apache Ranger: Clients accept TLS certificates issued for other hostnames","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00589,"kevAdded":null},{"id":"CVE-2026-65945","published":"2026-08-10T10:20:40.782Z","updated":"2026-08-10T19:58:46.630Z","title":"Apache Ranger: Logs contain replayable JWT bearer tokens","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00637,"kevAdded":null},{"id":"CVE-2026-65948","published":"2026-08-10T10:20:18.122Z","updated":"2026-08-10T19:59:35.403Z","title":"Apache Ranger: UnixAuth lacks brute-force protection","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00618,"kevAdded":null},{"id":"CVE-2026-44630","published":"2026-08-10T09:25:11.899Z","updated":"2026-08-12T15:54:05.223Z","title":"Apache IoTDB: RPC service denial of service via unchecked Thrift string length","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2026-71559","published":"2026-08-07T08:56:09.167Z","updated":"2026-08-07T17:51:17.894Z","title":"Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00799,"kevAdded":null},{"id":"CVE-2026-71558","published":"2026-08-07T08:54:56.897Z","updated":"2026-08-07T17:48:23.240Z","title":"Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.0099,"kevAdded":null},{"id":"CVE-2026-71560","published":"2026-08-07T08:53:36.032Z","updated":"2026-08-07T17:44:08.783Z","title":"Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00767,"kevAdded":null},{"id":"CVE-2025-49506","published":"2026-08-06T14:33:12.957Z","updated":"2026-08-06T21:56:06.543Z","title":"Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime Utility","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-32327","published":"2026-08-06T14:32:43.526Z","updated":"2026-08-06T21:56:07.488Z","title":"Apache Portable Runtime Utility: apr-util XML stack recursion crash","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime Utility","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2026-34191","published":"2026-08-06T14:32:24.362Z","updated":"2026-08-06T21:56:08.447Z","title":"Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime Utility","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2026-34501","published":"2026-08-06T14:31:48.356Z","updated":"2026-08-06T21:56:09.410Z","title":"Apache Portable Runtime Utility: Heap buffer overflow in APR redis client","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime Utility","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-34502","published":"2026-08-06T14:31:07.682Z","updated":"2026-08-06T21:56:10.337Z","title":"Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime Utility","kev":false,"epss":0.00508,"kevAdded":null},{"id":"CVE-2026-57818","published":"2026-08-06T11:24:53.590Z","updated":"2026-08-07T00:01:42.058Z","title":"Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2026-61466","published":"2026-08-06T11:24:27.466Z","updated":"2026-08-07T00:01:45.092Z","title":"Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00711,"kevAdded":null},{"id":"CVE-2026-63687","published":"2026-08-06T11:23:45.175Z","updated":"2026-08-07T00:01:46.574Z","title":"Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-65583","published":"2026-08-06T11:23:17.421Z","updated":"2026-08-07T00:01:49.572Z","title":"Apache CXF: Self-issued ID token claims validation skipped","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2026-68079","published":"2026-08-06T11:22:57.938Z","updated":"2026-08-07T00:01:53.998Z","title":"Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-68481","published":"2026-08-06T11:22:37.929Z","updated":"2026-08-07T00:01:55.439Z","title":"Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-65432","published":"2026-08-06T10:26:12.142Z","updated":"2026-08-07T00:01:48.075Z","title":"Apache CXF: XXE via WSDL/XSD import parsing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-57817","published":"2026-08-06T10:24:05.877Z","updated":"2026-08-07T03:55:29.695Z","title":"Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2026-66909","published":"2026-08-06T10:23:23.571Z","updated":"2026-08-07T00:01:52.513Z","title":"Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.01148,"kevAdded":null},{"id":"CVE-2026-64958","published":"2026-08-06T10:13:04.069Z","updated":"2026-08-06T15:10:53.292Z","title":"Apache CXF: Denial of service via message header attachments","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-57819","published":"2026-08-06T10:12:26.243Z","updated":"2026-08-07T00:01:43.594Z","title":"Apache CXF: No default restriction on the amount of form parameters per message","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-54225","published":"2026-08-06T10:11:41.498Z","updated":"2026-08-07T00:01:38.618Z","title":"Apache CXF: Denial of Service attack via large attachments","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-64640","published":"2026-08-06T09:08:06.534Z","updated":"2026-08-06T21:56:16.978Z","title":"Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Polaris","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-60053","published":"2026-08-05T15:13:10.355Z","updated":"2026-08-06T17:47:19.743Z","title":"Apache Answer: Residual Administrative API Key Access After Role or Account Revocation","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2026-60023","published":"2026-08-05T15:12:08.100Z","updated":"2026-08-06T14:38:36.910Z","title":"Apache Answer: Unauthorized disclosure of deleted or pending answer content","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00622,"kevAdded":null},{"id":"CVE-2026-50749","published":"2026-08-05T15:11:05.448Z","updated":"2026-08-06T15:27:21.369Z","title":"Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-48912","published":"2026-08-05T15:10:08.165Z","updated":"2026-08-06T14:37:55.288Z","title":"Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-48911","published":"2026-08-05T15:09:14.961Z","updated":"2026-08-06T14:37:06.522Z","title":"Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2026-48834","published":"2026-08-05T15:07:35.440Z","updated":"2026-08-06T14:35:47.589Z","title":"Apache Answer: Denial of service via crafted Accept-Language header parsing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00764,"kevAdded":null},{"id":"CVE-2026-61486","published":"2026-08-05T06:44:11.537Z","updated":"2026-09-04T15:55:46.443Z","title":"Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Lucy","kev":false,"epss":0.00807,"kevAdded":null},{"id":"CVE-2026-61484","published":"2026-08-05T06:42:06.543Z","updated":"2026-09-04T15:54:49.236Z","title":"Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Lucy","kev":false,"epss":0.00806,"kevAdded":null},{"id":"CVE-2026-61483","published":"2026-08-05T06:36:02.509Z","updated":"2026-09-04T15:53:38.317Z","title":"Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Lucy","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-68080","published":"2026-08-05T05:51:22.557Z","updated":"2026-08-05T14:58:48.703Z","title":"Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-67592","published":"2026-08-05T05:44:18.798Z","updated":"2026-08-05T15:20:13.011Z","title":"Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid ProtonJ2","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-67555","published":"2026-08-05T05:43:57.460Z","updated":"2026-08-05T17:43:30.655Z","title":"Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton Dotnet","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-68078","published":"2026-08-05T05:43:35.812Z","updated":"2026-08-05T15:29:55.243Z","title":"Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-66277","published":"2026-08-05T05:42:30.115Z","updated":"2026-08-05T15:38:51.857Z","title":"Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-67554","published":"2026-08-05T05:41:26.552Z","updated":"2026-08-05T15:44:38.533Z","title":"Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton Dotnet","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-68077","published":"2026-08-05T05:41:07.199Z","updated":"2026-08-06T15:13:48.596Z","title":"Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-66276","published":"2026-08-05T05:39:30.605Z","updated":"2026-08-06T15:14:36.749Z","title":"Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-67591","published":"2026-08-05T05:38:26.147Z","updated":"2026-08-06T15:16:01.150Z","title":"Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid ProtonJ2","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-67553","published":"2026-08-05T05:37:29.095Z","updated":"2026-08-06T15:19:37.702Z","title":"Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton Dotnet","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-68075","published":"2026-08-05T05:36:02.661Z","updated":"2026-08-06T15:26:23.891Z","title":"Apache Qpid Broker-J: Incoming session flow control window can be exceeded","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-66275","published":"2026-08-05T05:34:48.549Z","updated":"2026-08-06T15:30:56.492Z","title":"Apache Qpid Proton-J: Incoming session flow control window can be exceeded","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-67590","published":"2026-08-05T05:33:39.626Z","updated":"2026-08-06T15:38:44.299Z","title":"Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid ProtonJ2","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-67552","published":"2026-08-05T05:32:58.378Z","updated":"2026-08-06T15:37:28.470Z","title":"Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton Dotnet","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-68073","published":"2026-08-05T05:32:25.113Z","updated":"2026-08-06T15:37:34.545Z","title":"Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-66274","published":"2026-08-05T05:29:44.681Z","updated":"2026-08-06T15:37:40.997Z","title":"Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-67589","published":"2026-08-05T05:28:15.054Z","updated":"2026-08-06T15:37:47.356Z","title":"Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid ProtonJ2","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-67551","published":"2026-08-05T05:27:24.551Z","updated":"2026-08-06T15:37:53.625Z","title":"Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton Dotnet","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-68060","published":"2026-08-05T05:26:27.176Z","updated":"2026-08-06T15:37:59.327Z","title":"Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-66273","published":"2026-08-05T05:23:31.964Z","updated":"2026-08-06T13:48:38.834Z","title":"Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-67588","published":"2026-08-05T05:21:44.240Z","updated":"2026-08-06T13:44:32.387Z","title":"Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid ProtonJ2","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-67465","published":"2026-08-05T05:21:04.115Z","updated":"2026-08-06T13:26:49.211Z","title":"Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton Dotnet","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-68074","published":"2026-08-05T05:19:55.467Z","updated":"2026-08-06T13:18:48.748Z","title":"Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-66257","published":"2026-08-05T05:18:01.606Z","updated":"2026-08-06T13:13:32.455Z","title":"Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2026-68981","published":"2026-08-03T19:59:58.955Z","updated":"2026-08-04T19:19:50.310Z","title":"Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-68980","published":"2026-08-03T19:58:56.074Z","updated":"2026-08-04T19:20:56.357Z","title":"Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-62354","published":"2026-08-03T19:57:44.979Z","updated":"2026-08-05T03:57:11.315Z","title":"Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-68979","published":"2026-08-03T19:56:11.463Z","updated":"2026-08-05T13:33:59.526Z","title":"Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2026-61372","published":"2026-08-03T15:41:27.580Z","updated":"2026-08-03T20:07:09.782Z","title":"Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Jena Fuseki","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2026-44615","published":"2026-07-31T11:05:07.878Z","updated":"2026-07-31T16:20:12.350Z","title":"Path traversal in NotebookRepo note and folder path composition","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00805,"kevAdded":null},{"id":"CVE-2026-64607","published":"2026-07-31T10:12:18.035Z","updated":"2026-08-13T16:18:20.395Z","title":"Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HttpComponents Client","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-62391","published":"2026-07-31T09:58:15.033Z","updated":"2026-07-31T16:29:28.224Z","title":"Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Kyuubi","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2026-66756","published":"2026-07-30T19:18:07.900Z","updated":"2026-07-30T19:33:01.657Z","title":"Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.00746,"kevAdded":null},{"id":"CVE-2026-66755","published":"2026-07-30T19:16:42.370Z","updated":"2026-09-01T12:05:18.862Z","title":"Apache Tika: Arbitrary Local File Read in ISArchiveParser","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-23985","published":"2026-07-30T16:09:24.026Z","updated":"2026-07-30T19:16:46.521Z","title":"Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-23981","published":"2026-07-30T16:08:26.989Z","updated":"2026-07-30T19:35:52.546Z","title":"Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-52680","published":"2026-07-30T16:07:12.786Z","updated":"2026-07-31T17:56:51.075Z","title":"Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kyuubi","kev":false,"epss":0.0111,"kevAdded":null},{"id":"CVE-2026-48910","published":"2026-07-30T15:56:33.613Z","updated":"2026-07-30T16:37:15.693Z","title":"Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2026-28814","published":"2026-07-30T15:55:28.034Z","updated":"2026-07-31T17:55:59.734Z","title":"Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.00657,"kevAdded":null},{"id":"CVE-2026-28813","published":"2026-07-30T15:54:19.667Z","updated":"2026-07-31T11:34:33.218Z","title":"Apache JSPWiki: JSPWiki vulnerable to JSON hijacking","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-28812","published":"2026-07-30T15:52:34.172Z","updated":"2026-07-31T15:28:08.984Z","title":"Apache JSPWiki: UserManager does not sanity-check user database at startup","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2026-28811","published":"2026-07-30T15:51:27.131Z","updated":"2026-07-31T17:54:14.250Z","title":"Apache JSPWiki: Error Handling - Reveals Error Details","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-44617","published":"2026-07-30T15:22:39.054Z","updated":"2026-07-31T17:53:01.753Z","title":"Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00838,"kevAdded":null},{"id":"CVE-2026-44616","published":"2026-07-30T15:21:21.609Z","updated":"2026-07-31T17:51:37.685Z","title":"Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00758,"kevAdded":null},{"id":"CVE-2026-44613","published":"2026-07-30T15:19:40.786Z","updated":"2026-08-07T14:09:35.363Z","title":"Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-50622","published":"2026-07-29T09:10:12.149Z","updated":"2026-07-30T03:55:13.207Z","title":"Apache Atlas: Missing Authorization on Admin Endpoints","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-23904","published":"2026-07-29T09:07:18.168Z","updated":"2026-07-29T14:00:38.959Z","title":"Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Kyuubi","kev":false,"epss":0.0085,"kevAdded":null},{"id":"CVE-2026-65100","published":"2026-07-29T09:06:17.226Z","updated":"2026-10-01T17:06:34.984Z","title":"Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2026-58189","published":"2026-07-29T09:05:19.468Z","updated":"2026-10-01T17:05:54.498Z","title":"Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00629,"kevAdded":null},{"id":"CVE-2026-58188","published":"2026-07-29T09:04:24.836Z","updated":"2026-10-01T17:05:39.081Z","title":"Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2026-58187","published":"2026-07-29T09:03:22.659Z","updated":"2026-10-01T17:05:24.712Z","title":"Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2026-58186","published":"2026-07-29T09:01:39.548Z","updated":"2026-10-01T17:05:07.822Z","title":"Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00704,"kevAdded":null},{"id":"CVE-2026-58185","published":"2026-07-29T08:57:48.774Z","updated":"2026-10-01T17:04:52.274Z","title":"Apache Traffic Server: Use-after-free in the intercept plugin","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-58184","published":"2026-07-29T08:56:51.696Z","updated":"2026-10-01T17:04:34.076Z","title":"Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2026-58183","published":"2026-07-29T08:55:52.927Z","updated":"2026-10-01T17:04:18.967Z","title":"Apache Traffic Server: prefetch plugin can crash on attacker-influenced input","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00662,"kevAdded":null},{"id":"CVE-2026-58182","published":"2026-07-29T08:54:49.308Z","updated":"2026-10-01T17:04:03.769Z","title":"Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00731,"kevAdded":null},{"id":"CVE-2026-58181","published":"2026-07-29T08:46:04.829Z","updated":"2026-10-01T17:03:04.933Z","title":"Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58180","published":"2026-07-29T08:45:15.088Z","updated":"2026-10-01T17:02:43.101Z","title":"Apache Traffic Server: txn_box plugin overflows the stack from attacker input","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58179","published":"2026-07-29T08:44:33.338Z","updated":"2026-10-01T17:02:28.868Z","title":"Apache Traffic Server: regex_remap plugin overflows the stack from attacker input","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-58178","published":"2026-07-29T08:43:25.421Z","updated":"2026-10-01T17:02:13.390Z","title":"Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58177","published":"2026-07-29T08:42:41.254Z","updated":"2026-07-29T13:33:06.611Z","title":"Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2026-58175","published":"2026-07-29T08:41:50.764Z","updated":"2026-10-01T17:01:58.008Z","title":"Apache Traffic Server: HostDB SRV handling leaks memory","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58164","published":"2026-07-29T08:37:42.478Z","updated":"2026-10-01T17:01:41.984Z","title":"Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58163","published":"2026-07-29T08:36:57.160Z","updated":"2026-10-01T17:01:15.049Z","title":"Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00699,"kevAdded":null},{"id":"CVE-2026-58162","published":"2026-07-29T08:36:17.272Z","updated":"2026-10-01T17:01:01.772Z","title":"Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-58161","published":"2026-07-29T08:35:39.379Z","updated":"2026-10-01T17:00:46.631Z","title":"Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-59243","published":"2026-07-29T08:35:37.644Z","updated":"2026-09-16T14:56:00.259Z","title":"Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00643,"kevAdded":null},{"id":"CVE-2026-58160","published":"2026-07-29T08:34:34.990Z","updated":"2026-10-01T17:00:30.097Z","title":"Apache Traffic Server: Out-of-bounds reads while parsing DNS responses","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2026-58159","published":"2026-07-29T08:32:04.660Z","updated":"2026-10-01T17:00:09.731Z","title":"Apache Traffic Server: Listener and ACL handling allow access-control bypass","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00563,"kevAdded":null},{"id":"CVE-2026-58158","published":"2026-07-29T08:26:32.138Z","updated":"2026-10-01T16:59:46.758Z","title":"Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2026-58157","published":"2026-07-29T08:25:52.434Z","updated":"2026-10-01T16:59:27.244Z","title":"Apache Traffic Server: Improper server-session reuse can expose data across client connections","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-58156","published":"2026-07-29T08:25:12.013Z","updated":"2026-10-01T16:59:12.869Z","title":"Apache Traffic Server: URL and port parsing errors allow access-control bypass","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-58155","published":"2026-07-29T08:24:37.320Z","updated":"2026-10-01T16:58:57.741Z","title":"Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-58154","published":"2026-07-29T08:24:02.078Z","updated":"2026-10-01T16:58:40.837Z","title":"Apache Traffic Server: Memory-safety errors in MIME and header parsing","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-65325","published":"2026-07-29T08:23:28.374Z","updated":"2026-07-29T12:19:26.906Z","title":"Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2026-65324","published":"2026-07-29T08:17:46.795Z","updated":"2026-10-01T17:06:50.222Z","title":"Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58153","published":"2026-07-29T08:17:11.785Z","updated":"2026-07-29T13:29:30.157Z","title":"Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2026-58152","published":"2026-07-29T08:16:21.178Z","updated":"2026-10-01T16:58:26.432Z","title":"Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2026-58151","published":"2026-07-29T08:15:45.681Z","updated":"2026-10-01T16:58:11.365Z","title":"Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-58150","published":"2026-07-29T07:30:25.800Z","updated":"2026-10-01T16:57:53.079Z","title":"Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00568,"kevAdded":null},{"id":"CVE-2026-57834","published":"2026-07-29T07:25:49.384Z","updated":"2026-10-01T16:57:47.828Z","title":"Apache Traffic Server: Malformed chunked message body allows request smuggling","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-33930","published":"2026-07-29T07:23:54.658Z","updated":"2026-10-01T16:57:26.531Z","title":"Apache Traffic Server: Buffer overflow via Host field that has a long string value","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2026-24033","published":"2026-07-29T07:22:42.043Z","updated":"2026-07-29T13:12:49.617Z","title":"Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00572,"kevAdded":null},{"id":"CVE-2026-33267","published":"2026-07-29T07:21:52.256Z","updated":"2026-07-30T03:55:17.126Z","title":"Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2026-22068","published":"2026-07-29T07:19:04.701Z","updated":"2026-07-29T13:14:03.128Z","title":"Apache Traffic Server: Regex mappings match with malicious domain names","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2026-41920","published":"2026-07-29T07:18:01.534Z","updated":"2026-07-29T13:14:49.109Z","title":"Apache Traffic Server: SNI to Host header matching policy is not properly enforced","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2026-66299","published":"2026-07-28T14:29:05.810Z","updated":"2026-07-28T17:40:03.853Z","title":"Apache Tomcat: DoS via WebSocket chat example","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-66713","published":"2026-07-28T13:44:29.702Z","updated":"2026-07-29T03:55:41.433Z","title":"Apache Axis2/Java: deserialization of untrusted Data","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Axis2/Java","kev":false,"epss":0.01718,"kevAdded":null},{"id":"CVE-2026-59878","published":"2026-07-28T13:33:54.909Z","updated":"2026-07-28T14:05:06.447Z","title":"Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ AMQP","kev":false,"epss":0.00785,"kevAdded":null},{"id":"CVE-2026-61487","published":"2026-07-28T13:32:40.768Z","updated":"2026-07-28T14:07:13.139Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-66391","published":"2026-07-27T16:45:17.483Z","updated":"2026-07-28T14:49:47.331Z","title":"Apache Wicket: leaked and missing CSP headers","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00637,"kevAdded":null},{"id":"CVE-2026-66390","published":"2026-07-27T16:39:11.789Z","updated":"2026-07-28T14:49:16.289Z","title":"Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-66053","published":"2026-07-27T11:18:49.830Z","updated":"2026-07-27T13:08:21.318Z","title":"Apache Thrift: Python TSSLSocket Hostname Matcher Import","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-58662","published":"2026-07-27T11:17:26.018Z","updated":"2026-07-27T13:07:59.960Z","title":"Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.01078,"kevAdded":null},{"id":"CVE-2026-58389","published":"2026-07-27T11:14:30.062Z","updated":"2026-07-27T13:07:38.103Z","title":"Apache Thrift: Rust binary protocol non-strict path missing string size limit","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-58023","published":"2026-07-27T11:12:40.875Z","updated":"2026-07-27T13:07:33.262Z","title":"Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.01017,"kevAdded":null},{"id":"CVE-2026-55971","published":"2026-07-27T11:11:23.201Z","updated":"2026-07-28T03:55:51.567Z","title":"Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()","severity":"CRITICAL","score":9.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00979,"kevAdded":null},{"id":"CVE-2026-55970","published":"2026-07-27T11:09:41.544Z","updated":"2026-07-27T13:07:21.939Z","title":"Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00775,"kevAdded":null},{"id":"CVE-2026-55969","published":"2026-07-27T11:07:53.785Z","updated":"2026-07-27T13:05:35.872Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-55968","published":"2026-07-27T11:06:17.910Z","updated":"2026-07-27T13:05:00.181Z","title":"Apache Thrift: Node.js quadratic-time DoS in server receive transports","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-49158","published":"2026-07-27T11:05:07.157Z","updated":"2026-07-27T13:04:21.271Z","title":"Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-48586","published":"2026-07-27T11:02:54.430Z","updated":"2026-07-27T13:03:46.048Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-48145","published":"2026-07-27T10:59:46.107Z","updated":"2026-07-27T13:03:08.355Z","title":"Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00417,"kevAdded":null},{"id":"CVE-2026-48144","published":"2026-07-27T10:58:31.112Z","updated":"2026-07-28T03:55:50.038Z","title":"Apache Thrift: c_glib TLS Client Missing Hostname Verification","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-45112","published":"2026-07-27T10:57:34.326Z","updated":"2026-07-27T13:02:07.682Z","title":"Apache Thrift: Unbounded Read Leading to Denial of Service","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-43871","published":"2026-07-27T10:56:15.279Z","updated":"2026-07-27T13:01:39.993Z","title":"Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-41608","published":"2026-07-27T10:53:43.865Z","updated":"2026-07-28T14:54:47.811Z","title":"Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-49326","published":"2026-07-24T14:56:22.664Z","updated":"2026-07-24T17:57:56.951Z","title":"Apache HBase: Missing scanner instance owner check in thrift delegation service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache HBase","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2026-46452","published":"2026-07-24T12:11:42.453Z","updated":"2026-07-24T18:04:46.229Z","title":"Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00908,"kevAdded":null},{"id":"CVE-2026-45816","published":"2026-07-24T12:11:09.434Z","updated":"2026-07-24T18:22:34.523Z","title":"Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-45815","published":"2026-07-24T12:10:38.456Z","updated":"2026-07-24T18:20:48.428Z","title":"Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2026-45813","published":"2026-07-24T12:10:12.070Z","updated":"2026-07-24T18:18:46.883Z","title":"Apache NimBLE: Incorrect data validation in BASS add/modify source operation","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-45812","published":"2026-07-24T12:09:38.958Z","updated":"2026-07-24T18:16:48.556Z","title":"Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2026-45811","published":"2026-07-24T12:09:10.299Z","updated":"2026-07-24T18:14:45.702Z","title":"Apache NimBLE: Buffer overflow in socket HCI transport","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-66144","published":"2026-07-24T12:08:27.992Z","updated":"2026-07-24T18:42:19.733Z","title":"Apache Neethi: Remote PolicyReference fetch lacks resource bounds","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-66143","published":"2026-07-24T12:07:52.657Z","updated":"2026-07-24T18:40:12.434Z","title":"Apache Neethi: Missing global alternative-output budget across policy computation paths","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.00854,"kevAdded":null},{"id":"CVE-2026-66142","published":"2026-07-24T12:07:26.323Z","updated":"2026-07-24T18:38:17.880Z","title":"Apache Neethi: Uncontrolled recursion in policy processing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-63317","published":"2026-07-24T08:07:57.463Z","updated":"2026-07-24T18:04:05.691Z","title":"Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML","severity":"MEDIUM","score":5.6,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.00852,"kevAdded":null},{"id":"CVE-2026-60080","published":"2026-07-21T10:54:19.298Z","updated":"2026-07-22T16:12:10.640Z","title":"Apache Fory: Rust MetaString heap use-after-free","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-64606","published":"2026-07-21T10:43:51.436Z","updated":"2026-07-21T18:28:15.293Z","title":"Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00782,"kevAdded":null},{"id":"CVE-2026-64609","published":"2026-07-21T09:34:57.010Z","updated":"2026-07-21T18:28:17.440Z","title":"Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00777,"kevAdded":null},{"id":"CVE-2026-64608","published":"2026-07-21T09:34:12.817Z","updated":"2026-07-21T18:28:16.365Z","title":"Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00806,"kevAdded":null},{"id":"CVE-2026-56623","published":"2026-07-20T20:29:08.249Z","updated":"2026-07-21T17:15:28.287Z","title":"Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00871,"kevAdded":null},{"id":"CVE-2026-56624","published":"2026-07-20T20:28:26.333Z","updated":"2026-07-23T03:56:23.660Z","title":"Apache MINA SSHD: SSH certificate options lack validations","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.0029,"kevAdded":null},{"id":"CVE-2026-58624","published":"2026-07-20T20:27:39.070Z","updated":"2026-07-21T17:15:42.543Z","title":"Apache MINA SSHD: Remote execution of JGit commands can write files on the server","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-56452","published":"2026-07-20T20:26:28.301Z","updated":"2026-07-21T17:15:49.562Z","title":"Apache MINA SSHD: Path traversal in SCP file reception","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2026-62418","published":"2026-07-20T14:27:04.679Z","updated":"2026-07-21T14:57:00.487Z","title":"Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2026-62183","published":"2026-07-20T14:23:20.294Z","updated":"2026-07-21T14:57:08.107Z","title":"Apache Syncope: User self-service privilege escalation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2026-57308","published":"2026-07-20T14:21:57.415Z","updated":"2026-07-21T14:57:14.949Z","title":"Apache Syncope: SQL injection vulnerability in Audit Events search","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00832,"kevAdded":null},{"id":"CVE-2026-53421","published":"2026-07-20T14:21:10.071Z","updated":"2026-07-21T14:57:20.891Z","title":"Apache Syncope: Remote Code Execution via Scripted Connector","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.01137,"kevAdded":null},{"id":"CVE-2026-53405","published":"2026-07-20T14:20:06.824Z","updated":"2026-07-21T14:57:26.644Z","title":"Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00746,"kevAdded":null},{"id":"CVE-2026-63071","published":"2026-07-20T14:19:19.065Z","updated":"2026-07-21T14:57:32.285Z","title":"Apache Syncope: RCE via Groovy Sandbox bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2026-59173","published":"2026-07-18T12:52:18.923Z","updated":"2026-07-20T13:41:03.319Z","title":"Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-62764","published":"2026-07-17T08:35:57.234Z","updated":"2026-07-17T10:07:38.455Z","title":"Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions","severity":"MEDIUM","score":5.7,"vendor":"Apache Software Foundation","product":"Apache Accumulo","kev":false,"epss":0.00789,"kevAdded":null},{"id":"CVE-2026-26032","published":"2026-07-15T18:49:43.153Z","updated":"2026-07-15T19:31:07.994Z","title":"Apache Ivy: PackagerResolver path traversal vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Ivy","kev":false,"epss":0.00507,"kevAdded":null},{"id":"CVE-2026-57821","published":"2026-07-15T09:20:09.239Z","updated":"2026-07-15T12:26:10.244Z","title":"Apache Fineract: Office list: SQL Injection via Subquery in orderBy","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00743,"kevAdded":null},{"id":"CVE-2026-35152","published":"2026-07-15T09:19:54.983Z","updated":"2026-08-06T11:21:12.960Z","title":"Apache Fineract: SQL injection in runreports endpoint","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.03281,"kevAdded":null},{"id":"CVE-2026-56287","published":"2026-07-15T09:19:38.262Z","updated":"2026-07-15T14:32:08.722Z","title":"Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00654,"kevAdded":null},{"id":"CVE-2026-49488","published":"2026-07-14T12:21:05.929Z","updated":"2026-07-15T15:13:20.235Z","title":"Apache OpenMeetings: Arbitrary File Read","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.00703,"kevAdded":null},{"id":"CVE-2026-62393","published":"2026-07-14T12:19:27.705Z","updated":"2026-07-15T15:13:25.772Z","title":"Apache Kylin: Improper authorization in job information retrieval","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-62392","published":"2026-07-14T12:18:57.308Z","updated":"2026-07-15T04:00:58.707Z","title":"Apache Kylin: OS Command Injection via Async Query API","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.02481,"kevAdded":null},{"id":"CVE-2026-62390","published":"2026-07-14T12:09:40.980Z","updated":"2026-07-14T16:12:57.844Z","title":"Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2026-58319","published":"2026-07-14T09:36:41.043Z","updated":"2026-07-14T16:03:35.174Z","title":"Apache Doris: Improper Authentication in Frontend HTTP API","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00747,"kevAdded":null},{"id":"CVE-2026-59084","published":"2026-07-14T08:24:21.531Z","updated":"2026-07-14T13:51:52.489Z","title":"Apache Tomcat: EncryptInterceptor requirements not clearly documented","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00506,"kevAdded":null},{"id":"CVE-2026-59083","published":"2026-07-14T08:13:04.861Z","updated":"2026-07-14T12:19:54.438Z","title":"Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2026-59245","published":"2026-07-13T15:05:21.156Z","updated":"2026-09-16T14:55:46.629Z","title":"Apache Airflow FAB provider: FAB auth manager: a DAG named \"DAGs\" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00599,"kevAdded":null},{"id":"CVE-2026-58065","published":"2026-07-13T15:00:49.159Z","updated":"2026-09-16T15:06:43.587Z","title":"Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow Git provider","kev":false,"epss":0.00736,"kevAdded":null},{"id":"CVE-2026-41041","published":"2026-07-13T09:08:51.055Z","updated":"2026-07-13T17:04:02.546Z","title":"Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Gravitino","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2026-49876","published":"2026-07-13T08:45:35.082Z","updated":"2026-07-13T14:27:15.256Z","title":"Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Gravitino","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2026-49844","published":"2026-07-10T21:14:59.111Z","updated":"2026-09-17T18:37:58.088Z","title":"Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4j API","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-40454","published":"2026-07-10T07:19:01.868Z","updated":"2026-07-10T14:55:00.635Z","title":"Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB C++ client","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-40452","published":"2026-07-10T07:16:05.992Z","updated":"2026-07-10T17:55:35.036Z","title":"Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-40009","published":"2026-07-10T07:15:07.119Z","updated":"2026-07-10T17:56:44.976Z","title":"Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00354,"kevAdded":null},{"id":"CVE-2026-40008","published":"2026-07-10T07:13:27.770Z","updated":"2026-07-10T14:54:56.744Z","title":"Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00597,"kevAdded":null},{"id":"CVE-2026-40007","published":"2026-07-10T07:12:29.926Z","updated":"2026-07-10T14:54:55.434Z","title":"Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00488,"kevAdded":null},{"id":"CVE-2026-40006","published":"2026-07-10T07:10:54.826Z","updated":"2026-07-10T14:59:16.628Z","title":"Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00584,"kevAdded":null},{"id":"CVE-2026-40005","published":"2026-07-10T07:09:49.770Z","updated":"2026-07-10T15:02:01.778Z","title":"Apache IoTDB: Path Traversal in Pipe File Transfer Receiver","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-28564","published":"2026-07-10T07:08:12.481Z","updated":"2026-07-10T15:02:54.356Z","title":"Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-57111","published":"2026-07-09T07:09:05.827Z","updated":"2026-07-09T13:38:56.274Z","title":"Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Helix REST","kev":false,"epss":0.00347,"kevAdded":null},{"id":"CVE-2026-41042","published":"2026-07-08T11:38:55.311Z","updated":"2026-07-08T17:31:28.887Z","title":"Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Gravitino","kev":false,"epss":0.01512,"kevAdded":null},{"id":"CVE-2026-33264","published":"2026-07-07T09:20:18.518Z","updated":"2026-11-03T06:53:53.359Z","title":"Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01649,"kevAdded":null},{"id":"CVE-2026-49487","published":"2026-07-07T09:19:36.710Z","updated":"2026-11-03T06:58:32.490Z","title":"Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-48828","published":"2026-07-07T09:18:53.833Z","updated":"2026-11-03T06:57:29.376Z","title":"Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-49296","published":"2026-07-07T09:18:12.369Z","updated":"2026-11-03T06:57:54.406Z","title":"Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-48891","published":"2026-07-07T09:17:28.748Z","updated":"2026-11-03T06:57:35.748Z","title":"Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00636,"kevAdded":null},{"id":"CVE-2026-48892","published":"2026-07-07T09:16:26.466Z","updated":"2026-11-03T06:57:41.989Z","title":"Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2026-43825","published":"2026-07-06T15:42:04.928Z","updated":"2026-07-06T20:38:00.073Z","title":"Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OpenNLP :: Core :: ML :: LibSVM","kev":false,"epss":0.13921,"kevAdded":null},{"id":"CVE-2026-49297","published":"2026-07-06T09:54:07.148Z","updated":"2026-07-06T19:26:04.051Z","title":"Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow Google provider","kev":false,"epss":0.00994,"kevAdded":null},{"id":"CVE-2026-46588","published":"2026-07-06T09:36:25.163Z","updated":"2026-07-06T21:31:57.875Z","title":"Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2026-46587","published":"2026-07-06T09:35:31.928Z","updated":"2026-07-06T21:31:56.383Z","title":"Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2026-49042","published":"2026-07-06T09:34:48.956Z","updated":"2026-07-06T21:31:59.344Z","title":"Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2026-24013","published":"2026-07-06T08:38:54.778Z","updated":"2026-07-06T20:37:57.934Z","title":"Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-24012","published":"2026-07-06T08:38:25.308Z","updated":"2026-07-06T20:37:56.860Z","title":"Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-43866","published":"2026-07-06T08:35:04.935Z","updated":"2026-07-06T19:10:00.576Z","title":"Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00654,"kevAdded":null},{"id":"CVE-2026-24014","published":"2026-07-06T08:34:26.447Z","updated":"2026-07-06T20:37:58.998Z","title":"Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2026-43867","published":"2026-07-06T08:24:10.108Z","updated":"2026-07-06T19:27:29.706Z","title":"Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00926,"kevAdded":null},{"id":"CVE-2026-56140","published":"2026-07-06T08:16:00.599Z","updated":"2026-07-06T19:31:06.707Z","title":"Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel AWS2 SNS","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2026-56139","published":"2026-07-06T08:15:08.493Z","updated":"2026-07-06T20:55:43.126Z","title":"Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel Undertow","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-55994","published":"2026-07-06T08:13:59.420Z","updated":"2026-07-06T21:13:45.038Z","title":"Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel Iggy","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2026-55993","published":"2026-07-06T08:13:24.909Z","updated":"2026-07-07T12:39:32.830Z","title":"Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel Atmosphere Websocket","kev":false,"epss":0.00857,"kevAdded":null},{"id":"CVE-2026-53913","published":"2026-07-06T08:12:32.594Z","updated":"2026-07-07T12:36:54.235Z","title":"Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel Keycloak","kev":false,"epss":0.01085,"kevAdded":null},{"id":"CVE-2026-49365","published":"2026-07-06T08:11:49.232Z","updated":"2026-07-07T12:34:51.854Z","title":"Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-49099","published":"2026-07-06T08:11:30.540Z","updated":"2026-07-07T12:30:34.187Z","title":"Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel Salesforce","kev":false,"epss":0.0052,"kevAdded":null},{"id":"CVE-2026-49098","published":"2026-07-06T08:10:43.227Z","updated":"2026-07-07T12:27:08.483Z","title":"Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topic","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2026-49097","published":"2026-07-06T08:10:26.965Z","updated":"2026-07-06T19:02:56.155Z","title":"Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or users","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00675,"kevAdded":null},{"id":"CVE-2026-49086","published":"2026-07-06T08:10:06.768Z","updated":"2026-07-06T19:04:56.921Z","title":"Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to influence internal behaviour","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel Dapr","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2026-48206","published":"2026-07-06T08:09:09.027Z","updated":"2026-07-06T19:06:19.319Z","title":"Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue operations using the endpoint's configured credentials","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel JIRA","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-48205","published":"2026-07-06T08:08:19.869Z","updated":"2026-07-06T19:07:20.497Z","title":"Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Camel DNS","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-48204","published":"2026-07-06T08:06:52.913Z","updated":"2026-07-06T19:08:16.754Z","title":"Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-48203","published":"2026-07-06T08:06:22.592Z","updated":"2026-07-06T19:17:53.635Z","title":"Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-46726","published":"2026-07-06T08:05:40.270Z","updated":"2026-07-06T19:19:03.677Z","title":"Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel Vertx Websocket","kev":false,"epss":0.00857,"kevAdded":null},{"id":"CVE-2026-46592","published":"2026-07-06T08:04:32.968Z","updated":"2026-07-06T19:20:07.548Z","title":"Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2026-46591","published":"2026-07-06T08:04:17.286Z","updated":"2026-07-06T19:21:17.467Z","title":"Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2026-46590","published":"2026-07-06T08:03:54.979Z","updated":"2026-07-06T19:16:21.233Z","title":"Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00839,"kevAdded":null},{"id":"CVE-2026-46585","published":"2026-07-06T08:03:16.498Z","updated":"2026-07-06T19:24:45.975Z","title":"Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel Lucene","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-46584","published":"2026-07-06T08:02:37.913Z","updated":"2026-07-06T19:26:03.975Z","title":"Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Camel Mail","kev":false,"epss":0.00562,"kevAdded":null},{"id":"CVE-2026-46457","published":"2026-07-06T07:57:13.104Z","updated":"2026-07-06T19:27:26.948Z","title":"Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00659,"kevAdded":null},{"id":"CVE-2026-46456","published":"2026-07-06T07:56:51.598Z","updated":"2026-07-06T19:28:37.870Z","title":"Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00791,"kevAdded":null},{"id":"CVE-2026-46455","published":"2026-07-06T07:56:29.905Z","updated":"2026-07-06T19:29:29.570Z","title":"Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2026-46454","published":"2026-07-06T07:56:14.036Z","updated":"2026-07-06T17:41:19.974Z","title":"Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00827,"kevAdded":null},{"id":"CVE-2026-46453","published":"2026-07-06T07:55:56.230Z","updated":"2026-07-06T18:44:44.793Z","title":"Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-43865","published":"2026-07-06T07:55:26.650Z","updated":"2026-07-06T18:46:19.640Z","title":"Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00984,"kevAdded":null},{"id":"CVE-2026-42527","published":"2026-07-06T07:55:06.159Z","updated":"2026-07-06T18:47:30.650Z","title":"Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00668,"kevAdded":null},{"id":"CVE-2026-40859","published":"2026-07-06T07:54:29.981Z","updated":"2026-07-06T18:48:16.623Z","title":"Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00886,"kevAdded":null},{"id":"CVE-2026-40047","published":"2026-07-06T07:46:57.694Z","updated":"2026-07-06T18:49:25.326Z","title":"Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.02429,"kevAdded":null},{"id":"CVE-2026-47896","published":"2026-07-03T07:48:35.289Z","updated":"2026-07-06T17:30:50.057Z","title":"Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server","severity":"HIGH","score":8.9,"vendor":"Apache Software Foundation","product":"Apache Lucene.Net","kev":false,"epss":0.00808,"kevAdded":null},{"id":"CVE-2026-47897","published":"2026-07-03T07:48:11.367Z","updated":"2026-07-06T17:31:22.410Z","title":"Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client","severity":"HIGH","score":8.9,"vendor":"Apache Software Foundation","product":"Apache Lucene.Net","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2026-47898","published":"2026-07-03T07:47:38.904Z","updated":"2026-07-06T17:32:25.185Z","title":"Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser","severity":"MEDIUM","score":4,"vendor":"Apache Software Foundation","product":"Apache Lucene.Net","kev":false,"epss":0.00468,"kevAdded":null},{"id":"CVE-2026-54428","published":"2026-07-01T17:03:53.938Z","updated":"2026-07-01T18:15:56.634Z","title":"Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HttpComponents Core","kev":false,"epss":0.00871,"kevAdded":null},{"id":"CVE-2026-54399","published":"2026-07-01T17:02:21.778Z","updated":"2026-07-01T17:36:47.358Z","title":"Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HttpComponents Core","kev":false,"epss":0.00779,"kevAdded":null},{"id":"CVE-2025-53648","published":"2026-06-30T13:36:00.654Z","updated":"2026-06-30T17:35:41.726Z","title":"Apache Gravitino: SQL misconfiguration can access or truncate files","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Gravitino","kev":false,"epss":0.00561,"kevAdded":null},{"id":"CVE-2026-49434","published":"2026-06-30T09:55:29.533Z","updated":"2026-06-30T12:27:49.847Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-49432","published":"2026-06-30T09:54:38.991Z","updated":"2026-06-30T15:55:36.075Z","title":"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.00785,"kevAdded":null},{"id":"CVE-2026-49877","published":"2026-06-30T09:53:42.706Z","updated":"2026-06-30T12:29:12.251Z","title":"Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2026-50734","published":"2026-06-30T09:53:03.435Z","updated":"2026-06-30T12:32:25.918Z","title":"Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Client","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-50750","published":"2026-06-30T09:51:57.035Z","updated":"2026-06-30T13:21:45.456Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.00686,"kevAdded":null},{"id":"CVE-2026-52760","published":"2026-06-30T09:50:30.176Z","updated":"2026-06-30T15:58:39.098Z","title":"Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.00679,"kevAdded":null},{"id":"CVE-2026-53916","published":"2026-06-30T09:49:55.655Z","updated":"2026-06-30T15:58:46.098Z","title":"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-53917","published":"2026-06-30T09:49:17.388Z","updated":"2026-06-30T14:51:31.720Z","title":"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-54475","published":"2026-06-30T09:48:28.852Z","updated":"2026-06-30T14:52:25.352Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.00563,"kevAdded":null},{"id":"CVE-2026-55957","published":"2026-06-29T20:47:12.661Z","updated":"2026-06-30T13:27:37.064Z","title":"Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02855,"kevAdded":null},{"id":"CVE-2026-55956","published":"2026-06-29T20:46:02.927Z","updated":"2026-06-30T13:25:31.049Z","title":"Apache Tomcat: Security constraints for default servlet ignored method","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00695,"kevAdded":null},{"id":"CVE-2026-55955","published":"2026-06-29T20:44:39.779Z","updated":"2026-06-30T13:22:14.917Z","title":"Apache Tomcat: EncryptInterceptor not protected against replay attacks","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-55276","published":"2026-06-29T20:42:23.257Z","updated":"2026-06-30T13:59:37.872Z","title":"Apache Tomcat: Logged effective web.xml is incomplete","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2026-53434","published":"2026-06-29T20:41:06.948Z","updated":"2026-06-30T12:28:36.391Z","title":"Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00586,"kevAdded":null},{"id":"CVE-2026-53404","published":"2026-06-29T20:39:45.317Z","updated":"2026-06-30T12:34:20.821Z","title":"Apache Tomcat: Bad ornext processing in RewriteValve","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00652,"kevAdded":null},{"id":"CVE-2026-50229","published":"2026-06-29T20:36:24.683Z","updated":"2026-06-30T12:50:01.539Z","title":"Apache Tomcat: XSS in number guess example","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.04091,"kevAdded":null},{"id":"CVE-2025-64152","published":"2026-06-26T12:16:28.295Z","updated":"2026-06-26T18:36:29.179Z","title":"Apache IoTDB: Path Traversal Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2025-55017","published":"2026-06-26T12:15:53.226Z","updated":"2026-06-26T18:35:21.837Z","title":"Apache IoTDB: Path Traversal Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-57915","published":"2026-06-26T12:09:54.850Z","updated":"2026-08-03T12:05:45.937Z","title":"Apache Kerby: Kerberos Pre-Authentication Bypass","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Kerby","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-57914","published":"2026-06-26T11:28:26.849Z","updated":"2026-06-26T18:36:16.816Z","title":"Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kerby","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-49486","published":"2026-06-26T07:05:39.182Z","updated":"2026-09-16T14:55:36.170Z","title":"Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow FTP provider","kev":false,"epss":0.00442,"kevAdded":null},{"id":"CVE-2026-56091","published":"2026-06-25T08:45:19.426Z","updated":"2026-06-25T12:10:34.365Z","title":"Apache Shiro: Authentication bypass in Guice-Web integration","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2026-56130","published":"2026-06-25T08:44:30.040Z","updated":"2026-06-25T12:12:43.666Z","title":"Apache Shiro: Remember-me cookie isn't checked for expiry on the server","severity":"LOW","score":2,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-41566","published":"2026-06-25T08:04:25.631Z","updated":"2026-06-25T12:14:55.712Z","title":"Apache Kvrocks: Improper permission for the APPLYBATCH command","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2026-45188","published":"2026-06-25T08:01:49.945Z","updated":"2026-06-25T12:16:45.965Z","title":"Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling","severity":"LOW","score":2.4,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00154,"kevAdded":null},{"id":"CVE-2026-46751","published":"2026-06-25T08:01:00.294Z","updated":"2026-06-25T12:20:03.821Z","title":"Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2026-46752","published":"2026-06-25T08:00:18.363Z","updated":"2026-06-25T12:21:28.528Z","title":"Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2026-54226","published":"2026-06-25T07:59:24.945Z","updated":"2026-06-25T13:41:46.849Z","title":"Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS","severity":"MEDIUM","score":6.4,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00397,"kevAdded":null},{"id":"CVE-2025-62198","published":"2026-06-22T07:47:11.847Z","updated":"2026-06-22T15:50:36.658Z","title":"Apache Atlas: Stored XSS in Create Entity page","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.00505,"kevAdded":null},{"id":"CVE-2026-44914","published":"2026-06-22T07:38:01.356Z","updated":"2026-06-24T03:56:11.221Z","title":"Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0066,"kevAdded":null},{"id":"CVE-2026-44911","published":"2026-06-22T07:37:10.823Z","updated":"2026-06-22T12:28:14.522Z","title":"Apache NiFi: Incorrect Authorization for Configuration Verification Requests","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00516,"kevAdded":null},{"id":"CVE-2026-44913","published":"2026-06-22T07:36:40.885Z","updated":"2026-06-22T12:28:41.736Z","title":"Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL","severity":"MEDIUM","score":5.2,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00646,"kevAdded":null},{"id":"CVE-2026-54665","published":"2026-06-22T07:34:13.850Z","updated":"2026-06-22T16:09:50.834Z","title":"Apache NiFi: Missing Validation for Proxy Host Headers","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-66336","published":"2026-06-22T06:55:17.988Z","updated":"2026-06-22T15:49:55.563Z","title":"Apache Doris MCP Server: SQL injection leading the authentication bypass","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Doris MCP Server","kev":false,"epss":0.00561,"kevAdded":null},{"id":"CVE-2026-49872","published":"2026-06-19T13:19:34.126Z","updated":"2026-06-22T16:30:40.492Z","title":"Apache APISIX: Improper authentication in cas-auth plugin","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-49871","published":"2026-06-19T13:18:36.767Z","updated":"2026-06-22T16:21:31.946Z","title":"Apache APISIX: cas-auth login CSRF / session injection issue","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-47341","published":"2026-06-19T13:17:23.659Z","updated":"2026-06-22T16:21:09.414Z","title":"Apache APISIX: Session replay issue in hmac-auth","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00689,"kevAdded":null},{"id":"CVE-2026-48895","published":"2026-06-19T13:16:29.442Z","updated":"2026-06-22T16:20:39.998Z","title":"Apache APISIX: Cas-auth Host header influence on CAS service URL","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00646,"kevAdded":null},{"id":"CVE-2026-49231","published":"2026-06-19T13:14:52.100Z","updated":"2026-06-22T16:20:09.284Z","title":"Apache APISIX: Identity spoofing issue in APISIX opa plugin","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2026-49230","published":"2026-06-19T13:13:38.841Z","updated":"2026-06-22T16:19:42.049Z","title":"Apache APISIX: Authentication bypass in jwe-decrypt","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00296,"kevAdded":null},{"id":"CVE-2026-44915","published":"2026-06-19T13:12:33.435Z","updated":"2026-06-22T16:16:59.769Z","title":"Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00643,"kevAdded":null},{"id":"CVE-2026-44087","published":"2026-06-19T13:11:17.219Z","updated":"2026-06-22T16:19:00.993Z","title":"Apache APISIX: Openid-connect plugin Identity Header Spoofing","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2026-47339","published":"2026-06-19T13:10:04.769Z","updated":"2026-06-22T16:18:30.495Z","title":"Apache APISIX: authz-casdoor incorrect session sharing","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2026-44046","published":"2026-06-19T13:09:01.406Z","updated":"2026-06-22T16:18:05.136Z","title":"Apache APISIX: wolf-rbac plugin Identity Spoofing","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00475,"kevAdded":null},{"id":"CVE-2026-39999","published":"2026-06-19T13:07:50.893Z","updated":"2026-06-22T16:17:30.194Z","title":"Apache APISIX: JWT Algorithm Confusion allows authentication bypass","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00635,"kevAdded":null},{"id":"CVE-2026-39998","published":"2026-06-19T13:04:39.608Z","updated":"2026-06-22T16:16:29.535Z","title":"Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup","severity":"MEDIUM","score":5.8,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00676,"kevAdded":null},{"id":"CVE-2026-49268","published":"2026-06-17T13:07:44.488Z","updated":"2026-06-17T17:02:22.861Z","title":"Apache Shiro: LDAP DN Injection in DefaultLdapRealm","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2026-47340","published":"2026-06-17T09:00:12.475Z","updated":"2026-06-17T15:37:28.582Z","title":"Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2026-32967","published":"2026-06-17T08:57:55.852Z","updated":"2026-08-21T08:31:39.389Z","title":"Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-42357","published":"2026-06-17T08:56:55.154Z","updated":"2026-06-17T15:35:11.670Z","title":"Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-41280","published":"2026-06-17T08:55:29.988Z","updated":"2026-06-17T11:06:01.798Z","title":"Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-32966","published":"2026-06-17T08:43:11.566Z","updated":"2026-06-17T15:34:06.325Z","title":"Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2026-50203","published":"2026-06-17T01:47:49.652Z","updated":"2026-06-17T14:56:45.456Z","title":"Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow SFTP provider","kev":false,"epss":0.00626,"kevAdded":null},{"id":"CVE-2026-50645","published":"2026-06-12T09:06:54.819Z","updated":"2026-08-07T12:43:56.015Z","title":"Apache CXF: No restriction on attachment headers per message","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00459,"kevAdded":null},{"id":"CVE-2026-50634","published":"2026-06-12T09:05:53.768Z","updated":"2026-08-07T12:43:39.789Z","title":"Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00276,"kevAdded":null},{"id":"CVE-2026-50633","published":"2026-06-12T09:02:02.547Z","updated":"2026-08-07T12:43:35.206Z","title":"Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00888,"kevAdded":null},{"id":"CVE-2026-50632","published":"2026-06-12T09:00:48.530Z","updated":"2026-08-07T12:43:28.785Z","title":"Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00669,"kevAdded":null},{"id":"CVE-2026-50631","published":"2026-06-12T08:59:40.200Z","updated":"2026-08-07T12:43:22.536Z","title":"Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-50630","published":"2026-06-12T08:58:27.181Z","updated":"2026-08-07T12:43:16.673Z","title":"Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-50629","published":"2026-06-12T08:57:22.534Z","updated":"2026-08-07T12:43:09.466Z","title":"Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-50628","published":"2026-06-12T08:56:28.526Z","updated":"2026-08-10T12:05:47.240Z","title":"Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00706,"kevAdded":null},{"id":"CVE-2026-50627","published":"2026-06-12T08:55:41.657Z","updated":"2026-08-10T12:05:49.743Z","title":"Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.04524,"kevAdded":null},{"id":"CVE-2026-49875","published":"2026-06-12T08:54:50.103Z","updated":"2026-08-07T12:42:46.763Z","title":"Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2026-50623","published":"2026-06-12T08:52:05.767Z","updated":"2026-08-07T12:42:50.769Z","title":"Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-47342","published":"2026-06-10T22:29:06.793Z","updated":"2026-06-12T12:44:44.347Z","title":"Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2026-50223","published":"2026-06-10T22:23:49.650Z","updated":"2026-06-12T03:55:27.599Z","title":"Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00657,"kevAdded":null},{"id":"CVE-2026-25700","published":"2026-06-10T14:57:00.853Z","updated":"2026-06-19T05:45:50.544Z","title":"Apache Answer: AdminToken not invalidated after admin deactivation","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00448,"kevAdded":null},{"id":"CVE-2026-49818","published":"2026-06-09T07:42:48.028Z","updated":"2026-06-10T17:37:57.296Z","title":"Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Samba provider","kev":false,"epss":0.00624,"kevAdded":null},{"id":"CVE-2026-34905","published":"2026-06-09T07:35:56.670Z","updated":"2026-06-09T14:55:35.086Z","title":"Apache Answer: Unlisted Questions Accessible via Direct API Access","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00313,"kevAdded":null},{"id":"CVE-2026-34033","published":"2026-06-09T07:35:16.045Z","updated":"2026-06-09T15:43:16.886Z","title":"Apache Answer: HTML Content Injection in Email","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-34031","published":"2026-06-09T07:34:38.977Z","updated":"2026-06-09T15:12:18.151Z","title":"Apache Answer: The custom avatar was not properly validated","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00362,"kevAdded":null},{"id":"CVE-2026-33582","published":"2026-06-09T07:34:02.379Z","updated":"2026-06-09T15:06:16.052Z","title":"Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2026-25699","published":"2026-06-09T07:33:18.349Z","updated":"2026-06-09T14:58:00.387Z","title":"Apache Answer: Authorization Bypass in Timeline API","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-25688","published":"2026-06-09T07:32:23.869Z","updated":"2026-06-09T14:56:41.862Z","title":"Apache Answer: XSS in AI Answer Rendering","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00406,"kevAdded":null},{"id":"CVE-2026-49975","published":"2026-06-08T15:26:04.674Z","updated":"2026-08-19T12:05:08.039Z","title":"Apache HTTP Server: mod_http2 denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.3295,"kevAdded":null},{"id":"CVE-2026-48913","published":"2026-06-08T15:24:52.573Z","updated":"2026-06-08T22:32:34.557Z","title":"Apache HTTP Server: mod_http2 memory corruption when file handles exhausted","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2026-42536","published":"2026-06-08T15:23:46.290Z","updated":"2026-09-14T12:04:32.084Z","title":"Apache HTTP Server: mod_xml2enc heap overflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01024,"kevAdded":null},{"id":"CVE-2026-44185","published":"2026-06-08T15:22:11.809Z","updated":"2026-09-14T12:04:28.422Z","title":"Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00741,"kevAdded":null},{"id":"CVE-2026-34355","published":"2026-06-08T15:20:30.900Z","updated":"2026-09-14T12:04:27.406Z","title":"Apache HTTP Server: mod_proxy_html buffer overflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01161,"kevAdded":null},{"id":"CVE-2026-44631","published":"2026-06-08T15:19:23.570Z","updated":"2026-06-08T22:32:33.325Z","title":"Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-44119","published":"2026-06-08T15:17:31.939Z","updated":"2026-06-09T11:57:10.824Z","title":"Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00177,"kevAdded":null},{"id":"CVE-2026-43951","published":"2026-06-08T15:16:14.594Z","updated":"2026-06-08T22:32:28.584Z","title":"Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00545,"kevAdded":null},{"id":"CVE-2026-42535","published":"2026-06-08T15:14:49.189Z","updated":"2026-06-09T12:13:11.748Z","title":"Apache HTTP Server: mod_dav_fs protected directory access","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2026-34356","published":"2026-06-08T15:12:21.415Z","updated":"2026-06-08T22:32:24.906Z","title":"Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00708,"kevAdded":null},{"id":"CVE-2026-44186","published":"2026-06-08T15:11:12.743Z","updated":"2026-06-09T12:20:10.986Z","title":"Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-29170","published":"2026-06-08T15:10:09.141Z","updated":"2026-06-08T22:32:22.561Z","title":"Apache HTTP Server: mod_proxy_ftp XSS","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00481,"kevAdded":null},{"id":"CVE-2026-29167","published":"2026-06-08T15:07:59.231Z","updated":"2026-06-09T12:31:24.706Z","title":"Apache HTTP Server: mod_ldap per-dir use-after-free","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00688,"kevAdded":null},{"id":"CVE-2026-47430","published":"2026-06-08T10:22:25.138Z","updated":"2026-06-08T12:56:23.693Z","title":"Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews","severity":"CRITICAL","score":9.5,"vendor":"Apache Software Foundation","product":"Cordova Plugin InAppBrowser","kev":false,"epss":0.00723,"kevAdded":null},{"id":"CVE-2026-50076","published":"2026-06-04T16:09:03.212Z","updated":"2026-06-04T17:01:57.229Z","title":"Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.0052,"kevAdded":null},{"id":"CVE-2026-47065","published":"2026-06-03T09:39:41.629Z","updated":"2026-06-04T03:55:48.440Z","title":"Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00504,"kevAdded":null},{"id":"CVE-2026-46718","published":"2026-06-02T09:17:51.193Z","updated":"2026-06-02T14:41:35.506Z","title":"Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Calcite","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-41115","published":"2026-06-02T08:56:43.636Z","updated":"2026-06-02T17:33:07.625Z","title":"Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-49328","published":"2026-06-01T10:10:34.042Z","updated":"2026-06-01T14:13:17.227Z","title":"Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Fesod (Incubating)","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2026-48827","published":"2026-06-01T08:37:41.968Z","updated":"2026-06-01T12:44:56.455Z","title":"Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-44825","published":"2026-06-01T08:02:15.120Z","updated":"2026-06-02T03:55:51.805Z","title":"Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.03922,"kevAdded":null},{"id":"CVE-2026-49361","published":"2026-06-01T07:57:27.038Z","updated":"2026-06-01T16:48:51.369Z","title":"Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Fluss (incubating)","kev":false,"epss":0.00831,"kevAdded":null},{"id":"CVE-2026-40861","published":"2026-06-01T07:55:37.566Z","updated":"2026-11-03T06:54:55.643Z","title":"Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00691,"kevAdded":null},{"id":"CVE-2026-40961","published":"2026-06-01T07:55:04.647Z","updated":"2026-11-03T06:55:01.599Z","title":"Apache Airflow: Open Redirect Bypass Vulnerability","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00649,"kevAdded":null},{"id":"CVE-2026-40963","published":"2026-06-01T07:54:33.704Z","updated":"2026-11-03T06:55:07.626Z","title":"Apache Airflow: DAG authorization bypass on /ui/structure/structure_data","severity":"LOW","score":3.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-41014","published":"2026-06-01T07:53:52.098Z","updated":"2026-11-03T06:55:13.471Z","title":"Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-49267","published":"2026-06-01T07:53:13.259Z","updated":"2026-11-03T06:57:48.147Z","title":"Apache Airflow: No certificate validation on SMTP STARTTLS connections","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00185,"kevAdded":null},{"id":"CVE-2026-41017","published":"2026-06-01T07:52:33.651Z","updated":"2026-11-03T06:55:51.428Z","title":"Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0035,"kevAdded":null},{"id":"CVE-2026-41084","published":"2026-06-01T07:51:56.669Z","updated":"2026-11-03T06:55:57.368Z","title":"Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2026-42252","published":"2026-06-01T07:51:19.018Z","updated":"2026-11-03T06:56:03.321Z","title":"Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00383,"kevAdded":null},{"id":"CVE-2026-42360","published":"2026-06-01T07:50:37.777Z","updated":"2026-11-03T06:56:21.188Z","title":"Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-42358","published":"2026-06-01T07:49:57.728Z","updated":"2026-11-03T06:56:09.282Z","title":"Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-42359","published":"2026-06-01T07:49:17.429Z","updated":"2026-11-03T06:56:15.211Z","title":"Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2026-45360","published":"2026-06-01T07:48:13.287Z","updated":"2026-11-03T06:56:33.203Z","title":"Apache Airflow: Arbitrary import in custom deadline-reference deserialization","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00676,"kevAdded":null},{"id":"CVE-2026-45426","published":"2026-06-01T07:47:16.636Z","updated":"2026-11-03T06:57:11.563Z","title":"Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access","severity":"LOW","score":3.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-46764","published":"2026-06-01T07:45:48.288Z","updated":"2026-11-03T06:57:17.602Z","title":"Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-48726","published":"2026-06-01T07:35:19.270Z","updated":"2026-11-03T06:57:24.307Z","title":"Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-49298","published":"2026-06-01T07:34:32.229Z","updated":"2026-11-03T06:49:48.654Z","title":"Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00489,"kevAdded":null},{"id":"CVE-2026-42253","published":"2026-06-01T07:23:50.962Z","updated":"2026-06-03T09:25:55.984Z","title":"Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.01018,"kevAdded":null},{"id":"CVE-2026-42588","published":"2026-06-01T07:23:17.287Z","updated":"2026-06-02T03:55:44.029Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2026-45505","published":"2026-06-01T07:22:32.247Z","updated":"2026-06-02T03:55:45.446Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.006,"kevAdded":null},{"id":"CVE-2026-46605","published":"2026-06-01T07:21:13.148Z","updated":"2026-06-01T14:44:50.457Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-49157","published":"2026-06-01T07:20:10.862Z","updated":"2026-06-01T14:42:33.386Z","title":"Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2026-49270","published":"2026-06-01T07:19:34.391Z","updated":"2026-06-01T13:11:12.455Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-35563","published":"2026-06-01T07:12:05.815Z","updated":"2026-06-01T13:09:55.143Z","title":"Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Directory LDAP API","kev":false,"epss":0.00182,"kevAdded":null},{"id":"CVE-2026-45192","published":"2026-06-01T06:51:41.026Z","updated":"2026-11-03T06:56:27.147Z","title":"Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-40914","published":"2026-05-28T12:28:25.972Z","updated":"2026-05-29T18:55:50.602Z","title":"Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Artemis Stomp Protocol","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2025-48977","published":"2026-05-28T08:58:06.822Z","updated":"2026-05-28T12:59:14.937Z","title":"Apache Ignite: REST HTTP arbitrary file read vulnerability","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache Ignite","kev":false,"epss":0.00527,"kevAdded":null},{"id":"CVE-2026-40564","published":"2026-05-26T14:38:21.937Z","updated":"2026-06-02T14:12:08.938Z","title":"Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Flink Kubernetes Operator","kev":false,"epss":0.00666,"kevAdded":null},{"id":"CVE-2026-48589","published":"2026-05-25T20:20:03.597Z","updated":"2026-05-26T12:37:44.475Z","title":"Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow","severity":"NONE","score":0,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-44598","published":"2026-05-25T20:19:44.317Z","updated":"2026-05-26T12:38:12.217Z","title":"Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Shiro Jakarta EE module","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-43828","published":"2026-05-25T20:19:26.227Z","updated":"2026-05-26T12:38:38.399Z","title":"Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2026-43827","published":"2026-05-25T20:19:03.428Z","updated":"2026-05-26T12:39:39.186Z","title":"Apache Shiro: Session fixation: new session is not created after login by default","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-42797","published":"2026-05-25T15:00:55.670Z","updated":"2026-05-26T20:06:31.884Z","title":"Apache Syncope: JexlContextBuilder Information Disclosure","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2026-42782","published":"2026-05-25T14:58:59.152Z","updated":"2026-05-27T20:31:30.996Z","title":"Apache Syncope: Post-auth RCE via Groovy static","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2026-46745","published":"2026-05-25T10:41:16.676Z","updated":"2026-05-26T20:08:17.281Z","title":"Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow FAB provider","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2026-45361","published":"2026-05-25T09:34:01.126Z","updated":"2026-06-01T15:48:53.991Z","title":"Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow Google provider","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2026-45249","published":"2026-05-25T07:38:07.398Z","updated":"2026-05-26T16:17:41.575Z","title":"Apache ECharts: XSS in Lines series tooltip rendering","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache ECharts","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2026-44417","published":"2026-05-22T12:17:25.102Z","updated":"2026-07-15T00:54:13.279Z","title":"Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00663,"kevAdded":null},{"id":"CVE-2026-44618","published":"2026-05-22T12:17:14.591Z","updated":"2026-05-22T21:26:21.841Z","title":"Apache CXF: XXE vulnerability in WS-Transfer functionality","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00314,"kevAdded":null},{"id":"CVE-2026-44930","published":"2026-05-22T12:16:47.230Z","updated":"2026-07-20T12:04:41.035Z","title":"Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00719,"kevAdded":null},{"id":"CVE-2026-48207","published":"2026-05-21T15:51:12.292Z","updated":"2026-05-21T18:37:32.208Z","title":"Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-45760","published":"2026-05-21T11:43:44.844Z","updated":"2026-05-23T02:17:48.106Z","title":"Apache Camel K: Camel K Cross-Namespace Build Deputy Attack","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Camel K","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-27173","published":"2026-05-19T19:19:00.266Z","updated":"2026-05-19T19:57:11.716Z","title":"Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Airflow CNCF Kubernetes provider","kev":false,"epss":0.00156,"kevAdded":null},{"id":"CVE-2026-42526","published":"2026-05-19T19:17:51.565Z","updated":"2026-05-19T19:53:24.129Z","title":"Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow Amazon provider","kev":false,"epss":0.00413,"kevAdded":null},{"id":"CVE-2026-47323","published":"2026-05-19T12:25:49.373Z","updated":"2026-07-15T00:49:00.306Z","title":"Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.19563,"kevAdded":null},{"id":"CVE-2026-46586","published":"2026-05-19T09:41:39.546Z","updated":"2026-05-20T15:33:41.602Z","title":"Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00717,"kevAdded":null},{"id":"CVE-2026-45434","published":"2026-05-19T09:40:26.892Z","updated":"2026-11-03T22:13:24.966Z","title":"Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.21264,"kevAdded":null},{"id":"CVE-2026-45187","published":"2026-05-19T09:39:27.294Z","updated":"2026-05-19T18:37:23.236Z","title":"Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00513,"kevAdded":null},{"id":"CVE-2026-41919","published":"2026-05-19T09:36:55.524Z","updated":"2026-05-19T18:37:22.296Z","title":"Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-35086","published":"2026-05-19T09:36:00.229Z","updated":"2026-11-03T22:13:23.677Z","title":"Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2026-31986","published":"2026-05-19T09:34:38.426Z","updated":"2026-05-19T18:37:20.230Z","title":"Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-31910","published":"2026-05-19T09:33:38.681Z","updated":"2026-05-19T18:37:19.274Z","title":"Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-31909","published":"2026-05-19T09:32:47.268Z","updated":"2026-05-19T18:37:18.308Z","title":"Apache OFBiz: Unauthenticated Shipment Label Image Disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-31906","published":"2026-05-19T09:30:19.719Z","updated":"2026-05-19T18:37:17.349Z","title":"Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2026-31388","published":"2026-05-19T09:28:29.273Z","updated":"2026-05-19T18:37:16.419Z","title":"Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00416,"kevAdded":null},{"id":"CVE-2026-31387","published":"2026-05-19T09:27:05.898Z","updated":"2026-05-19T18:37:15.451Z","title":"Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2026-31380","published":"2026-05-19T09:24:39.139Z","updated":"2026-05-19T18:37:14.491Z","title":"Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00487,"kevAdded":null},{"id":"CVE-2026-31379","published":"2026-05-19T09:22:49.222Z","updated":"2026-05-19T18:37:13.441Z","title":"Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00588,"kevAdded":null},{"id":"CVE-2026-31378","published":"2026-05-19T09:21:18.503Z","updated":"2026-05-19T18:37:12.423Z","title":"Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00574,"kevAdded":null},{"id":"CVE-2026-29226","published":"2026-05-19T09:19:30.626Z","updated":"2026-05-19T18:37:11.474Z","title":"Apache OFBiz: Low-Privilege SSRF in Content Component","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00473,"kevAdded":null},{"id":"CVE-2026-29207","published":"2026-05-19T09:18:18.681Z","updated":"2026-05-19T18:37:09.452Z","title":"Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00541,"kevAdded":null},{"id":"CVE-2026-29220","published":"2026-05-19T09:16:59.872Z","updated":"2026-05-19T18:37:10.485Z","title":"Apache OFBiz: Low-Privilege LFI in Content Component","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00684,"kevAdded":null},{"id":"CVE-2026-35194","published":"2026-05-15T15:27:27.346Z","updated":"2026-05-15T21:23:25.726Z","title":"Apache Flink: Remote code execution via SQL injection in code generation","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Flink","kev":false,"epss":0.00381,"kevAdded":null},{"id":"CVE-2026-45205","published":"2026-05-14T11:22:43.908Z","updated":"2026-05-14T20:31:47.159Z","title":"Apache Commons Configuration: StackOverflowError for YAML input with cycles","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Commons Configuration","kev":false,"epss":0.00469,"kevAdded":null},{"id":"CVE-2026-43515","published":"2026-05-12T15:33:23.311Z","updated":"2026-06-04T09:57:54.826Z","title":"Apache Tomcat: Security constraints not correctly applied","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2026-43514","published":"2026-05-12T15:32:09.858Z","updated":"2026-05-13T17:22:42.246Z","title":"Apache Tomcat: AJP secret compared in non-constant time","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-43513","published":"2026-05-12T15:26:25.599Z","updated":"2026-05-14T19:53:30.781Z","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00503,"kevAdded":null},{"id":"CVE-2026-43512","published":"2026-05-12T15:24:02.424Z","updated":"2026-05-14T19:53:34.555Z","title":"Apache Tomcat: Digest authenticator will authenticate any unknown user","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01326,"kevAdded":null},{"id":"CVE-2026-41293","published":"2026-05-12T15:19:35.179Z","updated":"2026-09-17T18:37:24.561Z","title":"Apache Tomcat: HTTP/2 request headers not validated","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01705,"kevAdded":null},{"id":"CVE-2026-42498","published":"2026-05-12T15:17:56.531Z","updated":"2026-05-13T15:59:04.361Z","title":"Apache Tomcat: WebSocket authentication header exposure","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00646,"kevAdded":null},{"id":"CVE-2026-41284","published":"2026-05-12T15:14:45.278Z","updated":"2026-05-13T15:57:45.607Z","title":"Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00839,"kevAdded":null},{"id":"CVE-2026-41018","published":"2026-05-11T08:21:47.722Z","updated":"2026-05-11T12:59:39.211Z","title":"Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers Elasticsearch","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-43826","published":"2026-05-11T08:21:08.702Z","updated":"2026-05-11T13:02:08.325Z","title":"Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers OpenSearch","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-39816","published":"2026-05-08T13:38:12.925Z","updated":"2026-05-09T01:12:19.254Z","title":"Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0076,"kevAdded":null},{"id":"CVE-2026-25199","published":"2026-05-08T12:22:56.226Z","updated":"2026-05-09T06:43:07.020Z","title":"Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-25077","published":"2026-05-08T12:21:27.034Z","updated":"2026-05-10T14:31:54.919Z","title":"Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00726,"kevAdded":null},{"id":"CVE-2025-69233","published":"2026-05-08T12:19:30.874Z","updated":"2026-05-09T06:43:04.154Z","title":"Apache CloudStack: Domain/account resources limits not honored","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2025-66467","published":"2026-05-08T12:16:04.822Z","updated":"2026-05-09T06:43:02.627Z","title":"Apache CloudStack: MinIO policy remains intact on bucket deletion","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2025-66172","published":"2026-05-08T12:13:18.311Z","updated":"2026-05-10T14:31:30.028Z","title":"Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00512,"kevAdded":null},{"id":"CVE-2025-66171","published":"2026-05-08T12:11:03.883Z","updated":"2026-05-09T06:42:59.830Z","title":"Apache CloudStack: Any user can create a new VM from backups they should not have access to","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.0053,"kevAdded":null},{"id":"CVE-2025-66170","published":"2026-05-08T12:06:32.467Z","updated":"2026-05-09T06:42:58.243Z","title":"Apache CloudStack: Any user can list backups that they should not have access to","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00486,"kevAdded":null},{"id":"CVE-2026-40010","published":"2026-05-06T08:34:30.480Z","updated":"2026-05-07T12:19:50.120Z","title":"Apache Wicket: possible session fixation using AuthenticatedWebSession","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-42509","published":"2026-05-06T08:34:00.746Z","updated":"2026-05-07T12:16:58.182Z","title":"Apache Wicket: crafted strings can break out of the JavaScript sequence","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-43646","published":"2026-05-06T08:31:50.560Z","updated":"2026-05-06T13:58:50.550Z","title":"Apache Wicket: crafted URLs can bypass PackageResourceGuard","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-43975","published":"2026-05-06T08:28:27.681Z","updated":"2026-05-06T13:05:44.585Z","title":"Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00732,"kevAdded":null},{"id":"CVE-2026-28780","published":"2026-05-05T21:29:41.527Z","updated":"2026-09-14T12:04:33.013Z","title":"Apache HTTP Server: buffer overflow in mod_proxy_ajp via  ajp_msg_check_header()","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01376,"kevAdded":null},{"id":"CVE-2026-29168","published":"2026-05-05T13:10:05.656Z","updated":"2026-05-05T16:31:49.391Z","title":"Apache HTTP Server: mod_md unrestricted OCSP response","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00628,"kevAdded":null},{"id":"CVE-2026-43868","published":"2026-05-05T07:49:47.754Z","updated":"2026-07-22T12:08:40.517Z","title":"Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00706,"kevAdded":null},{"id":"CVE-2026-43870","published":"2026-05-05T07:45:35.699Z","updated":"2026-05-06T13:32:31.943Z","title":"Apache Thrift: Node.js web_server.js multi-vulnerability","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00379,"kevAdded":null},{"id":"CVE-2026-43869","published":"2026-05-05T07:25:48.611Z","updated":"2026-09-09T12:05:00.187Z","title":"Apache Thrift: TSSLTransportFactory.java hostname verification","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00632,"kevAdded":null},{"id":"CVE-2026-40682","published":"2026-05-04T16:55:55.834Z","updated":"2026-09-02T12:04:26.218Z","title":"Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.00495,"kevAdded":null},{"id":"CVE-2026-42810","published":"2026-05-04T16:48:49.754Z","updated":"2026-05-04T18:33:09.056Z","title":"Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Polaris","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-42027","published":"2026-05-04T16:43:12.583Z","updated":"2026-09-09T12:04:43.799Z","title":"Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.00707,"kevAdded":null},{"id":"CVE-2026-42440","published":"2026-05-04T16:40:32.503Z","updated":"2026-07-30T12:05:07.579Z","title":"Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2026-42811","published":"2026-05-04T16:37:02.030Z","updated":"2026-05-04T19:48:33.457Z","title":"Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Polaris","kev":false,"epss":0.00432,"kevAdded":null},{"id":"CVE-2026-42809","published":"2026-05-04T16:22:48.527Z","updated":"2026-05-04T16:38:51.761Z","title":"Apache Polaris: staged table creation could vend storage credentials for unvalidated locations","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Polaris","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2026-42812","published":"2026-05-04T16:19:55.828Z","updated":"2026-05-04T16:38:57.660Z","title":"Apache Polaris: No protection on `write.metadata.path`","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Polaris","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-40563","published":"2026-05-04T15:17:32.511Z","updated":"2026-05-06T13:27:03.304Z","title":"Apache Atlas: Script injection allows access to unintended data","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.00464,"kevAdded":null},{"id":"CVE-2026-29169","published":"2026-05-04T14:48:29.832Z","updated":"2026-05-05T20:23:49.062Z","title":"Apache HTTP Server: mod_dav_lock indirect lock crash","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2026-23918","published":"2026-05-04T14:44:28.513Z","updated":"2026-07-15T01:17:47.323Z","title":"Apache HTTP Server: http2: double free and possible RCE on early reset","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.49727,"kevAdded":null},{"id":"CVE-2026-33006","published":"2026-05-04T14:42:03.473Z","updated":"2026-05-04T18:23:55.292Z","title":"Apache HTTP Server: mod_auth_digest timing attack","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00557,"kevAdded":null},{"id":"CVE-2026-33007","published":"2026-05-04T14:41:27.520Z","updated":"2026-05-05T15:07:42.103Z","title":"Apache HTTP Server: mod_authn_socache crash","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-33523","published":"2026-05-04T14:40:41.430Z","updated":"2026-05-04T17:32:49.282Z","title":"Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-33857","published":"2026-05-04T13:07:30.753Z","updated":"2026-05-04T17:32:50.362Z","title":"Apache HTTP Server: Off-by-one OOB reads in AJP getter functions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00393,"kevAdded":null},{"id":"CVE-2026-34032","published":"2026-05-04T12:54:54.383Z","updated":"2026-05-04T17:32:51.452Z","title":"Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00485,"kevAdded":null},{"id":"CVE-2026-34059","published":"2026-05-04T12:39:42.273Z","updated":"2026-05-04T17:32:52.565Z","title":"Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in  ajp_parse_data()","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-24072","published":"2026-05-04T12:37:57.673Z","updated":"2026-05-05T03:56:09.568Z","title":"Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00654,"kevAdded":null},{"id":"CVE-2026-42778","published":"2026-05-01T10:01:10.081Z","updated":"2026-05-02T03:55:26.868Z","title":"Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00657,"kevAdded":null},{"id":"CVE-2026-42779","published":"2026-05-01T10:00:43.712Z","updated":"2026-05-02T03:55:25.715Z","title":"Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.01228,"kevAdded":null},{"id":"CVE-2026-42404","published":"2026-05-01T09:46:49.958Z","updated":"2026-05-01T16:21:08.152Z","title":"Apache Neethi: Unrestricted HTTP Redirect Following in Policy References","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2026-42402","published":"2026-05-01T08:54:41.427Z","updated":"2026-05-01T16:21:05.909Z","title":"Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.00711,"kevAdded":null},{"id":"CVE-2026-42403","published":"2026-05-01T08:38:16.035Z","updated":"2026-05-01T16:21:07.061Z","title":"Apache Neethi: Circular Policy Reference Infinite Loop","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Neethi","kev":false,"epss":0.00763,"kevAdded":null},{"id":"CVE-2026-41016","published":"2026-04-30T09:09:45.529Z","updated":"2026-04-30T13:17:14.490Z","title":"Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers SMTP","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-41873","published":"2026-04-28T15:18:52.392Z","updated":"2026-04-29T11:55:19.796Z","title":"Pony Mail: Admin account takeover via request smuggling","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Pony Mail","kev":false,"epss":0.00444,"kevAdded":null},{"id":"CVE-2026-41636","published":"2026-04-28T09:22:14.639Z","updated":"2026-10-31T20:36:23.426Z","title":"Apache Thrift: Node.js skip() recursion","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00451,"kevAdded":null},{"id":"CVE-2026-41607","published":"2026-04-28T09:21:48.502Z","updated":"2026-09-09T12:04:59.591Z","title":"Apache Thrift: C++ JSON OOB read","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00896,"kevAdded":null},{"id":"CVE-2026-41606","published":"2026-04-28T09:21:12.815Z","updated":"2026-09-09T12:04:58.384Z","title":"Apache Thrift: c_glib dispatch stack overflow","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.01101,"kevAdded":null},{"id":"CVE-2026-41605","published":"2026-04-28T09:20:44.319Z","updated":"2026-09-09T12:04:44.636Z","title":"Apache Thrift: Swift Compact Protocol integer overflow","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.0093,"kevAdded":null},{"id":"CVE-2026-41604","published":"2026-04-28T09:20:13.996Z","updated":"2026-09-09T12:05:08.920Z","title":"Apache Thrift: Swift Range crash in skip()","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.00918,"kevAdded":null},{"id":"CVE-2026-41602","published":"2026-04-28T09:19:06.646Z","updated":"2026-09-09T12:04:46.718Z","title":"Apache Thrift: Go TFramedTransport uint32 overflow","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.01163,"kevAdded":null},{"id":"CVE-2025-48431","published":"2026-04-28T09:11:44.283Z","updated":"2026-09-10T12:05:08.876Z","title":"Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.01038,"kevAdded":null},{"id":"CVE-2026-40557","published":"2026-04-27T13:12:11.118Z","updated":"2026-04-30T15:21:01.170Z","title":"Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Storm Prometheus Reporter","kev":false,"epss":0.00193,"kevAdded":null},{"id":"CVE-2026-41081","published":"2026-04-27T13:10:45.886Z","updated":"2026-04-27T14:43:31.605Z","title":"Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Storm Client","kev":false,"epss":0.00286,"kevAdded":null},{"id":"CVE-2026-27172","published":"2026-04-27T09:59:45.503Z","updated":"2026-07-15T01:14:21.996Z","title":"Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01225,"kevAdded":null},{"id":"CVE-2026-33453","published":"2026-04-27T09:58:48.787Z","updated":"2026-07-15T01:06:23.443Z","title":"Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.09178,"kevAdded":null},{"id":"CVE-2026-33454","published":"2026-04-27T09:42:39.799Z","updated":"2026-07-15T01:06:21.039Z","title":"Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01492,"kevAdded":null},{"id":"CVE-2026-40022","published":"2026-04-27T09:40:28.107Z","updated":"2026-07-15T01:01:36.172Z","title":"Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Camel Platform HTTP Main","kev":false,"epss":0.00937,"kevAdded":null},{"id":"CVE-2026-40858","published":"2026-04-27T09:38:55.466Z","updated":"2026-09-09T12:04:43.040Z","title":"Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01305,"kevAdded":null},{"id":"CVE-2026-41409","published":"2026-04-27T09:20:12.866Z","updated":"2026-04-27T12:21:52.067Z","title":"Apache MINA: CWE-502 Deserialization of Untrusted Data","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2026-41635","published":"2026-04-27T08:59:50.652Z","updated":"2026-04-28T03:55:38.297Z","title":"Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2026-40453","published":"2026-04-27T08:23:20.354Z","updated":"2026-07-15T01:01:00.195Z","title":"Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection","severity":"CRITICAL","score":9.9,"vendor":"Apache Software Foundation","product":"Apache Camel JMS","kev":false,"epss":0.02104,"kevAdded":null},{"id":"CVE-2026-40860","published":"2026-04-27T08:03:19.616Z","updated":"2026-09-10T12:04:54.245Z","title":"Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01739,"kevAdded":null},{"id":"CVE-2026-40048","published":"2026-04-27T07:53:54.636Z","updated":"2026-07-15T01:01:31.729Z","title":"Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Camel PQC","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2026-40473","published":"2026-04-27T07:51:59.134Z","updated":"2026-07-15T01:00:55.681Z","title":"Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel Mina","kev":false,"epss":0.01188,"kevAdded":null},{"id":"CVE-2026-38743","published":"2026-04-24T12:36:40.202Z","updated":"2026-11-03T06:54:43.499Z","title":"Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-40690","published":"2026-04-24T12:35:33.289Z","updated":"2026-11-03T06:54:49.381Z","title":"Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-23902","published":"2026-04-24T10:56:18.289Z","updated":"2026-04-24T18:33:34.025Z","title":"Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00446,"kevAdded":null},{"id":"CVE-2025-62233","published":"2026-04-24T10:54:55.162Z","updated":"2026-04-24T16:09:59.535Z","title":"Apache DolphinScheduler: Deserialization of untrusted data in RPC","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00537,"kevAdded":null},{"id":"CVE-2026-41044","published":"2026-04-24T10:16:53.518Z","updated":"2026-07-15T02:48:41.675Z","title":"Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.0098,"kevAdded":null},{"id":"CVE-2026-41043","published":"2026-04-24T10:16:23.810Z","updated":"2026-04-24T18:17:14.457Z","title":"Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console -  XSS vulnerability when browsing queues","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2026-40466","published":"2026-04-24T10:15:44.445Z","updated":"2026-07-15T01:00:57.571Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":false,"epss":0.04783,"kevAdded":null},{"id":"CVE-2026-40542","published":"2026-04-22T07:07:21.344Z","updated":"2026-09-09T12:05:01.516Z","title":"Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HttpClient","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-33557","published":"2026-04-20T13:28:43.669Z","updated":"2026-07-15T01:06:14.162Z","title":"Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00897,"kevAdded":null},{"id":"CVE-2025-66335","published":"2026-04-20T13:27:27.764Z","updated":"2026-04-20T14:17:11.395Z","title":"Apache Doris MCP Server: MCP SQL inject","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Doris MCP Server","kev":false,"epss":0.00655,"kevAdded":null},{"id":"CVE-2026-33558","published":"2026-04-20T13:20:38.059Z","updated":"2026-04-20T14:20:41.640Z","title":"Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.0063,"kevAdded":null},{"id":"CVE-2026-40948","published":"2026-04-18T13:22:41.577Z","updated":"2026-04-20T16:17:53.543Z","title":"Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers Keycloak","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-32690","published":"2026-04-18T06:22:26.081Z","updated":"2026-11-03T06:53:47.342Z","title":"Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00421,"kevAdded":null},{"id":"CVE-2026-30898","published":"2026-04-18T06:20:48.647Z","updated":"2026-11-03T06:53:17.291Z","title":"Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00771,"kevAdded":null},{"id":"CVE-2026-30912","published":"2026-04-18T06:20:30.254Z","updated":"2026-11-03T06:53:29.166Z","title":"Apache Airflow: Exposing stack trace in case of constraint error","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00449,"kevAdded":null},{"id":"CVE-2026-25917","published":"2026-04-18T06:20:11.187Z","updated":"2026-11-03T06:52:21.285Z","title":"Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00822,"kevAdded":null},{"id":"CVE-2026-32228","published":"2026-04-18T06:19:47.512Z","updated":"2026-11-03T06:53:41.104Z","title":"Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-31987","published":"2026-04-16T13:31:52.336Z","updated":"2026-11-03T06:53:35.106Z","title":"Apache Airflow: JWT token appearing in logs","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00739,"kevAdded":null},{"id":"CVE-2026-25219","published":"2026-04-15T12:30:17.584Z","updated":"2026-11-03T06:52:15.276Z","title":"Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2026-30778","published":"2026-04-15T10:54:25.212Z","updated":"2026-04-16T12:05:25.254Z","title":"Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache SkyWalking","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2025-54550","published":"2026-04-15T00:22:03.305Z","updated":"2026-11-03T07:01:21.033Z","title":"Apache Airflow: RCE by race condition in example_xcom dag","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-31923","published":"2026-04-14T08:38:59.039Z","updated":"2026-04-14T18:16:34.559Z","title":"Apache APISIX: Openid-connect `tls_verify` field is disabled by default","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-33929","published":"2026-04-14T08:09:39.517Z","updated":"2026-04-14T19:50:07.000Z","title":"Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache PDFBox Examples","kev":false,"epss":0.00711,"kevAdded":null},{"id":"CVE-2026-31924","published":"2026-04-14T08:08:05.615Z","updated":"2026-04-14T19:51:55.994Z","title":"Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00238,"kevAdded":null},{"id":"CVE-2026-31908","published":"2026-04-14T08:06:18.026Z","updated":"2026-04-16T12:06:00.176Z","title":"Apache APISIX: forward auth plugin allows header injection","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-33858","published":"2026-04-13T14:36:30.956Z","updated":"2026-11-03T06:54:31.540Z","title":"Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-66236","published":"2026-04-13T14:20:37.180Z","updated":"2026-11-03T06:51:04.950Z","title":"Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2026-34476","published":"2026-04-13T13:01:31.156Z","updated":"2026-04-13T15:29:57.926Z","title":"Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache SkyWalking MCP","kev":false,"epss":0.00477,"kevAdded":null},{"id":"CVE-2026-35337","published":"2026-04-13T09:11:06.193Z","updated":"2026-04-14T03:55:31.489Z","title":"Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Storm Client","kev":false,"epss":0.01011,"kevAdded":null},{"id":"CVE-2026-35565","published":"2026-04-13T09:10:17.367Z","updated":"2026-04-13T14:10:07.069Z","title":"Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Storm UI","kev":false,"epss":0.00466,"kevAdded":null},{"id":"CVE-2026-40023","published":"2026-04-10T15:45:52.895Z","updated":"2026-04-10T17:29:20.009Z","title":"Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4cxx","kev":false,"epss":0.00499,"kevAdded":null},{"id":"CVE-2026-40021","published":"2026-04-10T15:44:17.451Z","updated":"2026-04-10T17:35:01.228Z","title":"Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4net","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2026-34481","published":"2026-04-10T15:43:00.100Z","updated":"2026-07-11T04:55:42.502Z","title":"Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4j JSON Template Layout","kev":false,"epss":0.00691,"kevAdded":null},{"id":"CVE-2026-34480","published":"2026-04-10T15:42:03.843Z","updated":"2026-04-10T17:45:07.434Z","title":"Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Log4j Core","kev":false,"epss":0.01046,"kevAdded":null},{"id":"CVE-2026-34479","published":"2026-04-10T15:41:07.888Z","updated":"2026-04-10T17:47:34.402Z","title":"Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Log4j 1 to Log4j 2 bridge","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2026-34478","published":"2026-04-10T15:40:17.713Z","updated":"2026-04-10T17:50:12.484Z","title":"Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache Log4j Core","kev":false,"epss":0.00972,"kevAdded":null},{"id":"CVE-2026-34477","published":"2026-04-10T15:36:19.740Z","updated":"2026-04-10T17:38:57.154Z","title":"Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4j Core","kev":false,"epss":0.0056,"kevAdded":null},{"id":"CVE-2026-39304","published":"2026-04-10T10:54:04.130Z","updated":"2026-07-15T01:02:18.117Z","title":"Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Client","kev":false,"epss":0.00896,"kevAdded":null},{"id":"CVE-2026-34500","published":"2026-04-09T19:36:52.857Z","updated":"2026-04-10T14:22:31.310Z","title":"Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2026-34487","published":"2026-04-09T19:36:12.048Z","updated":"2026-04-10T17:49:44.314Z","title":"Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2026-34486","published":"2026-04-09T19:35:35.994Z","updated":"2026-09-21T19:43:41.203Z","title":"Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":true,"epss":0.98503,"kevAdded":"2026-08-04"},{"id":"CVE-2026-34483","published":"2026-04-09T19:30:28.874Z","updated":"2026-04-10T20:17:38.858Z","title":"Apache Tomcat: Incomplete escaping of JSON access logs","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2026-32990","published":"2026-04-09T19:23:49.618Z","updated":"2026-04-10T18:39:25.498Z","title":"Apache Tomcat: Fix for CVE-2025-66614 is incomplete","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00307,"kevAdded":null},{"id":"CVE-2026-29146","published":"2026-04-09T19:21:57.289Z","updated":"2026-08-17T12:05:18.740Z","title":"Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0885,"kevAdded":null},{"id":"CVE-2026-29145","published":"2026-04-09T19:20:24.601Z","updated":"2026-04-10T18:11:31.014Z","title":"Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00715,"kevAdded":null},{"id":"CVE-2026-29129","published":"2026-04-09T19:19:40.645Z","updated":"2026-04-10T18:06:45.771Z","title":"Apache Tomcat: TLS cipher order is not preserved","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00259,"kevAdded":null},{"id":"CVE-2026-25854","published":"2026-04-09T19:13:13.529Z","updated":"2026-04-10T18:22:34.359Z","title":"Apache Tomcat: Occasionally open redirect","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00526,"kevAdded":null},{"id":"CVE-2026-24880","published":"2026-04-09T19:12:10.730Z","updated":"2026-04-10T18:33:49.308Z","title":"Apache Tomcat: Request smuggling via invalid chunk extension","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2026-40046","published":"2026-04-09T15:58:32.966Z","updated":"2026-04-10T19:41:00.618Z","title":"Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2026-33005","published":"2026-04-09T15:52:50.770Z","updated":"2026-04-10T18:44:45.976Z","title":"Apache OpenMeetings: Insufficient checks in FileWebService","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.00418,"kevAdded":null},{"id":"CVE-2026-33266","published":"2026-04-09T15:52:36.105Z","updated":"2026-04-10T18:49:13.351Z","title":"Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2026-34020","published":"2026-04-09T15:52:06.599Z","updated":"2026-04-10T20:13:47.789Z","title":"Apache OpenMeetings: Login Credentials Passed via GET Query Parameters","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2025-57735","published":"2026-04-09T11:12:41.735Z","updated":"2026-11-03T06:50:46.407Z","title":"Apache Airflow: Airflow Logout Not Invalidating JWT","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00667,"kevAdded":null},{"id":"CVE-2025-62188","published":"2026-04-09T09:27:13.570Z","updated":"2026-04-09T13:57:33.406Z","title":"Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-34538","published":"2026-04-09T09:09:20.906Z","updated":"2026-11-03T06:54:37.472Z","title":"Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00685,"kevAdded":null},{"id":"CVE-2026-32588","published":"2026-04-07T16:42:52.361Z","updated":"2026-04-09T14:43:57.808Z","title":"Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2026-27315","published":"2026-04-07T16:40:51.836Z","updated":"2026-04-09T14:38:23.271Z","title":"Apache Cassandra: cqlsh history sensitive information leak","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.00169,"kevAdded":null},{"id":"CVE-2026-27314","published":"2026-04-07T16:33:44.448Z","updated":"2026-04-08T03:55:52.335Z","title":"Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-35554","published":"2026-04-07T13:07:08.679Z","updated":"2026-04-07T16:23:31.521Z","title":"Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache Kafka Clients","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-33227","published":"2026-04-07T07:50:58.897Z","updated":"2026-04-08T15:44:39.427Z","title":"Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Client","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-34197","published":"2026-04-07T07:50:10.958Z","updated":"2026-08-17T12:05:05.421Z","title":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Broker","kev":true,"epss":0.98256,"kevAdded":"2026-04-16"},{"id":"CVE-2025-65114","published":"2026-04-02T15:55:27.280Z","updated":"2026-04-02T18:10:10.171Z","title":"Apache Traffic Server: Malformed chunked message body allows request smuggling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00445,"kevAdded":null},{"id":"CVE-2025-58136","published":"2026-04-02T15:54:47.013Z","updated":"2026-04-02T18:13:21.125Z","title":"Apache Traffic Server: A simple legitimate POST request causes a crash","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00699,"kevAdded":null},{"id":"CVE-2026-32794","published":"2026-03-30T21:43:38.144Z","updated":"2026-03-31T13:31:19.039Z","title":"Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Provider for Databricks","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-32642","published":"2026-03-24T07:53:44.644Z","updated":"2026-03-24T14:13:23.718Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.00429,"kevAdded":null},{"id":"CVE-2026-28563","published":"2026-03-17T10:54:57.439Z","updated":"2026-11-03T06:52:33.307Z","title":"Apache Airflow: DAG authorization bypass","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00457,"kevAdded":null},{"id":"CVE-2026-26929","published":"2026-03-17T10:54:05.523Z","updated":"2026-11-03T06:52:27.228Z","title":"Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-30911","published":"2026-03-17T10:53:02.587Z","updated":"2026-11-03T06:53:23.227Z","title":"Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00558,"kevAdded":null},{"id":"CVE-2026-28779","published":"2026-03-17T10:15:59.132Z","updated":"2026-11-03T06:53:11.119Z","title":"Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00704,"kevAdded":null},{"id":"CVE-2025-54920","published":"2026-03-14T09:01:50.486Z","updated":"2026-03-17T12:45:29.903Z","title":"Apache Spark: Spark History Server Code Execution Vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.05422,"kevAdded":null},{"id":"CVE-2025-60012","published":"2026-03-13T15:23:07.334Z","updated":"2026-03-13T18:11:24.588Z","title":"Apache Livy: Restrict file access","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Livy","kev":false,"epss":0.00497,"kevAdded":null},{"id":"CVE-2025-66249","published":"2026-03-13T15:21:53.722Z","updated":"2026-03-13T18:11:59.840Z","title":"Apache Livy: Unauthorized directory access","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Livy","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2026-23907","published":"2026-03-10T09:43:40.384Z","updated":"2026-03-10T17:51:53.261Z","title":"Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache PDFBox Examples","kev":false,"epss":0.00901,"kevAdded":null},{"id":"CVE-2026-25604","published":"2026-03-09T10:39:05.883Z","updated":"2026-03-09T16:48:12.786Z","title":"Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers Amazon","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2025-69219","published":"2026-03-09T10:19:58.034Z","updated":"2026-03-10T03:55:27.322Z","title":"Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers Http","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2026-24713","published":"2026-03-09T08:59:59.259Z","updated":"2026-03-10T17:55:45.832Z","title":"Apache IoTDB: JEXL Expression Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2026-24015","published":"2026-03-09T08:57:45.745Z","updated":"2026-03-10T17:58:18.381Z","title":"Apache IoTDB: Insecure Default Configuration Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00647,"kevAdded":null},{"id":"CVE-2026-24308","published":"2026-03-07T08:51:17.567Z","updated":"2026-07-15T02:46:52.345Z","title":"Apache ZooKeeper: Sensitive information disclosure in client configuration handling","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.01289,"kevAdded":null},{"id":"CVE-2026-24281","published":"2026-03-07T08:50:32.525Z","updated":"2026-07-15T01:17:24.357Z","title":"Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00695,"kevAdded":null},{"id":"CVE-2026-27446","published":"2026-03-04T08:48:48.199Z","updated":"2026-09-18T12:04:44.095Z","title":"Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation","severity":"CRITICAL","score":9.3,"vendor":"Apache Software Foundation","product":"Apache Artemis","kev":false,"epss":0.114,"kevAdded":null},{"id":"CVE-2025-66168","published":"2026-03-04T08:45:00.932Z","updated":"2026-04-10T10:52:27.564Z","title":"Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.00872,"kevAdded":null},{"id":"CVE-2025-59060","published":"2026-03-03T10:46:52.382Z","updated":"2026-08-24T10:59:52.651Z","title":"Apache Ranger: Hostname verification bypass in NiFiRegistryClient","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2025-59059","published":"2026-03-03T10:44:47.294Z","updated":"2026-03-03T14:54:30.232Z","title":"Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.01379,"kevAdded":null},{"id":"CVE-2026-23969","published":"2026-02-24T13:02:55.287Z","updated":"2026-02-24T18:19:35.336Z","title":"Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00699,"kevAdded":null},{"id":"CVE-2026-23980","published":"2026-02-24T12:54:09.946Z","updated":"2026-02-24T18:19:36.414Z","title":"Apache Superset: Improper Neutralization of Special Elements used in a SQL Command","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0071,"kevAdded":null},{"id":"CVE-2026-23982","published":"2026-02-24T12:52:44.361Z","updated":"2026-02-24T18:19:37.487Z","title":"Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2026-23983","published":"2026-02-24T12:52:11.347Z","updated":"2026-02-24T18:19:38.494Z","title":"Apache Superset: Sensitive Data Exposure via REST API (disabled by default)","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00471,"kevAdded":null},{"id":"CVE-2026-23984","published":"2026-02-24T12:51:07.027Z","updated":"2026-02-24T18:19:39.664Z","title":"Apache Superset: SQLLab Read-Only Bypass on PostgreSQL","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2025-27555","published":"2026-02-24T10:09:59.703Z","updated":"2026-03-11T15:10:06.311Z","title":"Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2024-56373","published":"2026-02-24T10:06:41.162Z","updated":"2026-02-26T14:44:09.219Z","title":"Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01232,"kevAdded":null},{"id":"CVE-2026-25747","published":"2026-02-23T08:45:45.826Z","updated":"2026-08-17T12:05:17.559Z","title":"Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Camel LevelDB","kev":false,"epss":0.01257,"kevAdded":null},{"id":"CVE-2026-23552","published":"2026-02-23T08:45:36.154Z","updated":"2026-02-23T15:40:59.201Z","title":"Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2025-65995","published":"2026-02-21T02:14:25.730Z","updated":"2026-11-03T06:50:58.704Z","title":"Apache Airflow: Disclosure of secrets to UI via kwargs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00888,"kevAdded":null},{"id":"CVE-2026-24734","published":"2026-02-17T18:53:12.228Z","updated":"2026-07-15T13:48:07.714Z","title":"Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.00575,"kevAdded":null},{"id":"CVE-2026-24733","published":"2026-02-17T18:50:43.871Z","updated":"2026-03-11T15:19:30.867Z","title":"Apache Tomcat: Security constraint bypass with HTTP/0.9","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2025-66614","published":"2026-02-17T18:48:30.577Z","updated":"2026-03-24T09:46:33.159Z","title":"Apache Tomcat: Client certificate verification bypass due to virtual host mapping","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-25087","published":"2026-02-17T13:18:25.494Z","updated":"2026-02-20T09:56:43.018Z","title":"Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Arrow","kev":false,"epss":0.00903,"kevAdded":null},{"id":"CVE-2026-25903","published":"2026-02-17T09:54:44.203Z","updated":"2026-02-17T14:29:12.153Z","title":"Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates","severity":"HIGH","score":8.7,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2025-33042","published":"2026-02-13T11:47:03.783Z","updated":"2026-02-13T18:05:35.038Z","title":"Apache Avro Java SDK: Code injection on Java generated code","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Avro Java SDK","kev":false,"epss":0.00673,"kevAdded":null},{"id":"CVE-2026-24343","published":"2026-02-10T09:28:52.465Z","updated":"2026-02-10T15:37:07.090Z","title":"Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.00796,"kevAdded":null},{"id":"CVE-2026-23906","published":"2026-02-10T09:28:09.007Z","updated":"2026-02-12T04:45:28.979Z","title":"Apache Druid: Authentication Bypass via LDAP Anonymous Bind","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.01134,"kevAdded":null},{"id":"CVE-2026-23901","published":"2026-02-10T09:25:51.765Z","updated":"2026-02-10T15:31:25.166Z","title":"Apache Shiro: Brute force attack possible to determine valid user names","severity":"LOW","score":1,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2026-22922","published":"2026-02-09T10:33:49.649Z","updated":"2026-11-03T06:52:02.873Z","title":"Apache Airflow: Airflow externalLogUrl Permission Bypass","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2026-24098","published":"2026-02-09T10:32:53.910Z","updated":"2026-11-03T06:52:09.394Z","title":"Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00827,"kevAdded":null},{"id":"CVE-2026-23903","published":"2026-02-09T09:26:21.772Z","updated":"2026-08-20T09:44:32.338Z","title":"Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.00402,"kevAdded":null},{"id":"CVE-2026-24735","published":"2026-02-04T10:41:58.990Z","updated":"2026-02-04T18:15:12.318Z","title":"Apache Answer: Revision API Improper Access Control leads to Information Disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00645,"kevAdded":null},{"id":"CVE-2026-23794","published":"2026-02-03T15:15:24.310Z","updated":"2026-02-03T16:01:22.030Z","title":"Apache Syncope: Reflected XSS on Enduser Login","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-23795","published":"2026-02-03T15:14:35.448Z","updated":"2026-02-03T16:00:32.112Z","title":"Apache Syncope: Console XXE on Keymaster parameters","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.01969,"kevAdded":null},{"id":"CVE-2016-15057","published":"2026-01-26T11:29:03.524Z","updated":"2026-01-26T18:06:06.158Z","title":"Apache Continuum: Command injection leading to RCE","severity":"CRITICAL","score":9.9,"vendor":"Apache Software Foundation","product":"Apache Continuum","kev":false,"epss":0.03888,"kevAdded":null},{"id":"CVE-2025-27821","published":"2026-01-26T09:44:13.532Z","updated":"2026-01-26T18:13:19.241Z","title":"HDFS native client: Out of bounds write in URI parser of native HDFS client","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"HDFS native client","kev":false,"epss":0.00906,"kevAdded":null},{"id":"CVE-2026-24656","published":"2026-01-26T09:41:24.356Z","updated":"2026-01-26T18:35:51.514Z","title":"Apache Karaf: Decanter log-socket collector has deserialization vulnerability","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.00681,"kevAdded":null},{"id":"CVE-2026-22022","published":"2026-01-21T13:41:46.346Z","updated":"2026-01-21T15:35:07.116Z","title":"Apache Solr: Unauthorized bypass of certain \"predefined permission\" rules in the RuleBasedAuthorizationPlugin","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-22444","published":"2026-01-21T13:40:24.979Z","updated":"2026-01-21T15:39:04.577Z","title":"Apache Solr: Insufficient file-access checking in standalone core-creation requests","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.00687,"kevAdded":null},{"id":"CVE-2025-59355","published":"2026-01-19T08:37:24.364Z","updated":"2026-01-20T15:07:22.356Z","title":"Apache Linkis: Password Exposure","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2025-29847","published":"2026-01-19T08:36:06.839Z","updated":"2026-01-20T15:12:04.287Z","title":"Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.0087,"kevAdded":null},{"id":"CVE-2025-68675","published":"2026-01-16T10:23:25.946Z","updated":"2026-11-03T06:51:57.622Z","title":"Apache Airflow: proxy credentials for various providers might leak in task logs","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01879,"kevAdded":null},{"id":"CVE-2025-68438","published":"2026-01-16T10:06:08.128Z","updated":"2026-11-03T06:51:50.923Z","title":"Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2025-60021","published":"2026-01-16T08:39:23.318Z","updated":"2026-02-26T15:04:02.925Z","title":"Apache bRPC: Remote command injection vulnerability in heap builtin service","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.25711,"kevAdded":null},{"id":"CVE-2025-66169","published":"2026-01-14T11:45:20.338Z","updated":"2026-01-15T20:43:58.492Z","title":"Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel Neo4j","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2025-68493","published":"2026-01-11T13:05:36.894Z","updated":"2026-09-14T12:04:26.312Z","title":"Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.50424,"kevAdded":null},{"id":"CVE-2025-52435","published":"2026-01-10T09:47:10.568Z","updated":"2026-01-12T19:07:07.593Z","title":"Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Mynewt NimBLE","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2025-53470","published":"2026-01-10T09:46:35.789Z","updated":"2026-01-12T19:12:52.715Z","title":"Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver","severity":"LOW","score":3.1,"vendor":"Apache Software Foundation","product":"Apache Mynewt NimBLE","kev":false,"epss":0.00346,"kevAdded":null},{"id":"CVE-2025-53477","published":"2026-01-10T09:45:27.630Z","updated":"2026-01-12T16:54:48.496Z","title":"Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Mynewt NimBLE","kev":false,"epss":0.00815,"kevAdded":null},{"id":"CVE-2025-62235","published":"2026-01-10T09:42:30.446Z","updated":"2026-01-12T16:45:27.886Z","title":"Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Mynewt NimBLE","kev":false,"epss":0.00375,"kevAdded":null},{"id":"CVE-2025-68637","published":"2026-01-07T09:39:04.167Z","updated":"2026-01-07T14:40:51.284Z","title":"Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Uniffle","kev":false,"epss":0.00253,"kevAdded":null},{"id":"CVE-2025-68280","published":"2026-01-05T13:45:21.980Z","updated":"2026-01-05T20:04:14.836Z","title":"Apache SIS: XML External Entity (XXE) vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache SIS","kev":false,"epss":0.00699,"kevAdded":null},{"id":"CVE-2025-66518","published":"2026-01-05T08:46:27.649Z","updated":"2026-01-05T20:27:07.472Z","title":"Apache Kyuubi: Unauthorized directory access due to missing path normalization","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kyuubi","kev":false,"epss":0.00996,"kevAdded":null},{"id":"CVE-2025-47411","published":"2026-01-01T16:41:51.743Z","updated":"2026-01-05T15:15:34.140Z","title":"Apache StreamPipes: Leverage of User ID for Privilege Escalation","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.15309,"kevAdded":null},{"id":"CVE-2025-48769","published":"2026-01-01T16:14:33.415Z","updated":"2026-01-05T20:07:09.425Z","title":"Apache NuttX RTOS: fs/vfs/fs_rename: use after free","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache NuttX RTOS","kev":false,"epss":0.0157,"kevAdded":null},{"id":"CVE-2025-48768","published":"2026-01-01T16:14:00.837Z","updated":"2026-01-05T20:06:13.296Z","title":"Apache NuttX RTOS: fs/inode: fs_inoderemove root inode removal","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache NuttX RTOS","kev":false,"epss":0.0079,"kevAdded":null},{"id":"CVE-2025-66524","published":"2025-12-19T09:24:40.687Z","updated":"2026-02-26T16:07:25.299Z","title":"Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2025-68161","published":"2025-12-18T20:47:49.123Z","updated":"2026-04-10T16:18:50.424Z","title":"Apache Log4j Core: Missing TLS hostname verification in Socket appender","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4j Core","kev":false,"epss":0.00767,"kevAdded":null},{"id":"CVE-2025-67895","published":"2025-12-17T11:47:42.502Z","updated":"2025-12-17T19:55:36.494Z","title":"Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers Edge3","kev":false,"epss":0.01168,"kevAdded":null},{"id":"CVE-2025-66388","published":"2025-12-15T11:30:44.355Z","updated":"2026-11-03T06:51:11.009Z","title":"Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00479,"kevAdded":null},{"id":"CVE-2025-53960","published":"2025-12-12T15:15:49.443Z","updated":"2025-12-16T10:08:36.613Z","title":"Apache StreamPark: Uses the user’s password as the secret key","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2025-54947","published":"2025-12-12T15:11:38.279Z","updated":"2025-12-12T18:48:51.364Z","title":"Apache StreamPark: Use hard-coded key vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2025-54981","published":"2025-12-12T15:10:35.562Z","updated":"2025-12-12T19:27:16.118Z","title":"Apache StreamPark: Weak Encryption Algorithm in StreamPark","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2025-26866","published":"2025-12-12T09:23:07.681Z","updated":"2026-02-26T16:07:42.192Z","title":"Apache HugeGraph-Server: RAFT and deserialization vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HugeGraph-Server","kev":false,"epss":0.01044,"kevAdded":null},{"id":"CVE-2025-58137","published":"2025-12-12T09:21:00.374Z","updated":"2025-12-12T19:35:44.785Z","title":"Apache Fineract: IDOR via self-service API","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.0039,"kevAdded":null},{"id":"CVE-2025-58130","published":"2025-12-12T09:20:06.930Z","updated":"2025-12-12T19:38:02.717Z","title":"Apache Fineract: Server Key not masked","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2025-23408","published":"2025-12-12T09:18:59.147Z","updated":"2025-12-18T15:34:00.875Z","title":"Apache Fineract: weak password policy","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2025-66675","published":"2025-12-10T09:32:58.536Z","updated":"2025-12-10T14:53:13.391Z","title":"Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.00594,"kevAdded":null},{"id":"CVE-2025-58098","published":"2025-12-05T13:40:39.772Z","updated":"2026-02-26T16:57:30.146Z","title":"Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01424,"kevAdded":null},{"id":"CVE-2025-66200","published":"2025-12-05T11:02:25.722Z","updated":"2025-12-05T17:38:36.682Z","title":"Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0065,"kevAdded":null},{"id":"CVE-2025-65082","published":"2025-12-05T10:46:27.138Z","updated":"2025-12-05T19:30:08.216Z","title":"Apache HTTP Server: CGI environment variable override","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00807,"kevAdded":null},{"id":"CVE-2025-59775","published":"2025-12-05T10:17:03.852Z","updated":"2025-12-05T19:28:44.631Z","title":"Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00821,"kevAdded":null},{"id":"CVE-2025-55753","published":"2025-12-05T10:12:22.041Z","updated":"2025-12-05T19:27:31.842Z","title":"Apache HTTP Server: mod_md (ACME), unintended retry intervals","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0045,"kevAdded":null},{"id":"CVE-2025-66516","published":"2025-12-04T16:17:24.980Z","updated":"2026-02-26T16:57:34.060Z","title":"Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Tika core","kev":false,"epss":0.89024,"kevAdded":null},{"id":"CVE-2025-64775","published":"2025-12-01T16:07:36.573Z","updated":"2025-12-01T18:23:17.469Z","title":"Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.01526,"kevAdded":null},{"id":"CVE-2025-59789","published":"2025-12-01T10:22:41.697Z","updated":"2025-12-01T15:05:18.284Z","title":"Apache bRPC: Stack Exhaustion via Unbounded Recursion in JSON Parser","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.01672,"kevAdded":null},{"id":"CVE-2025-59792","published":"2025-11-28T14:21:22.699Z","updated":"2025-11-28T17:03:57.700Z","title":"Apache Kvrocks: MONITOR command reveals plaintext credentials to non-admins","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00317,"kevAdded":null},{"id":"CVE-2025-59790","published":"2025-11-28T14:20:31.682Z","updated":"2025-11-28T17:03:56.121Z","title":"Apache Kvrocks: RESET command grants admin privileges","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-54057","published":"2025-11-27T11:47:32.947Z","updated":"2026-04-13T15:29:56.169Z","title":"Apache SkyWalking: Stored XSS vulnerability","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache SkyWalking","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2025-59302","published":"2025-11-27T11:46:25.521Z","updated":"2026-11-03T22:03:06.484Z","title":"Apache CloudStack: Potential remote code execution on Javascript engine defined rules","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.0049,"kevAdded":null},{"id":"CVE-2025-59454","published":"2025-11-27T11:40:40.043Z","updated":"2025-11-28T15:41:44.599Z","title":"Apache CloudStack: Lack of user permission validation leading to data leak for few APIs","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-59390","published":"2025-11-26T08:50:07.322Z","updated":"2025-12-11T14:24:14.505Z","title":"Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.00701,"kevAdded":null},{"id":"CVE-2025-62728","published":"2025-11-26T08:45:37.472Z","updated":"2025-12-01T18:19:47.592Z","title":"Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2025-65998","published":"2025-11-24T13:47:03.979Z","updated":"2025-11-24T15:36:14.583Z","title":"Apache Syncope: Default AES key used for internal password encryption","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2025-64408","published":"2025-11-19T10:32:05.808Z","updated":"2026-11-03T22:03:07.444Z","title":"Apache Causeway: Java deserialization vulnerability to authenticated attackers","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Causeway","kev":false,"epss":0.11555,"kevAdded":null},{"id":"CVE-2025-61623","published":"2025-11-12T09:16:58.139Z","updated":"2025-11-12T14:29:43.400Z","title":"Apache OFBiz: Reflected Cross-site Scripting","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00834,"kevAdded":null},{"id":"CVE-2025-59118","published":"2025-11-12T09:15:54.263Z","updated":"2025-11-12T14:31:48.367Z","title":"Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.01742,"kevAdded":null},{"id":"CVE-2025-64407","published":"2025-11-12T09:12:48.714Z","updated":"2025-11-13T16:32:12.202Z","title":"Apache OpenOffice: URL fetching can be used to exfiltrate arbitrary INI file values and environment variables","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00491,"kevAdded":null},{"id":"CVE-2025-64406","published":"2025-11-12T09:11:47.133Z","updated":"2025-11-12T17:09:01.642Z","title":"Apache OpenOffice: Possible memory corruption during CSV import","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2025-64405","published":"2025-11-12T09:10:35.778Z","updated":"2025-11-13T16:40:51.632Z","title":"Apache OpenOffice: Remote documents loaded without prompt via DDE function","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01446,"kevAdded":null},{"id":"CVE-2025-64404","published":"2025-11-12T09:08:34.261Z","updated":"2025-11-13T16:41:33.471Z","title":"Apache OpenOffice: Remote documents loaded without prompt via background and bullet images","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01252,"kevAdded":null},{"id":"CVE-2025-64403","published":"2025-11-12T09:04:50.392Z","updated":"2025-11-12T14:47:26.507Z","title":"Apache OpenOffice: Remote documents loaded without prompt via \"external data sources\" in Calc","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01259,"kevAdded":null},{"id":"CVE-2025-64402","published":"2025-11-12T09:03:01.604Z","updated":"2025-11-12T14:49:16.168Z","title":"Apache OpenOffice: Remote documents loaded without prompt via OLE objects","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2025-64401","published":"2025-11-12T08:58:18.371Z","updated":"2025-11-12T14:50:48.219Z","title":"Apache OpenOffice: Remote documents loaded without prompt via IFrame","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00895,"kevAdded":null},{"id":"CVE-2025-58337","published":"2025-11-05T09:26:36.573Z","updated":"2025-11-06T15:55:05.901Z","title":"Apache Doris-MCP-Server: Improper Access Control results in bypassing a \"read-only\" mode for doris-mcp-server MCP Server","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Doris-MCP-Server","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2025-62232","published":"2025-10-31T08:48:23.592Z","updated":"2025-10-31T13:58:14.534Z","title":"Apache APISIX: basic-auth logs plaintext credentials at info level","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.0048,"kevAdded":null},{"id":"CVE-2025-54941","published":"2025-10-30T09:45:26.712Z","updated":"2026-11-03T06:50:40.247Z","title":"Apache Airflow: Command injection in \"example_dag_decorator\"","severity":"MEDIUM","score":4.6,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00492,"kevAdded":null},{"id":"CVE-2025-62402","published":"2025-10-30T09:14:27.456Z","updated":"2026-11-03T06:50:52.451Z","title":"Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00522,"kevAdded":null},{"id":"CVE-2025-62503","published":"2025-10-30T09:11:16.813Z","updated":"2025-10-30T14:25:43.960Z","title":"Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)","severity":"MEDIUM","score":4.6,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2025-61795","published":"2025-10-27T17:30:28.334Z","updated":"2026-05-12T12:08:33.715Z","title":"Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01249,"kevAdded":null},{"id":"CVE-2025-55752","published":"2025-10-27T17:29:56.060Z","updated":"2026-05-12T12:08:27.205Z","title":"Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.64413,"kevAdded":null},{"id":"CVE-2025-55754","published":"2025-10-27T17:29:50.756Z","updated":"2026-05-12T12:08:28.428Z","title":"Apache Tomcat: console manipulation via escape sequences in log messages","severity":"CRITICAL","score":9.6,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.10173,"kevAdded":null},{"id":"CVE-2025-57738","published":"2025-10-20T14:43:39.985Z","updated":"2025-11-04T21:13:18.181Z","title":"Apache Syncope: Remote Code Execution by delegated administrators","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.23185,"kevAdded":null},{"id":"CVE-2025-47410","published":"2025-10-18T15:15:09.547Z","updated":"2025-11-04T21:10:53.480Z","title":"Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.00356,"kevAdded":null},{"id":"CVE-2025-61581","published":"2025-10-16T08:40:11.865Z","updated":"2025-11-04T21:13:58.992Z","title":"Apache Traffic Control: ReDoS issue in Traffic Router configuration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Control","kev":false,"epss":0.00736,"kevAdded":null},{"id":"CVE-2025-54539","published":"2025-10-16T08:26:06.766Z","updated":"2026-02-26T16:57:26.658Z","title":"Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ NMS AMQP Client","kev":false,"epss":0.02087,"kevAdded":null},{"id":"CVE-2025-55039","published":"2025-10-15T07:19:25.493Z","updated":"2025-11-04T21:13:00.940Z","title":"Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.00205,"kevAdded":null},{"id":"CVE-2024-44088","published":"2025-10-14T14:36:52.447Z","updated":"2025-11-04T21:08:55.234Z","title":"Apache Geode: Reflected XSS","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.00689,"kevAdded":null},{"id":"CVE-2025-30001","published":"2025-10-10T09:52:26.810Z","updated":"2025-11-04T21:09:55.311Z","title":"Apache StreamPark: Authenticated users can trigger remote command execution","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00554,"kevAdded":null},{"id":"CVE-2025-62228","published":"2025-10-09T13:15:49.761Z","updated":"2025-11-04T21:14:15.721Z","title":"Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Flink CDC","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-61735","published":"2025-10-02T09:47:49.948Z","updated":"2025-11-04T21:14:09.199Z","title":"Apache Kylin: Server-Side Request Forgery","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.01042,"kevAdded":null},{"id":"CVE-2025-61733","published":"2025-10-02T09:47:39.126Z","updated":"2026-02-26T17:48:23.007Z","title":"Apache Kylin: Authentication bypass","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.01301,"kevAdded":null},{"id":"CVE-2025-61734","published":"2025-10-02T09:47:15.317Z","updated":"2025-11-04T21:14:07.897Z","title":"Apache Kylin: improper restriction of file read","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.26124,"kevAdded":null},{"id":"CVE-2025-61622","published":"2025-10-01T09:55:05.557Z","updated":"2025-11-04T21:14:00.912Z","title":"Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.45125,"kevAdded":null},{"id":"CVE-2025-54831","published":"2025-09-26T07:28:59.066Z","updated":"2026-11-03T06:50:34.087Z","title":"Apache Airflow: Connection sensitive details exposed to users with READ permissions","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00968,"kevAdded":null},{"id":"CVE-2025-58457","published":"2025-09-24T09:29:35.824Z","updated":"2025-11-04T21:13:42.037Z","title":"Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00338,"kevAdded":null},{"id":"CVE-2025-48392","published":"2025-09-24T07:59:52.592Z","updated":"2025-11-04T21:11:04.278Z","title":"Apache IoTDB: DoS Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00627,"kevAdded":null},{"id":"CVE-2025-48459","published":"2025-09-24T07:57:24.444Z","updated":"2025-11-04T21:11:05.598Z","title":"Apache IoTDB: Deserialization of untrusted Data","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00514,"kevAdded":null},{"id":"CVE-2025-59328","published":"2025-09-15T16:26:58.442Z","updated":"2025-11-04T21:13:48.540Z","title":"Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Fory","kev":false,"epss":0.00685,"kevAdded":null},{"id":"CVE-2025-48208","published":"2025-09-09T09:31:35.585Z","updated":"2025-11-04T21:10:58.747Z","title":"Apache HertzBeat (incubating): Jmx JNDI injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HertzBeat (incubating)","kev":false,"epss":0.0067,"kevAdded":null},{"id":"CVE-2025-24404","published":"2025-09-09T09:30:59.424Z","updated":"2025-11-04T21:09:42.310Z","title":"Apache HertzBeat (incubating): RCE by parse http sitemap xml response","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HertzBeat (incubating)","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2025-58782","published":"2025-09-08T08:53:15.818Z","updated":"2025-11-04T21:13:47.254Z","title":"Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Jackrabbit Core","kev":false,"epss":0.01354,"kevAdded":null},{"id":"CVE-2024-43166","published":"2025-09-03T09:10:24.401Z","updated":"2025-11-04T21:08:48.628Z","title":"Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00533,"kevAdded":null},{"id":"CVE-2024-43115","published":"2025-09-03T08:38:32.442Z","updated":"2025-11-04T21:08:47.334Z","title":"Apache DolphinScheduler: Alert Script Attack","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-26467","published":"2025-08-25T14:06:28.761Z","updated":"2026-02-26T17:48:12.624Z","title":"Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.00515,"kevAdded":null},{"id":"CVE-2025-54812","published":"2025-08-22T18:46:46.205Z","updated":"2025-11-04T21:12:52.982Z","title":"Apache Log4cxx: Improper HTML escaping in HTMLLayout","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache Log4cxx","kev":false,"epss":0.01238,"kevAdded":null},{"id":"CVE-2025-54813","published":"2025-08-22T18:45:42.611Z","updated":"2025-11-04T21:12:54.283Z","title":"Apache Log4cxx: Improper escaping with JSONLayout","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Log4cxx","kev":false,"epss":0.0135,"kevAdded":null},{"id":"CVE-2024-48988","published":"2025-08-22T18:24:22.144Z","updated":"2025-11-04T21:09:00.563Z","title":"Apache StreamPark: SQL injection vulnerability","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00593,"kevAdded":null},{"id":"CVE-2025-54988","published":"2025-08-20T20:08:49.481Z","updated":"2026-02-26T17:48:22.169Z","title":"Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Tika PDF parser module","kev":false,"epss":0.47948,"kevAdded":null},{"id":"CVE-2024-39954","published":"2025-08-20T08:56:41.560Z","updated":"2025-08-20T13:20:27.851Z","title":"Apache EventMesh Runtime: SSRF","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache EventMesh Runtime","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2025-53192","published":"2025-08-18T20:09:31.206Z","updated":"2025-11-04T21:11:44.989Z","title":"Apache Commons OGNL: Expression Injection leading to RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Commons OGNL","kev":false,"epss":0.00577,"kevAdded":null},{"id":"CVE-2025-54466","published":"2025-08-15T14:13:52.584Z","updated":"2026-02-26T17:48:32.591Z","title":"Apache OFBiz: RCE Vulnerability in scrum plugin","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.26526,"kevAdded":null},{"id":"CVE-2025-55675","published":"2025-08-14T13:18:53.944Z","updated":"2025-11-04T21:13:14.265Z","title":"Apache Superset: Incorrect datasource authorization on REST API","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00648,"kevAdded":null},{"id":"CVE-2025-55674","published":"2025-08-14T13:18:10.535Z","updated":"2025-11-04T21:13:12.950Z","title":"Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0075,"kevAdded":null},{"id":"CVE-2025-55672","published":"2025-08-14T13:17:33.843Z","updated":"2025-11-04T21:13:10.307Z","title":"Apache Superset: Stored XSS on charts metadata","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00801,"kevAdded":null},{"id":"CVE-2025-55673","published":"2025-08-14T13:16:27.060Z","updated":"2025-11-04T21:13:11.614Z","title":"Apache Superset: Metadata exposure in embedded charts","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00609,"kevAdded":null},{"id":"CVE-2025-54472","published":"2025-08-14T09:05:38.944Z","updated":"2025-11-04T21:12:49.056Z","title":"Apache bRPC: Redis Parser Remote Denial of Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.01267,"kevAdded":null},{"id":"CVE-2025-55668","published":"2025-08-13T13:21:35.743Z","updated":"2025-11-04T21:13:09.014Z","title":"Apache Tomcat: session fixation via rewrite valve","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00929,"kevAdded":null},{"id":"CVE-2025-48989","published":"2025-08-13T12:11:26.124Z","updated":"2026-05-12T12:08:14.457Z","title":"Apache Tomcat: h2 DoS - Made You Reset","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.03768,"kevAdded":null},{"id":"CVE-2025-53606","published":"2025-08-08T09:22:55.040Z","updated":"2025-11-04T21:11:51.516Z","title":"Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Seata (incubating)","kev":false,"epss":0.00773,"kevAdded":null},{"id":"CVE-2025-48913","published":"2025-08-08T09:21:22.208Z","updated":"2026-02-26T17:49:47.500Z","title":"Apache CXF: Untrusted JMS configuration can lead to RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.01072,"kevAdded":null},{"id":"CVE-2024-51775","published":"2025-08-03T10:13:17.467Z","updated":"2025-11-04T21:09:01.910Z","title":"Apache Zeppelin: Command Injection via CSWSH","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00289,"kevAdded":null},{"id":"CVE-2024-41177","published":"2025-08-03T10:09:43.302Z","updated":"2025-11-04T21:08:43.404Z","title":"Apache Zeppelin: XSS in the Helium module","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.0073,"kevAdded":null},{"id":"CVE-2024-52279","published":"2025-08-03T10:02:05.153Z","updated":"2025-11-04T21:09:03.247Z","title":"Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01132,"kevAdded":null},{"id":"CVE-2025-24854","published":"2025-07-31T08:43:18.886Z","updated":"2025-11-04T21:09:44.925Z","title":"Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.0051,"kevAdded":null},{"id":"CVE-2025-24853","published":"2025-07-31T08:42:06.453Z","updated":"2025-11-04T21:09:43.620Z","title":"Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.00598,"kevAdded":null},{"id":"CVE-2025-54656","published":"2025-07-30T15:58:02.362Z","updated":"2025-11-04T21:12:51.678Z","title":"Apache Struts Extras: Improper Output Neutralization for Logs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Struts Extras","kev":false,"epss":0.00671,"kevAdded":null},{"id":"CVE-2025-54090","published":"2025-07-23T13:19:25.273Z","updated":"2025-11-04T21:12:43.771Z","title":"Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0088,"kevAdded":null},{"id":"CVE-2025-50151","published":"2025-07-21T09:32:30.334Z","updated":"2025-11-04T21:11:34.502Z","title":"Apache Jena: Configuration files uploaded by administrative users are not check properly","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Jena","kev":false,"epss":0.01067,"kevAdded":null},{"id":"CVE-2025-49656","published":"2025-07-21T09:30:32.715Z","updated":"2025-11-04T21:11:14.792Z","title":"Apache Jena: Administrative users can create files outside the server directory space via the admin UI","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Jena","kev":false,"epss":0.01558,"kevAdded":null},{"id":"CVE-2025-48795","published":"2025-07-15T14:26:44.758Z","updated":"2025-11-04T21:11:06.901Z","title":"Apache CXF: Denial of Service and sensitive data exposure in logs","severity":"MEDIUM","score":5.6,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.00735,"kevAdded":null},{"id":"CVE-2025-53689","published":"2025-07-14T09:15:38.863Z","updated":"2025-11-04T21:12:33.255Z","title":"Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Jackrabbit","kev":false,"epss":0.0054,"kevAdded":null},{"id":"CVE-2024-41169","published":"2025-07-12T16:22:35.724Z","updated":"2025-11-04T21:08:42.107Z","title":"Apache Zeppelin: raft directory listing and file read","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00693,"kevAdded":null},{"id":"CVE-2025-48924","published":"2025-07-11T14:56:58.049Z","updated":"2025-11-04T22:06:40.023Z","title":"Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Commons Lang","kev":false,"epss":0.02632,"kevAdded":null},{"id":"CVE-2025-53506","published":"2025-07-10T19:14:23.249Z","updated":"2025-11-04T21:11:48.893Z","title":"Apache Tomcat: DoS via excessive h2 streams at connection start","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02129,"kevAdded":null},{"id":"CVE-2025-52520","published":"2025-07-10T19:05:41.637Z","updated":"2025-11-04T21:11:39.773Z","title":"Apache Tomcat: DoS via integer overflow in multipart file upload","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02198,"kevAdded":null},{"id":"CVE-2025-52434","published":"2025-07-10T19:03:47.225Z","updated":"2025-11-04T21:11:38.474Z","title":"Apache Tomcat: APR/Native Connector crash leading to DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02074,"kevAdded":null},{"id":"CVE-2025-53020","published":"2025-07-10T16:59:06.340Z","updated":"2025-11-04T21:11:43.692Z","title":"Apache HTTP Server: HTTP/2 DoS by Memory Increase","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.04963,"kevAdded":null},{"id":"CVE-2025-49812","published":"2025-07-10T16:58:23.943Z","updated":"2025-11-04T21:11:18.699Z","title":"Apache HTTP Server: mod_ssl TLS upgrade attack","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00614,"kevAdded":null},{"id":"CVE-2025-49630","published":"2025-07-10T16:57:40.117Z","updated":"2025-11-04T21:11:13.455Z","title":"Apache HTTP Server: mod_proxy_http2 denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01352,"kevAdded":null},{"id":"CVE-2025-23048","published":"2025-07-10T16:56:53.545Z","updated":"2026-02-26T17:50:47.700Z","title":"Apache HTTP Server: mod_ssl access control bypass with session resumption","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0104,"kevAdded":null},{"id":"CVE-2024-43394","published":"2025-07-10T16:56:07.720Z","updated":"2025-11-04T21:08:53.876Z","title":"Apache HTTP Server: SSRF on Windows due to UNC paths","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01272,"kevAdded":null},{"id":"CVE-2024-47252","published":"2025-07-10T16:55:20.013Z","updated":"2025-11-04T21:08:59.176Z","title":"Apache HTTP Server: mod_ssl error log variable escaping","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00795,"kevAdded":null},{"id":"CVE-2024-43204","published":"2025-07-10T16:54:15.759Z","updated":"2025-11-04T21:08:51.242Z","title":"Apache HTTP Server: SSRF with mod_headers setting Content-Type header","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00909,"kevAdded":null},{"id":"CVE-2024-42516","published":"2025-07-10T16:53:13.201Z","updated":"2025-11-04T21:08:46.021Z","title":"Apache HTTP Server: HTTP response splitting","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00818,"kevAdded":null},{"id":"CVE-2025-27446","published":"2025-07-06T06:05:15.144Z","updated":"2026-02-26T18:27:55.996Z","title":"Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache APISIX Java Plugin Runner","kev":false,"epss":0.00207,"kevAdded":null},{"id":"CVE-2024-35164","published":"2025-07-02T11:23:22.750Z","updated":"2026-02-26T18:28:01.214Z","title":"Apache Guacamole: Improper input validation of console codes","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2025-46647","published":"2025-07-02T11:08:47.179Z","updated":"2025-11-04T21:10:49.580Z","title":"Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2025-32897","published":"2025-06-28T18:25:18.312Z","updated":"2026-03-30T08:35:55.447Z","title":"Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Seata (incubating)","kev":false,"epss":0.02037,"kevAdded":null},{"id":"CVE-2025-50213","published":"2025-06-24T07:06:53.128Z","updated":"2025-06-24T18:03:35.296Z","title":"Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers Snowflake","kev":false,"epss":0.00774,"kevAdded":null},{"id":"CVE-2025-32896","published":"2025-06-19T10:38:37.159Z","updated":"2025-06-20T13:53:28.835Z","title":"Apache SeaTunnel: Unauthenticated insecure access","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache SeaTunnel","kev":false,"epss":0.01157,"kevAdded":null},{"id":"CVE-2025-31698","published":"2025-06-19T10:07:46.733Z","updated":"2025-06-20T13:32:19.681Z","title":"Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2025-49763","published":"2025-06-19T10:07:15.450Z","updated":"2025-06-20T13:56:54.082Z","title":"Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00742,"kevAdded":null},{"id":"CVE-2025-48976","published":"2025-06-16T15:00:48.140Z","updated":"2025-11-03T20:05:02.486Z","title":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons FileUpload","kev":false,"epss":0.32877,"kevAdded":null},{"id":"CVE-2025-49124","published":"2025-06-16T14:22:16.288Z","updated":"2025-10-29T14:25:42.691Z","title":"Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00361,"kevAdded":null},{"id":"CVE-2025-49125","published":"2025-06-16T14:18:09.610Z","updated":"2025-11-03T20:05:06.721Z","title":"Apache Tomcat: Security constraint bypass for pre/post-resources","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.03437,"kevAdded":null},{"id":"CVE-2025-48988","published":"2025-06-16T14:13:40.457Z","updated":"2025-11-03T20:05:03.939Z","title":"Apache Tomcat: FileUpload large number of parts with headers DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.30433,"kevAdded":null},{"id":"CVE-2025-47869","published":"2025-06-16T11:00:37.755Z","updated":"2025-06-16T16:10:04.916Z","title":"Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NuttX RTOS","kev":false,"epss":0.00741,"kevAdded":null},{"id":"CVE-2025-47868","published":"2025-06-16T11:00:05.293Z","updated":"2025-06-16T16:12:13.504Z","title":"Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NuttX RTOS: tools/bdf-converter.","kev":false,"epss":0.00741,"kevAdded":null},{"id":"CVE-2025-30675","published":"2025-06-10T23:12:23.838Z","updated":"2025-06-11T13:52:21.335Z","title":"Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00674,"kevAdded":null},{"id":"CVE-2025-22829","published":"2025-06-10T23:11:24.828Z","updated":"2025-06-11T13:53:45.517Z","title":"Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00821,"kevAdded":null},{"id":"CVE-2025-26521","published":"2025-06-10T23:08:48.602Z","updated":"2026-02-26T17:50:42.855Z","title":"Apache CloudStack: CKS cluster in project exposes user API keys","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2025-47849","published":"2025-06-10T23:07:54.526Z","updated":"2026-02-26T17:50:43.214Z","title":"Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-47713","published":"2025-06-10T23:06:45.585Z","updated":"2026-02-26T17:50:43.568Z","title":"Apache CloudStack: Domain Admin can reset Admin password in Root Domain","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00592,"kevAdded":null},{"id":"CVE-2025-27817","published":"2025-06-10T07:55:14.422Z","updated":"2025-06-10T15:15:40.843Z","title":"Apache Kafka Client: Arbitrary file read and SSRF vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kafka Client","kev":false,"epss":0.68776,"kevAdded":null},{"id":"CVE-2025-27819","published":"2025-06-10T07:54:41.896Z","updated":"2025-06-10T15:15:58.031Z","title":"Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2025-27818","published":"2025-06-10T07:52:31.778Z","updated":"2026-02-26T17:51:05.352Z","title":"Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.01066,"kevAdded":null},{"id":"CVE-2025-27531","published":"2025-06-06T14:55:28.516Z","updated":"2025-06-10T15:30:50.280Z","title":"Apache InLong: An arbitrary file read vulnerability for JDBC","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00811,"kevAdded":null},{"id":"CVE-2025-46548","published":"2025-06-03T14:45:32.890Z","updated":"2025-06-11T17:44:23.190Z","title":"Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effective","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Pekko Management","kev":false,"epss":0.00806,"kevAdded":null},{"id":"CVE-2025-48912","published":"2025-05-30T08:26:15.500Z","updated":"2025-05-31T00:11:45.502Z","title":"Apache Superset: Improper authorization bypass on row level security via SQL Injection","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00786,"kevAdded":null},{"id":"CVE-2025-46701","published":"2025-05-29T19:06:04.289Z","updated":"2025-11-03T20:04:34.067Z","title":"Apache Tomcat: Security constraint bypass for CGI scripts","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.03143,"kevAdded":null},{"id":"CVE-2025-48734","published":"2025-05-28T13:32:08.300Z","updated":"2026-11-03T22:03:05.082Z","title":"Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Commons BeanUtils 1.x","kev":false,"epss":0.02018,"kevAdded":null},{"id":"CVE-2025-27528","published":"2025-05-28T08:12:27.609Z","updated":"2025-05-28T13:20:49.864Z","title":"Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00859,"kevAdded":null},{"id":"CVE-2025-27526","published":"2025-05-28T08:07:35.440Z","updated":"2025-05-28T14:00:41.948Z","title":"Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00856,"kevAdded":null},{"id":"CVE-2025-27522","published":"2025-05-28T08:06:04.191Z","updated":"2026-01-28T19:39:59.185Z","title":"Apache InLong: JDBC Vulnerability during verification processing","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00899,"kevAdded":null},{"id":"CVE-2025-35003","published":"2025-05-26T10:03:06.808Z","updated":"2026-02-26T18:27:56.611Z","title":"Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NuttX RTOS","kev":false,"epss":0.01614,"kevAdded":null},{"id":"CVE-2025-47436","published":"2025-05-14T13:11:36.329Z","updated":"2025-05-14T20:58:23.567Z","title":"Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression","severity":"MEDIUM","score":6,"vendor":"Apache Software Foundation","product":"Apache ORC","kev":false,"epss":0.00566,"kevAdded":null},{"id":"CVE-2025-26864","published":"2025-05-14T10:44:12.712Z","updated":"2025-05-19T18:41:38.927Z","title":"Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.00746,"kevAdded":null},{"id":"CVE-2025-26795","published":"2025-05-14T10:43:05.586Z","updated":"2025-05-19T18:43:08.129Z","title":"Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB JDBC driver","kev":false,"epss":0.00746,"kevAdded":null},{"id":"CVE-2024-24780","published":"2025-05-14T10:42:20.580Z","updated":"2026-02-26T18:28:09.987Z","title":"Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01437,"kevAdded":null},{"id":"CVE-2025-27696","published":"2025-05-13T08:21:21.199Z","updated":"2025-09-01T09:52:53.293Z","title":"Apache Superset: Incorrect authorization leading to resource ownership takeover","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.013,"kevAdded":null},{"id":"CVE-2025-46392","published":"2025-05-09T09:34:38.854Z","updated":"2025-05-13T19:15:39.662Z","title":"Apache Commons Configuration: Uncontrolled Resource Consumption when loading untrusted configurations in 1.x","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Commons Configuration","kev":false,"epss":0.02123,"kevAdded":null},{"id":"CVE-2025-27533","published":"2025-05-07T08:59:00.249Z","updated":"2025-11-03T19:45:36.972Z","title":"Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.08963,"kevAdded":null},{"id":"CVE-2025-46762","published":"2025-05-06T09:08:13.996Z","updated":"2026-02-26T18:28:53.172Z","title":"Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Parquet Java","kev":false,"epss":0.01593,"kevAdded":null},{"id":"CVE-2025-31651","published":"2025-04-28T19:17:21.721Z","updated":"2026-02-26T18:27:59.801Z","title":"Apache Tomcat: Bypass of rules in Rewrite Valve","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.04263,"kevAdded":null},{"id":"CVE-2025-31650","published":"2025-04-28T19:14:31.107Z","updated":"2025-11-03T19:53:11.497Z","title":"Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.61322,"kevAdded":null},{"id":"CVE-2025-27820","published":"2025-04-24T11:44:25.986Z","updated":"2025-06-04T11:20:12.764Z","title":"Apache HttpComponents: PSL (Public Suffix List) validation bypass","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HttpComponents","kev":false,"epss":0.00966,"kevAdded":null},{"id":"CVE-2025-26413","published":"2025-04-22T07:07:49.985Z","updated":"2025-05-12T15:47:39.924Z","title":"Apache Kvrocks: The server was crashed by the negative offset","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00764,"kevAdded":null},{"id":"CVE-2025-29953","published":"2025-04-18T15:23:31.658Z","updated":"2025-04-23T15:39:08.654Z","title":"Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ NMS OpenWire Client","kev":false,"epss":0.02091,"kevAdded":null},{"id":"CVE-2024-56736","published":"2025-04-16T15:38:11.307Z","updated":"2025-04-16T18:03:38.561Z","title":"Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.00664,"kevAdded":null},{"id":"CVE-2025-24859","published":"2025-04-14T08:18:54.729Z","updated":"2026-02-26T18:28:24.132Z","title":"Apache Roller: Insufficient Session Expiration on Password Change","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.01136,"kevAdded":null},{"id":"CVE-2025-27391","published":"2025-04-09T14:42:32.504Z","updated":"2025-04-09T17:02:46.727Z","title":"Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Artemis","kev":false,"epss":0.00443,"kevAdded":null},{"id":"CVE-2025-31672","published":"2025-04-09T11:59:33.900Z","updated":"2025-05-23T13:11:07.642Z","title":"Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache POI","kev":false,"epss":0.01382,"kevAdded":null},{"id":"CVE-2025-30677","published":"2025-04-09T11:58:11.716Z","updated":"2025-04-09T16:03:27.556Z","title":"Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Pulsar IO Kafka Connector","kev":false,"epss":0.00745,"kevAdded":null},{"id":"CVE-2025-30473","published":"2025-04-07T08:31:57.220Z","updated":"2026-02-26T18:28:53.983Z","title":"Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Common SQL Provider","kev":false,"epss":0.00952,"kevAdded":null},{"id":"CVE-2024-53868","published":"2025-04-03T08:59:02.557Z","updated":"2025-04-18T14:38:03.477Z","title":"Apache Traffic Server: Malformed chunked message body allows request smuggling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00673,"kevAdded":null},{"id":"CVE-2025-30676","published":"2025-04-01T14:43:49.721Z","updated":"2025-04-02T22:03:27.945Z","title":"Apache OFBiz: Stored XSS Vulnerability","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.67607,"kevAdded":null},{"id":"CVE-2025-30177","published":"2025-04-01T11:56:30.484Z","updated":"2025-04-01T18:42:45.532Z","title":"Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01295,"kevAdded":null},{"id":"CVE-2024-56325","published":"2025-04-01T09:07:14.185Z","updated":"2025-10-27T17:11:08.160Z","title":"Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Pinot","kev":false,"epss":0.80212,"kevAdded":null},{"id":"CVE-2025-29868","published":"2025-04-01T07:56:28.633Z","updated":"2025-04-10T15:03:07.021Z","title":"Apache Answer: Using externally referenced images can leak user privacy.","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00973,"kevAdded":null},{"id":"CVE-2025-30065","published":"2025-04-01T07:53:42.993Z","updated":"2026-02-26T18:29:05.414Z","title":"Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Parquet Java","kev":false,"epss":0.43597,"kevAdded":null},{"id":"CVE-2025-27427","published":"2025-04-01T07:26:59.994Z","updated":"2025-04-02T22:03:20.210Z","title":"Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Artemis","kev":false,"epss":0.00653,"kevAdded":null},{"id":"CVE-2025-30067","published":"2025-03-27T15:06:36.598Z","updated":"2025-03-27T17:56:13.192Z","title":"Apache Kylin: The remote code execution via jdbc url","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00927,"kevAdded":null},{"id":"CVE-2024-48944","published":"2025-03-27T15:05:57.302Z","updated":"2025-05-08T10:26:40.785Z","title":"Apache Kylin: SSRF vulnerability in the diagnosis api","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00643,"kevAdded":null},{"id":"CVE-2024-53679","published":"2025-03-25T09:33:44.443Z","updated":"2025-03-31T16:22:35.005Z","title":"Apache VCL: XSS vulnerability in User Lookup impacting user privileges","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache VCL","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2024-53678","published":"2025-03-25T09:33:36.385Z","updated":"2025-03-31T16:23:19.825Z","title":"Apache VCL: SQL injection vulnerability in New Block Allocation form","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache VCL","kev":false,"epss":0.0062,"kevAdded":null},{"id":"CVE-2025-27553","published":"2025-03-23T14:16:20.363Z","updated":"2025-04-02T22:03:21.278Z","title":"Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons VFS","kev":false,"epss":0.01425,"kevAdded":null},{"id":"CVE-2025-30474","published":"2025-03-23T14:15:51.339Z","updated":"2025-04-01T18:04:55.401Z","title":"Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache Commons VFS","kev":false,"epss":0.00887,"kevAdded":null},{"id":"CVE-2025-26796","published":"2025-03-22T12:23:19.140Z","updated":"2025-03-24T14:05:19.477Z","title":"Apache Oozie: XSS in Oozie Web Console","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Oozie","kev":false,"epss":0.00532,"kevAdded":null},{"id":"CVE-2025-27888","published":"2025-03-20T11:29:00.730Z","updated":"2025-03-25T15:18:04.929Z","title":"Apache Druid: Server-Side Request Forgery and Cross-Site Scripting","severity":"MEDIUM","score":5.8,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.01791,"kevAdded":null},{"id":"CVE-2024-54016","published":"2025-03-20T08:59:26.175Z","updated":"2025-03-20T19:04:01.239Z","title":"compression bomb attack in Apache Seata Server","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Seata (incubating)","kev":false,"epss":0.00648,"kevAdded":null},{"id":"CVE-2024-47552","published":"2025-03-20T08:58:01.495Z","updated":"2026-03-30T08:35:40.674Z","title":"Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Seata (incubating)","kev":false,"epss":0.01246,"kevAdded":null},{"id":"CVE-2025-27018","published":"2025-03-19T09:06:07.220Z","updated":"2025-03-25T17:45:20.580Z","title":"Apache Airflow MySQL Provider: SQL injection in MySQL provider core function","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Airflow MySQL Provider","kev":false,"epss":0.00911,"kevAdded":null},{"id":"CVE-2025-27017","published":"2025-03-12T16:19:45.206Z","updated":"2025-03-12T17:56:14.825Z","title":"Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0125,"kevAdded":null},{"id":"CVE-2025-27867","published":"2025-03-12T15:51:24.965Z","updated":"2025-03-21T20:36:57.712Z","title":"Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin","severity":"MEDIUM","score":5.6,"vendor":"Apache Software Foundation","product":"Apache Felix HTTP Webconsole Plugin","kev":false,"epss":0.00571,"kevAdded":null},{"id":"CVE-2025-29891","published":"2025-03-12T14:42:59.644Z","updated":"2025-03-19T13:10:01.834Z","title":"Apache Camel: Camel Message Header Injection through request parameters","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.76087,"kevAdded":null},{"id":"CVE-2025-24813","published":"2025-03-10T16:44:03.715Z","updated":"2025-10-29T11:49:44.413Z","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":true,"epss":0.99942,"kevAdded":"2025-04-01"},{"id":"CVE-2025-26865","published":"2025-03-10T14:01:06.952Z","updated":"2025-03-11T19:26:51.972Z","title":"Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE","severity":"LOW","score":3.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.0066,"kevAdded":null},{"id":"CVE-2025-27636","published":"2025-03-09T12:09:58.619Z","updated":"2026-02-26T19:09:44.229Z","title":"Apache Camel: Camel Message Header Injection via Improper Filtering","severity":"MEDIUM","score":5.6,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.97057,"kevAdded":null},{"id":"CVE-2024-38311","published":"2025-03-06T11:34:16.289Z","updated":"2025-03-06T15:35:49.759Z","title":"Apache Traffic Server: Request smuggling via pipelining after a chunked message body","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00909,"kevAdded":null},{"id":"CVE-2024-56195","published":"2025-03-06T11:23:37.067Z","updated":"2025-03-06T15:37:24.745Z","title":"Apache Traffic Server: Intercept plugins are not access controlled","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00777,"kevAdded":null},{"id":"CVE-2024-56196","published":"2025-03-06T11:21:49.763Z","updated":"2025-03-06T15:37:59.338Z","title":"Apache Traffic Server: ACL is not fully compatible with older versions","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00777,"kevAdded":null},{"id":"CVE-2024-56202","published":"2025-03-06T11:09:11.632Z","updated":"2025-03-06T15:38:27.816Z","title":"Apache Traffic Server: Expect header field can unreasonably retain resource","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00871,"kevAdded":null},{"id":"CVE-2024-55532","published":"2025-03-03T16:04:54.856Z","updated":"2025-03-04T16:10:02.790Z","title":"Apache Ranger: Improper Neutralization of Formula Elements in a CSV File","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00814,"kevAdded":null},{"id":"CVE-2024-24778","published":"2025-03-03T10:37:04.509Z","updated":"2025-03-03T18:03:22.434Z","title":"Apache StreamPipes: Resources Permission Escalation","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2024-56180","published":"2025-02-14T13:34:26.600Z","updated":"2025-02-18T15:10:16.650Z","title":"Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache EventMesh","kev":false,"epss":0.00786,"kevAdded":null},{"id":"CVE-2024-52577","published":"2025-02-14T09:55:40.520Z","updated":"2025-02-14T17:02:36.182Z","title":"Apache Ignite: Possible RCE when deserializing incoming messages by the server node","severity":"CRITICAL","score":9.5,"vendor":"Apache Software Foundation","product":"Apache Ignite","kev":false,"epss":0.03131,"kevAdded":null},{"id":"CVE-2024-46910","published":"2025-02-13T08:52:57.498Z","updated":"2025-10-17T15:50:34.064Z","title":"Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.00569,"kevAdded":null},{"id":"CVE-2024-32838","published":"2025-02-12T09:44:15.943Z","updated":"2025-02-12T18:03:27.737Z","title":"Apache Fineract: SQL injection vulnerabilities in offices API endpoint","severity":"CRITICAL","score":9.4,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.01541,"kevAdded":null},{"id":"CVE-2025-25247","published":"2025-02-10T11:16:59.979Z","updated":"2025-02-10T14:40:10.467Z","title":"Apache Felix Webconsole: XSS in services console","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Felix Webconsole","kev":false,"epss":0.00694,"kevAdded":null},{"id":"CVE-2025-25069","published":"2025-02-07T12:46:11.350Z","updated":"2025-02-13T21:21:42.342Z","title":"Apache Kvrocks: Cross-Protocol Scripting Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kvrocks","kev":false,"epss":0.00806,"kevAdded":null},{"id":"CVE-2022-31764","published":"2025-02-06T14:23:03.166Z","updated":"2025-02-06T16:25:45.921Z","title":"Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBC","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache ShardingSphere ElasticJob-UI","kev":false,"epss":0.00683,"kevAdded":null},{"id":"CVE-2024-37358","published":"2025-02-06T11:22:38.260Z","updated":"2025-09-01T09:40:18.781Z","title":"Apache James: denial of service through the use of IMAP literals","severity":"HIGH","score":8.6,"vendor":"Apache Software Foundation","product":"Apache James server","kev":false,"epss":0.00888,"kevAdded":null},{"id":"CVE-2024-45626","published":"2025-02-06T11:21:12.417Z","updated":"2025-02-12T19:51:10.343Z","title":"Apache James: denial of service through JMAP HTML to text conversion","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache James server","kev":false,"epss":0.00798,"kevAdded":null},{"id":"CVE-2024-48019","published":"2025-02-04T18:19:52.467Z","updated":"2025-02-07T21:20:37.526Z","title":"Apache Doris: allows admin users to read arbitrary files through the REST API","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.01031,"kevAdded":null},{"id":"CVE-2024-27137","published":"2025-02-04T10:19:44.109Z","updated":"2025-02-15T00:10:33.257Z","title":"Apache Cassandra: unrestricted deserialization of JMX authentication credentials","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.00281,"kevAdded":null},{"id":"CVE-2025-24860","published":"2025-02-04T10:17:55.258Z","updated":"2025-02-15T00:10:37.682Z","title":"Apache Cassandra: CassandraNetworkAuthorizer and CassandraCIDRAuthorizer can be bypassed allowing access to different network regions","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.01095,"kevAdded":null},{"id":"CVE-2025-23015","published":"2025-02-04T09:37:18.580Z","updated":"2025-02-15T00:10:34.356Z","title":"Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.0101,"kevAdded":null},{"id":"CVE-2024-29869","published":"2025-01-28T21:31:43.422Z","updated":"2025-01-29T14:26:24.306Z","title":"Apache Hive: Credentials file created with non restrictive permissions","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2024-23953","published":"2025-01-28T09:07:22.333Z","updated":"2025-03-14T15:44:14.787Z","title":"Apache Hive: Timing Attack Against Signature in LLAP util","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01426,"kevAdded":null},{"id":"CVE-2025-24783","published":"2025-01-27T14:47:42.845Z","updated":"2025-01-28T15:19:04.224Z","title":"Apache Cocoon: continuations may not be private","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.00846,"kevAdded":null},{"id":"CVE-2025-24814","published":"2025-01-27T08:58:08.768Z","updated":"2025-02-15T00:10:36.558Z","title":"Apache Solr: Core-creation with \"trusted\" configset can use arbitrary untrusted files","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2024-52012","published":"2025-01-27T08:54:42.907Z","updated":"2025-02-06T16:11:37.353Z","title":"Apache Solr: Configset upload on Windows allows arbitrary path write-access","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.47121,"kevAdded":null},{"id":"CVE-2024-53299","published":"2025-01-23T08:37:05.687Z","updated":"2025-02-04T18:52:25.991Z","title":"Apache Wicket: An attacker can intentionally trigger a memory leak","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.01502,"kevAdded":null},{"id":"CVE-2024-45479","published":"2025-01-21T21:26:16.500Z","updated":"2025-06-10T09:06:33.435Z","title":"Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00687,"kevAdded":null},{"id":"CVE-2024-45478","published":"2025-01-21T21:25:58.276Z","updated":"2025-06-10T09:05:27.590Z","title":"Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.00607,"kevAdded":null},{"id":"CVE-2024-51941","published":"2025-01-21T21:24:23.360Z","updated":"2025-09-03T08:07:55.364Z","title":"Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01488,"kevAdded":null},{"id":"CVE-2025-23196","published":"2025-01-21T21:23:41.389Z","updated":"2025-02-03T08:22:56.454Z","title":"Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01294,"kevAdded":null},{"id":"CVE-2025-23195","published":"2025-01-21T21:22:33.286Z","updated":"2025-01-22T14:49:46.312Z","title":"Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.008,"kevAdded":null},{"id":"CVE-2025-23184","published":"2025-01-21T09:35:37.468Z","updated":"2025-12-15T15:58:16.867Z","title":"Apache CXF: Denial of Service vulnerability with temporary files","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.02194,"kevAdded":null},{"id":"CVE-2024-45627","published":"2025-01-14T16:13:20.135Z","updated":"2025-01-14T17:19:09.863Z","title":"Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Linkis Metadata Query Service JDBC","kev":false,"epss":0.00327,"kevAdded":null},{"id":"CVE-2025-22828","published":"2025-01-13T12:47:51.619Z","updated":"2025-01-13T19:02:32.935Z","title":"Apache CloudStack: Unauthorised access to annotations","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.02054,"kevAdded":null},{"id":"CVE-2024-45033","published":"2025-01-08T08:41:39.579Z","updated":"2025-01-08T13:59:37.707Z","title":"Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow Fab Provider","kev":false,"epss":0.00988,"kevAdded":null},{"id":"CVE-2024-54676","published":"2025-01-08T08:40:03.705Z","updated":"2025-01-08T14:00:52.923Z","title":"Apache OpenMeetings: Deserialisation of untrusted data in cluster mode","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.68777,"kevAdded":null},{"id":"CVE-2024-56512","published":"2024-12-28T16:18:46.112Z","updated":"2024-12-30T16:12:25.287Z","title":"Apache NiFi: Missing Complete Authorization for Parameter and Service References","severity":"LOW","score":2.1,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03268,"kevAdded":null},{"id":"CVE-2024-52046","published":"2024-12-25T10:06:23.887Z","updated":"2025-08-02T03:55:42.727Z","title":"Apache MINA: MINA applications using unbounded deserialization may allow RCE","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.24366,"kevAdded":null},{"id":"CVE-2024-43441","published":"2024-12-24T11:59:59.219Z","updated":"2024-12-31T18:47:44.461Z","title":"Apache HugeGraph-Server: Fixed JWT Token(Secret)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HugeGraph-Server","kev":false,"epss":0.72777,"kevAdded":null},{"id":"CVE-2024-45387","published":"2024-12-23T15:30:13.873Z","updated":"2024-12-24T01:47:40.228Z","title":"Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments","severity":"CRITICAL","score":9.9,"vendor":"Apache Software Foundation","product":"Apache Traffic Control","kev":false,"epss":0.65441,"kevAdded":null},{"id":"CVE-2024-23945","published":"2024-12-23T15:26:54.477Z","updated":"2025-03-19T13:34:26.019Z","title":"Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.0155,"kevAdded":null},{"id":"CVE-2024-56337","published":"2024-12-20T15:28:54.738Z","updated":"2025-11-04T15:59:21.843Z","title":"Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.08969,"kevAdded":null},{"id":"CVE-2024-56128","published":"2024-12-18T13:38:03.068Z","updated":"2024-12-18T17:02:47.926Z","title":"Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.00817,"kevAdded":null},{"id":"CVE-2024-54677","published":"2024-12-17T12:35:50.948Z","updated":"2025-11-03T19:32:11.848Z","title":"Apache Tomcat: DoS in examples web application","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01939,"kevAdded":null},{"id":"CVE-2024-50379","published":"2024-12-17T12:34:54.827Z","updated":"2026-11-04T00:07:07.076Z","title":"Apache Tomcat: RCE due to TOCTOU issue in JSP compilation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.31824,"kevAdded":null},{"id":"CVE-2024-55633","published":"2024-12-12T14:36:02.325Z","updated":"2025-02-12T09:35:43.626Z","title":"Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.02806,"kevAdded":null},{"id":"CVE-2024-53677","published":"2024-12-11T15:35:43.389Z","updated":"2026-11-04T00:07:36.407Z","title":"Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks","severity":"CRITICAL","score":9.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.72367,"kevAdded":null},{"id":"CVE-2024-53949","published":"2024-12-09T13:35:41.530Z","updated":"2025-02-12T09:34:57.804Z","title":"Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2024-53948","published":"2024-12-09T13:35:30.932Z","updated":"2024-12-09T18:03:42.140Z","title":"Apache Superset: Error verbosity exposes metadata in analytics databases","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00855,"kevAdded":null},{"id":"CVE-2024-53947","published":"2024-12-09T13:35:09.910Z","updated":"2024-12-09T15:05:21.361Z","title":"Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions","severity":"LOW","score":2.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00836,"kevAdded":null},{"id":"CVE-2024-46901","published":"2024-12-09T09:36:52.445Z","updated":"2025-04-13T21:02:57.347Z","title":"Apache Subversion: mod_dav_svn denial-of-service via control characters in paths","severity":"LOW","score":3.1,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.0193,"kevAdded":null},{"id":"CVE-2022-41137","published":"2024-12-05T10:01:41.692Z","updated":"2024-12-05T17:02:05.659Z","title":"Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01645,"kevAdded":null},{"id":"CVE-2024-45106","published":"2024-12-03T09:06:23.356Z","updated":"2024-12-03T15:52:28.971Z","title":"Apache Ozone: Improper authentication when generating S3 secrets","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.00576,"kevAdded":null},{"id":"CVE-2024-52338","published":"2024-11-28T16:31:44.087Z","updated":"2024-11-29T15:09:43.928Z","title":"Apache Arrow R package: Arbitrary code execution when loading a malicious data file","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Arrow R package","kev":false,"epss":0.02326,"kevAdded":null},{"id":"CVE-2024-51569","published":"2024-11-26T11:17:56.337Z","updated":"2024-12-06T10:16:33.111Z","title":"Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.01239,"kevAdded":null},{"id":"CVE-2024-47250","published":"2024-11-26T11:17:19.568Z","updated":"2024-12-06T10:16:02.631Z","title":"Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2024-47249","published":"2024-11-26T11:16:35.626Z","updated":"2024-12-06T10:15:23.820Z","title":"Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00622,"kevAdded":null},{"id":"CVE-2024-47248","published":"2024-11-26T11:15:46.394Z","updated":"2024-12-06T10:14:24.864Z","title":"Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.00721,"kevAdded":null},{"id":"CVE-2024-45719","published":"2024-11-22T14:36:44.588Z","updated":"2024-11-22T20:18:15.264Z","title":"Apache Answer: Predictable Authorization Token Using UUIDv1","severity":"LOW","score":2.6,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00263,"kevAdded":null},{"id":"CVE-2024-52067","published":"2024-11-21T09:28:43.910Z","updated":"2024-11-21T15:37:48.210Z","title":"Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log","severity":"MEDIUM","score":6.9,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00733,"kevAdded":null},{"id":"CVE-2024-31141","published":"2024-11-19T08:40:50.695Z","updated":"2025-01-31T15:02:44.982Z","title":"Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kafka Clients","kev":false,"epss":0.0133,"kevAdded":null},{"id":"CVE-2024-52318","published":"2024-11-18T12:21:39.170Z","updated":"2025-01-31T15:02:49.374Z","title":"Apache Tomcat: Incorrect JSP tag recycling leads to XSS","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01879,"kevAdded":null},{"id":"CVE-2024-52317","published":"2024-11-18T11:36:51.963Z","updated":"2025-01-24T20:03:10.485Z","title":"Apache Tomcat: Request/response mix-up with HTTP/2","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02097,"kevAdded":null},{"id":"CVE-2024-52316","published":"2024-11-18T11:32:22.072Z","updated":"2025-11-04T15:59:51.152Z","title":"Apache Tomcat: Authentication bypass when using Jakarta Authentication API","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.06246,"kevAdded":null},{"id":"CVE-2024-41151","published":"2024-11-18T08:45:49.288Z","updated":"2024-11-18T15:07:22.821Z","title":"Apache HertzBeat: RCE by notice template injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.00983,"kevAdded":null},{"id":"CVE-2024-45791","published":"2024-11-18T08:45:23.459Z","updated":"2024-11-18T15:04:55.582Z","title":"Apache HertzBeat: Exposure sensitive token via http GET method with query string","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.00848,"kevAdded":null},{"id":"CVE-2024-45505","published":"2024-11-18T08:44:46.165Z","updated":"2024-11-18T15:05:53.026Z","title":"Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.0221,"kevAdded":null},{"id":"CVE-2024-47208","published":"2024-11-18T08:43:17.743Z","updated":"2024-11-19T14:59:02.765Z","title":"Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.01598,"kevAdded":null},{"id":"CVE-2024-48962","published":"2024-11-18T08:41:30.545Z","updated":"2026-05-04T14:55:28.249Z","title":"Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)","severity":"HIGH","score":8.9,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.00646,"kevAdded":null},{"id":"CVE-2024-45784","published":"2024-11-15T08:20:05.581Z","updated":"2024-11-15T19:42:27.561Z","title":"Apache Airflow: Sensitive configuration values are not masked in the logs by default","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01341,"kevAdded":null},{"id":"CVE-2024-50306","published":"2024-11-14T09:55:43.037Z","updated":"2025-11-03T20:45:12.036Z","title":"Apache Traffic Server: Server process can fail to drop privilege","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01569,"kevAdded":null},{"id":"CVE-2024-50305","published":"2024-11-14T09:54:20.652Z","updated":"2024-11-14T18:15:38.823Z","title":"Apache Traffic Server: Valid Host field value can cause crashes","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00927,"kevAdded":null},{"id":"CVE-2024-38479","published":"2024-11-14T09:52:14.291Z","updated":"2025-11-03T20:38:05.702Z","title":"Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00823,"kevAdded":null},{"id":"CVE-2024-50386","published":"2024-11-12T14:34:08.537Z","updated":"2024-11-12T20:06:52.571Z","title":"Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.01472,"kevAdded":null},{"id":"CVE-2024-50378","published":"2024-11-08T14:37:09.699Z","updated":"2024-11-08T19:02:35.081Z","title":"Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01243,"kevAdded":null},{"id":"CVE-2024-51504","published":"2024-11-07T09:52:03.957Z","updated":"2024-11-07T16:33:08.247Z","title":"Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00918,"kevAdded":null},{"id":"CVE-2024-38286","published":"2024-11-07T07:37:32.224Z","updated":"2025-11-03T20:38:04.247Z","title":"Apache Tomcat: Denial of Service","severity":"HIGH","score":8.6,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0169,"kevAdded":null},{"id":"CVE-2024-23590","published":"2024-11-04T09:27:06.050Z","updated":"2024-11-05T14:50:24.558Z","title":"Apache Kylin: Session fixation in web interface","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.00667,"kevAdded":null},{"id":"CVE-2024-43383","published":"2024-10-31T09:57:29.062Z","updated":"2024-10-31T13:52:47.181Z","title":"Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache Lucene.Net.Replicator","kev":false,"epss":0.0119,"kevAdded":null},{"id":"CVE-2024-45477","published":"2024-10-29T09:00:08.387Z","updated":"2024-10-29T14:51:54.639Z","title":"Apache NiFi: Improper Neutralization of Input in Parameter Description","severity":"MEDIUM","score":4.6,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0075,"kevAdded":null},{"id":"CVE-2024-45031","published":"2024-10-24T14:21:35.279Z","updated":"2025-09-01T09:41:29.319Z","title":"Apache Syncope: Stored XSS in Console and Enduser","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00708,"kevAdded":null},{"id":"CVE-2024-45219","published":"2024-10-16T07:55:02.534Z","updated":"2024-10-16T14:48:18.087Z","title":"Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2024-45461","published":"2024-10-16T07:54:15.484Z","updated":"2025-02-21T16:53:10.585Z","title":"Apache CloudStack Quota plugin: Access checks not enforced in Quota","severity":"MEDIUM","score":5.7,"vendor":"Apache Software Foundation","product":"Apache CloudStack Quota plugin","kev":false,"epss":0.00772,"kevAdded":null},{"id":"CVE-2024-45462","published":"2024-10-16T07:53:40.129Z","updated":"2024-10-16T14:54:34.977Z","title":"Apache CloudStack: Incomplete session invalidation on web interface logout","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2024-45693","published":"2024-10-16T07:52:25.816Z","updated":"2024-10-16T14:57:41.020Z","title":"Apache CloudStack: Request origin validation bypass makes account takeover possible","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.0055,"kevAdded":null},{"id":"CVE-2024-45217","published":"2024-10-16T07:51:16.558Z","updated":"2024-10-16T15:08:26.625Z","title":"Apache Solr: ConfigSets created during a backup restore command are trusted implicitly","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.00748,"kevAdded":null},{"id":"CVE-2024-45216","published":"2024-10-16T07:50:25.965Z","updated":"2024-11-08T04:55:08.457Z","title":"Apache Solr: Authentication bypass possible using a fake URL Path ending","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.92747,"kevAdded":null},{"id":"CVE-2023-50780","published":"2024-10-14T16:03:38.321Z","updated":"2025-03-19T20:11:35.774Z","title":"Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Artemis","kev":false,"epss":0.17457,"kevAdded":null},{"id":"CVE-2024-46911","published":"2024-10-14T08:13:05.578Z","updated":"2024-11-01T17:06:11.070Z","title":"Apache Roller: Weakness in CSRF protection allows privilege escalation","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00447,"kevAdded":null},{"id":"CVE-2024-45720","published":"2024-10-09T12:38:28.971Z","updated":"2024-10-09T13:27:02.868Z","title":"Apache Subversion: Command line argument injection on Windows platforms","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.00611,"kevAdded":null},{"id":"CVE-2024-28168","published":"2024-10-09T12:04:03.835Z","updated":"2024-10-09T15:02:59.140Z","title":"Apache XML Graphics FOP: XML External Entity (XXE) Processing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XML Graphics FOP","kev":false,"epss":0.01038,"kevAdded":null},{"id":"CVE-2024-47554","published":"2024-10-03T11:32:48.936Z","updated":"2025-01-31T15:02:47.229Z","title":"Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Commons IO","kev":false,"epss":0.01315,"kevAdded":null},{"id":"CVE-2024-47561","published":"2024-10-03T10:23:16.214Z","updated":"2024-10-21T08:51:22.972Z","title":"Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)","severity":"CRITICAL","score":9.2,"vendor":"Apache Software Foundation","product":"Apache Avro Java SDK","kev":false,"epss":0.03256,"kevAdded":null},{"id":"CVE-2024-45772","published":"2024-09-30T08:51:30.950Z","updated":"2024-12-12T16:22:31.991Z","title":"Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue","severity":"MEDIUM","score":5.1,"vendor":"Apache Software Foundation","product":"Apache Lucene Replicator","kev":false,"epss":0.00582,"kevAdded":null},{"id":"CVE-2024-47197","published":"2024-09-26T08:01:24.486Z","updated":"2025-03-17T17:36:10.410Z","title":"Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Maven Archetype Plugin","kev":false,"epss":0.00839,"kevAdded":null},{"id":"CVE-2024-23454","published":"2024-09-25T07:45:43.496Z","updated":"2025-09-05T09:09:36.997Z","title":"Apache Hadoop: Temporary File Local Information Disclosure","severity":"MEDIUM","score":6.2,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.00407,"kevAdded":null},{"id":"CVE-2024-40761","published":"2024-09-25T07:31:08.416Z","updated":"2024-09-27T19:02:34.376Z","title":"Apache Answer: Avatar URL leaked user email addresses","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2024-39928","published":"2024-09-24T07:27:55.376Z","updated":"2024-09-24T15:02:39.880Z","title":"Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Linkis Spark EngineConn","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2024-46544","published":"2024-09-23T10:43:57.123Z","updated":"2024-10-31T19:59:53.770Z","title":"Apache Tomcat Connectors: mod_jk: local users can view and modify configuration","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat Connectors","kev":false,"epss":0.00326,"kevAdded":null},{"id":"CVE-2024-42323","published":"2024-09-21T09:30:15.295Z","updated":"2024-09-23T15:23:37.578Z","title":"Apache HertzBeat: RCE by snakeYaml deser load malicious xml","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache HertzBeat","kev":false,"epss":0.08322,"kevAdded":null},{"id":"CVE-2024-45537","published":"2024-09-17T18:37:49.823Z","updated":"2025-03-14T15:09:00.250Z","title":"Apache Druid: Users can provide MySQL JDBC properties not on allow list","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.00626,"kevAdded":null},{"id":"CVE-2024-45384","published":"2024-09-17T18:36:00.411Z","updated":"2025-03-14T19:45:27.172Z","title":"Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.00821,"kevAdded":null},{"id":"CVE-2024-22399","published":"2024-09-16T11:42:05.469Z","updated":"2024-09-16T18:06:33.948Z","title":"Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Seata","kev":false,"epss":0.03286,"kevAdded":null},{"id":"CVE-2024-45034","published":"2024-09-07T07:45:27.654Z","updated":"2024-09-09T13:55:13.683Z","title":"Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01688,"kevAdded":null},{"id":"CVE-2024-45498","published":"2024-09-07T07:43:43.899Z","updated":"2024-11-04T16:24:53.972Z","title":"Apache Airflow: Command Injection in an example DAG","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01237,"kevAdded":null},{"id":"CVE-2024-45195","published":"2024-09-04T08:08:59.201Z","updated":"2025-10-21T22:55:46.145Z","title":"Apache OFBiz: Confused controller-view authorization logic (forced browsing)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":true,"epss":0.99983,"kevAdded":"2025-02-04"},{"id":"CVE-2024-45507","published":"2024-09-04T08:08:33.876Z","updated":"2024-09-13T03:55:20.597Z","title":"Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.96357,"kevAdded":null},{"id":"CVE-2023-49582","published":"2024-08-26T14:03:44.588Z","updated":"2025-03-13T14:25:56.517Z","title":"Apache Portable Runtime (APR): Unexpected lax shared memory permissions","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime (APR)","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2024-41937","published":"2024-08-21T15:31:13.962Z","updated":"2025-03-20T20:22:38.511Z","title":"Apache Airflow: Stored XSS Vulnerability on provider link","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0173,"kevAdded":null},{"id":"CVE-2023-49198","published":"2024-08-21T09:37:57.478Z","updated":"2024-08-23T13:04:21.616Z","title":"Apache SeaTunnel Web: Arbitrary file read vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache SeaTunnel Web","kev":false,"epss":0.00934,"kevAdded":null},{"id":"CVE-2024-22281","published":"2024-08-20T22:11:38.598Z","updated":"2024-08-21T13:22:02.143Z","title":"Apache Helix Front (UI): Helix front hard-coded secret in the express-session","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Helix Front (UI)","kev":false,"epss":0.00726,"kevAdded":null},{"id":"CVE-2024-43202","published":"2024-08-20T07:29:43.170Z","updated":"2024-08-20T15:02:42.396Z","title":"Apache DolphinScheduler: Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.02149,"kevAdded":null},{"id":"CVE-2024-41909","published":"2024-08-12T16:00:29.568Z","updated":"2025-03-27T15:31:20.659Z","title":"Apache MINA SSHD: integrity check bypass","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.00581,"kevAdded":null},{"id":"CVE-2024-41888","published":"2024-08-09T14:55:14.493Z","updated":"2025-03-13T19:53:24.691Z","title":"Apache Answer: The link for resetting user password is not Single-Use","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.01222,"kevAdded":null},{"id":"CVE-2024-41890","published":"2024-08-09T14:53:28.544Z","updated":"2025-03-13T18:27:24.551Z","title":"Apache Answer: The link to reset the user's password will remain valid after sending a new link","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.01149,"kevAdded":null},{"id":"CVE-2024-30188","published":"2024-08-09T14:23:27.823Z","updated":"2025-03-13T14:01:49.238Z","title":"Apache DolphinScheduler: Resource File Read And Write Vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.05987,"kevAdded":null},{"id":"CVE-2024-29831","published":"2024-08-09T14:21:48.184Z","updated":"2024-08-12T17:49:00.242Z","title":"Apache DolphinScheduler: RCE by arbitrary js execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01175,"kevAdded":null},{"id":"CVE-2024-42062","published":"2024-08-07T07:17:08.811Z","updated":"2024-09-03T19:58:27.161Z","title":"Apache CloudStack: User Key Exposure to Domain Admins","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00946,"kevAdded":null},{"id":"CVE-2024-42222","published":"2024-08-07T07:16:13.765Z","updated":"2025-03-14T15:57:32.158Z","title":"Apache CloudStack: Unauthorised Network List Access","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00972,"kevAdded":null},{"id":"CVE-2024-36448","published":"2024-08-05T09:53:38.194Z","updated":"2025-03-13T14:22:04.554Z","title":"Apache IoTDB Workbench: SSRF Vulnerability (EOL)","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache IoTDB Workbench","kev":false,"epss":0.007,"kevAdded":null},{"id":"CVE-2024-38856","published":"2024-08-05T08:20:18.081Z","updated":"2025-10-21T22:55:48.822Z","title":"Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":true,"epss":0.99427,"kevAdded":"2024-08-27"},{"id":"CVE-2024-42447","published":"2024-08-05T08:02:31.921Z","updated":"2025-03-19T14:39:15.524Z","title":"Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Providers FAB","kev":false,"epss":0.00929,"kevAdded":null},{"id":"CVE-2024-36268","published":"2024-08-02T09:44:26.237Z","updated":"2024-08-22T19:40:19.635Z","title":"Apache InLong TubeMQ Client: Remote Code Execution vulnerability","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache InLong TubeMQ Client","kev":false,"epss":0.01173,"kevAdded":null},{"id":"CVE-2024-27182","published":"2024-08-02T09:29:33.391Z","updated":"2025-03-27T15:48:58.051Z","title":"Apache Linkis  Basic management services: Engine material management Arbitrary file deletion vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Linkis  Basic management services","kev":false,"epss":0.00737,"kevAdded":null},{"id":"CVE-2024-27181","published":"2024-08-02T09:27:48.639Z","updated":"2024-08-12T19:53:28.790Z","title":"Apache Linkis Basic management services: Privilege Escalation Attack vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Linkis Basic management services","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2023-48396","published":"2024-07-30T08:15:33.731Z","updated":"2025-02-13T17:18:18.107Z","title":"Apache SeaTunnel Web: Authentication bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache SeaTunnel Web","kev":false,"epss":0.00722,"kevAdded":null},{"id":"CVE-2023-38522","published":"2024-07-26T09:11:20.419Z","updated":"2025-11-03T21:49:13.216Z","title":"Apache Traffic Server: Incomplete field name check allows request smuggling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.00987,"kevAdded":null},{"id":"CVE-2024-35296","published":"2024-07-26T09:11:11.221Z","updated":"2025-11-03T21:55:00.755Z","title":"Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01085,"kevAdded":null},{"id":"CVE-2024-35161","published":"2024-07-26T09:10:56.281Z","updated":"2025-11-03T21:54:57.527Z","title":"Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0097,"kevAdded":null},{"id":"CVE-2024-25090","published":"2024-07-26T08:36:47.021Z","updated":"2025-03-14T16:11:12.779Z","title":"Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2023-48362","published":"2024-07-24T07:45:43.686Z","updated":"2025-02-13T17:18:17.319Z","title":"Apache Drill: XXE Vulnerability in XML Format Reader","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Drill","kev":false,"epss":0.00754,"kevAdded":null},{"id":"CVE-2024-39676","published":"2024-07-24T07:41:09.856Z","updated":"2025-03-14T17:19:59.450Z","title":"Apache Pinot: Unauthorized endpoint exposed sensitive information","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Pinot","kev":false,"epss":0.00846,"kevAdded":null},{"id":"CVE-2024-41178","published":"2024-07-23T16:50:10.093Z","updated":"2024-08-13T20:31:54.957Z","title":"Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Arrow Rust Object Store","kev":false,"epss":0.0071,"kevAdded":null},{"id":"CVE-2024-29070","published":"2024-07-23T08:13:41.408Z","updated":"2024-09-13T17:04:30.274Z","title":"Apache StreamPark: session not invalidated after logout","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00788,"kevAdded":null},{"id":"CVE-2024-34457","published":"2024-07-22T09:48:23.130Z","updated":"2024-11-04T21:27:42.331Z","title":"Apache StreamPark IDOR Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2024-38503","published":"2024-07-22T09:46:39.285Z","updated":"2024-12-06T21:48:36.234Z","title":"Apache Syncope: HTML tags can be injected into Console or Enduser text fields","severity":"LOW","score":3.9,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.00708,"kevAdded":null},{"id":"CVE-2024-23321","published":"2024-07-22T09:24:15.807Z","updated":"2025-02-13T17:39:41.709Z","title":"Apache RocketMQ: Unauthorized Exposure of Sensitive Data","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache RocketMQ","kev":false,"epss":0.0089,"kevAdded":null},{"id":"CVE-2024-41107","published":"2024-07-19T10:19:53.995Z","updated":"2025-03-19T18:31:21.603Z","title":"Apache CloudStack: SAML Signature Exclusion","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.1776,"kevAdded":null},{"id":"CVE-2024-41172","published":"2024-07-19T08:50:43.766Z","updated":"2024-09-13T17:05:12.209Z","title":"Apache CXF: Unrestricted memory consumption in CXF HTTP clients","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.01197,"kevAdded":null},{"id":"CVE-2024-32007","published":"2024-07-19T08:50:31.832Z","updated":"2024-09-13T17:04:44.644Z","title":"Apache CXF Denial of Service vulnerability in JOSE","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.01314,"kevAdded":null},{"id":"CVE-2024-29736","published":"2024-07-19T08:50:08.265Z","updated":"2024-11-15T13:08:15.763Z","title":"Apache CXF: SSRF vulnerability via WADL stylesheet parameter","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.01066,"kevAdded":null},{"id":"CVE-2024-29178","published":"2024-07-18T11:15:56.706Z","updated":"2025-02-13T17:47:39.338Z","title":"Apache StreamPark: FreeMarker SSTI RCE Vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.01239,"kevAdded":null},{"id":"CVE-2024-40725","published":"2024-07-18T09:32:43.929Z","updated":"2025-03-14T17:27:57.926Z","title":"Apache HTTP Server: source code disclosure with handlers configured via AddType","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.04417,"kevAdded":null},{"id":"CVE-2024-40898","published":"2024-07-18T09:32:06.990Z","updated":"2024-09-13T17:05:09.541Z","title":"Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01628,"kevAdded":null},{"id":"CVE-2024-29120","published":"2024-07-17T14:59:04.540Z","updated":"2025-02-13T17:47:37.551Z","title":"Apache StreamPark: Information leakage vulnerability","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache StreamPark","kev":false,"epss":0.00282,"kevAdded":null},{"id":"CVE-2024-31411","published":"2024-07-17T09:22:08.507Z","updated":"2024-09-13T17:04:42.752Z","title":"Apache StreamPipes: Potential remote code execution (RCE) via file upload","severity":"MEDIUM","score":6,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.01106,"kevAdded":null},{"id":"CVE-2024-31979","published":"2024-07-17T09:04:47.677Z","updated":"2024-09-13T17:04:43.686Z","title":"Apache StreamPipes: Possibility of SSRF in pipeline element installation process","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.00738,"kevAdded":null},{"id":"CVE-2024-30471","published":"2024-07-17T09:01:52.214Z","updated":"2024-09-13T17:04:36.497Z","title":"Apache StreamPipes: Potential creation of multiple identical accounts","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.0066,"kevAdded":null},{"id":"CVE-2024-29737","published":"2024-07-17T08:21:12.035Z","updated":"2025-02-13T17:47:42.503Z","title":"Apache StreamPark (incubating): maven build params could trigger remote command execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.01117,"kevAdded":null},{"id":"CVE-2023-52291","published":"2024-07-17T08:16:12.520Z","updated":"2025-02-13T17:20:01.487Z","title":"Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.01607,"kevAdded":null},{"id":"CVE-2024-39877","published":"2024-07-17T07:54:24.338Z","updated":"2026-11-04T00:02:36.469Z","title":"Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01726,"kevAdded":null},{"id":"CVE-2024-39863","published":"2024-07-17T07:53:31.820Z","updated":"2024-09-13T17:05:03.928Z","title":"Apache Airflow: Potential XSS Vulnerability","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00996,"kevAdded":null},{"id":"CVE-2024-39887","published":"2024-07-16T09:20:10.688Z","updated":"2025-02-13T17:53:20.299Z","title":"Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.04433,"kevAdded":null},{"id":"CVE-2023-52290","published":"2024-07-16T07:37:38.660Z","updated":"2024-09-13T17:04:01.780Z","title":"Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.00639,"kevAdded":null},{"id":"CVE-2023-49566","published":"2024-07-15T07:56:51.500Z","updated":"2025-03-27T15:35:11.826Z","title":"Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Linkis DataSource","kev":false,"epss":0.00845,"kevAdded":null},{"id":"CVE-2023-46801","published":"2024-07-15T07:55:29.702Z","updated":"2024-09-13T17:03:56.293Z","title":"Apache Linkis DataSource: DataSource Remote code execution vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Linkis DataSource","kev":false,"epss":0.01228,"kevAdded":null},{"id":"CVE-2023-41916","published":"2024-07-15T07:53:57.843Z","updated":"2025-03-14T15:16:15.724Z","title":"Apache Linkis DataSource: DatasourceManager module has a  JDBC parameter judgment logic vulnerability that allows for arbitrary file reading","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Linkis DataSource","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2024-36522","published":"2024-07-12T12:13:51.884Z","updated":"2025-02-13T17:52:57.312Z","title":"Apache Wicket: Remote code execution via XSLT injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.02127,"kevAdded":null},{"id":"CVE-2024-37389","published":"2024-07-08T07:29:00.146Z","updated":"2024-09-13T17:04:52.641Z","title":"Apache NiFi: Improper Neutralization of Input in Parameter Context Description","severity":"MEDIUM","score":4.6,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.24031,"kevAdded":null},{"id":"CVE-2024-38346","published":"2024-07-05T13:40:57.246Z","updated":"2025-02-13T17:53:05.631Z","title":"Apache CloudStack: Unauthenticated cluster service port leads to remote execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.03301,"kevAdded":null},{"id":"CVE-2024-39864","published":"2024-07-05T13:40:37.937Z","updated":"2025-03-19T14:44:07.745Z","title":"Apache CloudStack: Integration API service uses dynamic port when disabled","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.01772,"kevAdded":null},{"id":"CVE-2024-39884","published":"2024-07-04T08:36:49.772Z","updated":"2025-02-13T17:53:19.719Z","title":"Apache HTTP Server: source code disclosure with handlers configured via AddType","severity":"MEDIUM","score":6.2,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.00889,"kevAdded":null},{"id":"CVE-2024-34750","published":"2024-07-03T19:32:34.695Z","updated":"2025-11-03T19:29:53.932Z","title":"Apache Tomcat: HTTP/2 excess header handling DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.04602,"kevAdded":null},{"id":"CVE-2024-39573","published":"2024-07-01T18:16:44.297Z","updated":"2025-11-03T21:56:32.361Z","title":"Apache HTTP Server: mod_rewrite proxy handler substitution","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.35447,"kevAdded":null},{"id":"CVE-2024-38477","published":"2024-07-01T18:16:11.935Z","updated":"2025-11-03T21:55:44.577Z","title":"Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.03153,"kevAdded":null},{"id":"CVE-2024-38476","published":"2024-07-01T18:15:40.071Z","updated":"2025-11-03T21:55:42.872Z","title":"Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.41611,"kevAdded":null},{"id":"CVE-2024-38475","published":"2024-07-01T18:15:12.292Z","updated":"2025-11-03T21:55:40.951Z","title":"Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":true,"epss":0.99957,"kevAdded":"2025-05-01"},{"id":"CVE-2024-38474","published":"2024-07-01T18:14:47.004Z","updated":"2025-03-25T18:24:03.613Z","title":"Apache HTTP Server weakness with encoded question marks in backreferences","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.02456,"kevAdded":null},{"id":"CVE-2024-38473","published":"2024-07-01T18:14:21.520Z","updated":"2025-02-13T17:53:12.372Z","title":"Apache HTTP Server proxy encoding problem","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.25878,"kevAdded":null},{"id":"CVE-2024-38472","published":"2024-07-01T18:12:27.616Z","updated":"2026-11-04T00:01:23.425Z","title":"Apache HTTP Server on WIndows UNC SSRF","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.6947,"kevAdded":null},{"id":"CVE-2024-36387","published":"2024-07-01T18:10:25.512Z","updated":"2025-02-13T17:52:53.571Z","title":"Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01715,"kevAdded":null},{"id":"CVE-2024-29868","published":"2024-06-24T09:59:39.941Z","updated":"2024-09-13T16:03:11.423Z","title":"Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.05995,"kevAdded":null},{"id":"CVE-2024-27136","published":"2024-06-24T07:44:30.732Z","updated":"2025-03-20T18:03:19.410Z","title":"Apache JSPWiki: Cross-site scripting vulnerability on upload page","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.60846,"kevAdded":null},{"id":"CVE-2024-38379","published":"2024-06-22T09:09:32.464Z","updated":"2025-03-19T14:35:10.998Z","title":"Apache Allura: Stored authenticated XSS","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2024-34693","published":"2024-06-20T08:51:55.329Z","updated":"2025-02-21T16:55:58.529Z","title":"Apache Superset: Server arbitrary file read","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01584,"kevAdded":null},{"id":"CVE-2024-25142","published":"2024-06-14T08:25:35.633Z","updated":"2025-03-20T19:18:38.244Z","title":"Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00321,"kevAdded":null},{"id":"CVE-2024-36265","published":"2024-06-12T14:12:11.078Z","updated":"2026-07-14T09:56:46.782Z","title":"Apache Submarine Server Core: authorization bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Submarine Server Core","kev":false,"epss":0.00744,"kevAdded":null},{"id":"CVE-2024-36264","published":"2024-06-12T14:06:31.545Z","updated":"2025-03-20T19:07:12.124Z","title":"Apache Submarine Commons Utils: default secret","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Submarine Commons Utils","kev":false,"epss":0.01017,"kevAdded":null},{"id":"CVE-2024-36263","published":"2024-06-12T14:05:00.096Z","updated":"2025-02-13T17:52:52.302Z","title":"Apache Submarine Server Core: SQL injection","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Submarine Server Core","kev":false,"epss":0.00963,"kevAdded":null},{"id":"CVE-2024-36471","published":"2024-06-10T21:55:06.170Z","updated":"2024-09-13T16:03:21.981Z","title":"Apache Allura: sensitive information exposure via DNS rebinding","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.0075,"kevAdded":null},{"id":"CVE-2024-36104","published":"2024-06-04T07:25:07.746Z","updated":"2026-11-03T23:59:21.824Z","title":"Apache OFBiz: Path traversal leading to a RCE","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.87883,"kevAdded":null},{"id":"CVE-2024-32077","published":"2024-05-14T10:43:20.299Z","updated":"2025-03-27T19:28:00.194Z","title":"Apache Airflow: XSS vulnerability in Task Instance Log/Log Details","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01572,"kevAdded":null},{"id":"CVE-2024-34365","published":"2024-05-09T06:49:05.239Z","updated":"2025-02-13T17:52:29.208Z","title":"Apache Karaf Cave: Cave SSRF and arbitrary file access","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Karaf Cave","kev":false,"epss":0.01161,"kevAdded":null},{"id":"CVE-2024-26579","published":"2024-05-08T15:06:23.829Z","updated":"2025-03-28T18:52:24.649Z","title":"Apache Inlong JDBC Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01139,"kevAdded":null},{"id":"CVE-2024-32113","published":"2024-05-08T14:50:07.272Z","updated":"2025-10-21T23:05:18.831Z","title":"Apache OFBiz: Path traversal leading to RCE","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":true,"epss":0.99916,"kevAdded":"2024-08-07"},{"id":"CVE-2024-28148","published":"2024-05-07T13:33:42.137Z","updated":"2024-08-02T00:48:49.154Z","title":"Apache Superset: Incorrect datasource authorization on explore REST API","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2023-35701","published":"2024-05-03T08:11:08.215Z","updated":"2025-02-13T16:55:52.036Z","title":"Apache Hive: Arbitrary command execution via JDBC driver","severity":"MEDIUM","score":6.6,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01103,"kevAdded":null},{"id":"CVE-2024-32638","published":"2024-05-02T09:20:29.127Z","updated":"2025-02-13T17:52:13.382Z","title":"Apache APISIX: Forward-Auth Request Smuggling","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.01065,"kevAdded":null},{"id":"CVE-2024-32114","published":"2024-05-02T08:29:18.219Z","updated":"2024-08-02T02:06:44.047Z","title":"Apache ActiveMQ: Jolokia and REST API were not secured with default configuration","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.07148,"kevAdded":null},{"id":"CVE-2024-27349","published":"2024-04-22T14:08:56.591Z","updated":"2025-08-21T03:55:17.018Z","title":"Apache HugeGraph-Server: Bypass whitelist in Auth mode","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HugeGraph-Server","kev":false,"epss":0.01024,"kevAdded":null},{"id":"CVE-2024-27348","published":"2024-04-22T14:08:06.294Z","updated":"2025-10-21T23:05:21.096Z","title":"Apache HugeGraph-Server: Command execution in gremlin","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HugeGraph-Server","kev":true,"epss":0.9921,"kevAdded":"2024-09-18"},{"id":"CVE-2024-27347","published":"2024-04-22T14:07:37.300Z","updated":"2025-02-13T17:46:27.622Z","title":"Apache HugeGraph-Hubble: SSRF in Hubble connection page","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HugeGraph-Hubble","kev":false,"epss":0.00995,"kevAdded":null},{"id":"CVE-2024-29733","published":"2024-04-21T17:21:55.722Z","updated":"2025-02-13T17:47:41.310Z","title":"Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context","severity":"LOW","score":2.7,"vendor":"Apache Software Foundation","product":"Apache Airflow FTP Provider","kev":false,"epss":0.00631,"kevAdded":null},{"id":"CVE-2024-29217","published":"2024-04-21T16:04:10.514Z","updated":"2025-02-13T17:47:40.145Z","title":"Apache Answer: XSS vulnerability when changing personal website","severity":"MEDIUM","score":4.6,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00966,"kevAdded":null},{"id":"CVE-2024-31869","published":"2024-04-18T07:19:05.033Z","updated":"2025-03-13T16:10:23.130Z","title":"Apache Airflow: Sensitive configuration for providers displayed when \"non-sensitive-only\" config used","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01058,"kevAdded":null},{"id":"CVE-2024-31391","published":"2024-04-12T15:00:26.569Z","updated":"2025-03-13T19:45:50.106Z","title":"Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Solr Operator","kev":false,"epss":0.0084,"kevAdded":null},{"id":"CVE-2024-27309","published":"2024-04-12T06:58:45.134Z","updated":"2025-07-30T03:55:45.408Z","title":"Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.01125,"kevAdded":null},{"id":"CVE-2024-31309","published":"2024-04-10T12:07:16.975Z","updated":"2025-11-04T18:30:48.185Z","title":"Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.94615,"kevAdded":null},{"id":"CVE-2024-31867","published":"2024-04-09T16:15:47.978Z","updated":"2025-02-13T17:52:00.183Z","title":"Apache Zeppelin: LDAP search filter query Injection Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01176,"kevAdded":null},{"id":"CVE-2024-31868","published":"2024-04-09T16:10:30.671Z","updated":"2024-11-04T16:12:40.294Z","title":"Apache Zeppelin: XSS vulnerability in the helium module","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.0131,"kevAdded":null},{"id":"CVE-2024-31866","published":"2024-04-09T16:09:12.117Z","updated":"2025-02-13T17:51:59.550Z","title":"Apache Zeppelin: Interpreter download command does not escape malicious code injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01581,"kevAdded":null},{"id":"CVE-2024-31865","published":"2024-04-09T16:07:36.358Z","updated":"2025-02-13T17:48:06.867Z","title":"Apache Zeppelin: Cron arbitrary user impersonation with improper privileges","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01723,"kevAdded":null},{"id":"CVE-2024-31864","published":"2024-04-09T16:05:32.690Z","updated":"2025-11-04T21:08:35.546Z","title":"Apache Zeppelin: Remote code execution by adding malicious JDBC connection string","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01257,"kevAdded":null},{"id":"CVE-2024-31863","published":"2024-04-09T10:25:29.449Z","updated":"2025-03-25T18:21:05.668Z","title":"Apache Zeppelin: Replacing other users notebook, bypassing any permissions","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01008,"kevAdded":null},{"id":"CVE-2024-31862","published":"2024-04-09T09:40:39.495Z","updated":"2025-02-13T17:48:04.941Z","title":"Apache Zeppelin: Denial of service with invalid notebook name","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01365,"kevAdded":null},{"id":"CVE-2022-47894","published":"2024-04-09T09:29:17.806Z","updated":"2025-02-13T16:34:01.816Z","title":"Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Zeppelin SAP","kev":false,"epss":0.01327,"kevAdded":null},{"id":"CVE-2021-28656","published":"2024-04-09T09:12:58.493Z","updated":"2025-02-13T16:27:59.379Z","title":"Apache Zeppelin: CSRF vulnerability in the Credentials page","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2024-31860","published":"2024-04-09T09:08:28.802Z","updated":"2025-05-06T13:12:31.467Z","title":"Apache Zeppelin: Path traversal vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01386,"kevAdded":null},{"id":"CVE-2024-24746","published":"2024-04-06T11:56:07.232Z","updated":"2025-02-13T17:40:20.471Z","title":"Apache NimBLE: Denial of service in NimBLE Bluetooth stack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NimBLE","kev":false,"epss":0.01446,"kevAdded":null},{"id":"CVE-2024-27316","published":"2024-04-04T19:21:41.984Z","updated":"2025-11-04T22:06:02.830Z","title":"Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.88755,"kevAdded":null},{"id":"CVE-2024-24795","published":"2024-04-04T19:20:48.803Z","updated":"2024-11-12T19:48:20.007Z","title":"Apache HTTP Server: HTTP Response Splitting in multiple modules","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.02874,"kevAdded":null},{"id":"CVE-2023-38709","published":"2024-04-04T19:19:35.467Z","updated":"2025-11-04T21:08:23.335Z","title":"Apache HTTP Server: HTTP response splitting","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.03914,"kevAdded":null},{"id":"CVE-2024-29008","published":"2024-04-04T07:51:05.423Z","updated":"2024-08-29T20:31:23.220Z","title":"Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance","severity":"MEDIUM","score":6.4,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00619,"kevAdded":null},{"id":"CVE-2024-29007","published":"2024-04-04T07:49:57.831Z","updated":"2024-11-12T18:07:54.494Z","title":"Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00785,"kevAdded":null},{"id":"CVE-2024-29006","published":"2024-04-04T07:48:54.101Z","updated":"2025-03-27T19:43:43.236Z","title":"Apache CloudStack: x-forwarded-for HTTP header parsed by default","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.00874,"kevAdded":null},{"id":"CVE-2024-29834","published":"2024-04-02T19:24:46.473Z","updated":"2025-02-13T17:47:43.136Z","title":"Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints","severity":"MEDIUM","score":6.4,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01359,"kevAdded":null},{"id":"CVE-2024-23537","published":"2024-03-29T14:38:05.738Z","updated":"2025-02-13T17:39:45.238Z","title":"Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.01104,"kevAdded":null},{"id":"CVE-2024-23538","published":"2024-03-29T14:37:40.374Z","updated":"2025-02-13T17:39:45.863Z","title":"Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.","severity":"CRITICAL","score":9.9,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.01291,"kevAdded":null},{"id":"CVE-2024-23539","published":"2024-03-29T14:36:57.919Z","updated":"2025-02-13T17:39:46.405Z","title":"Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.","severity":"HIGH","score":8.3,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.01494,"kevAdded":null},{"id":"CVE-2024-29735","published":"2024-03-26T16:52:40.770Z","updated":"2025-02-13T17:47:41.979Z","title":"Apache Airflow: Potentially harmful permission changing by log task handler","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0146,"kevAdded":null},{"id":"CVE-2024-27438","published":"2024-03-21T09:39:21.894Z","updated":"2025-02-13T17:46:29.362Z","title":"Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00962,"kevAdded":null},{"id":"CVE-2024-26307","published":"2024-03-21T09:38:19.368Z","updated":"2025-02-13T17:41:13.412Z","title":"Apache Doris: Possible race condition","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2024-29131","published":"2024-03-21T09:07:13.627Z","updated":"2025-02-13T17:47:38.259Z","title":"Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Commons Configuration","kev":false,"epss":0.02054,"kevAdded":null},{"id":"CVE-2024-29133","published":"2024-03-21T09:05:47.597Z","updated":"2025-02-13T17:47:38.808Z","title":"Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Commons Configuration","kev":false,"epss":0.01727,"kevAdded":null},{"id":"CVE-2024-27439","published":"2024-03-19T11:07:47.648Z","updated":"2025-02-13T17:46:30.000Z","title":"Apache Wicket: Possible bypass of CSRF protection","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00681,"kevAdded":null},{"id":"CVE-2024-24683","published":"2024-03-19T08:20:18.989Z","updated":"2025-02-13T17:40:17.349Z","title":"Apache Hop Engine: ID isn't escaped when generating HTML","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Hop Engine","kev":false,"epss":0.01239,"kevAdded":null},{"id":"CVE-2024-28752","published":"2024-03-15T10:27:30.083Z","updated":"2025-02-13T17:47:30.605Z","title":"Apache CXF SSRF Vulnerability using the Aegis databinding","severity":"CRITICAL","score":9.3,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.02925,"kevAdded":null},{"id":"CVE-2024-23944","published":"2024-03-15T10:26:12.848Z","updated":"2025-07-03T14:52:57.231Z","title":"Apache ZooKeeper: Information disclosure in persistent watcher handling","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2024-28746","published":"2024-03-14T08:41:03.928Z","updated":"2025-03-20T19:04:18.928Z","title":"Apache Airflow: Ignored Airflow Permissions","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01344,"kevAdded":null},{"id":"CVE-2024-23672","published":"2024-03-13T15:48:42.610Z","updated":"2025-10-29T11:57:10.244Z","title":"Apache Tomcat: WebSocket DoS with incomplete closing handshake","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02313,"kevAdded":null},{"id":"CVE-2024-24549","published":"2024-03-13T15:46:53.085Z","updated":"2025-10-29T11:56:23.336Z","title":"Apache Tomcat: HTTP/2 header handling DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.23072,"kevAdded":null},{"id":"CVE-2024-27894","published":"2024-03-12T18:19:41.084Z","updated":"2025-02-13T17:47:12.314Z","title":"Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01895,"kevAdded":null},{"id":"CVE-2024-27317","published":"2024-03-12T18:18:52.650Z","updated":"2025-02-13T17:46:25.167Z","title":"Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.56934,"kevAdded":null},{"id":"CVE-2024-27135","published":"2024-03-12T18:18:06.720Z","updated":"2025-02-13T17:41:17.703Z","title":"Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.05983,"kevAdded":null},{"id":"CVE-2022-34321","published":"2024-03-12T18:17:06.236Z","updated":"2025-02-13T16:32:45.878Z","title":"Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01765,"kevAdded":null},{"id":"CVE-2024-28098","published":"2024-03-12T18:15:39.848Z","updated":"2025-02-13T17:47:15.300Z","title":"Apache Pulsar: Improper Authorization For Topic-Level Policy Management","severity":"MEDIUM","score":6.4,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01701,"kevAdded":null},{"id":"CVE-2023-41313","published":"2024-03-12T10:16:23.638Z","updated":"2025-02-13T17:09:00.819Z","title":"Apache Doris: Timing Attack weakness","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.01058,"kevAdded":null},{"id":"CVE-2023-50740","published":"2024-03-06T13:44:53.867Z","updated":"2025-02-13T17:19:29.492Z","title":"Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Linkis DataSource","kev":false,"epss":0.00901,"kevAdded":null},{"id":"CVE-2024-26580","published":"2024-03-06T12:07:28.140Z","updated":"2025-02-13T17:41:17.092Z","title":"Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.0122,"kevAdded":null},{"id":"CVE-2024-27138","published":"2024-03-01T15:41:12.677Z","updated":"2025-02-13T17:41:18.332Z","title":"Apache Archiva: disabling user registration is not effective","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.01192,"kevAdded":null},{"id":"CVE-2024-27139","published":"2024-03-01T15:40:49.893Z","updated":"2025-04-16T20:47:27.623Z","title":"Apache Archiva: incorrect authentication potentially leading to account takeover","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.0133,"kevAdded":null},{"id":"CVE-2024-27140","published":"2024-03-01T15:40:08.456Z","updated":"2025-02-13T17:41:19.631Z","title":"Apache Archiva: reflected XSS","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.01341,"kevAdded":null},{"id":"CVE-2023-50378","published":"2024-03-01T14:38:29.732Z","updated":"2024-11-07T16:03:03.744Z","title":"Apache Ambari: Various XSS problems","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01212,"kevAdded":null},{"id":"CVE-2024-26280","published":"2024-03-01T11:05:54.480Z","updated":"2025-02-13T17:41:11.624Z","title":"Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01856,"kevAdded":null},{"id":"CVE-2024-27906","published":"2024-02-29T11:02:19.310Z","updated":"2025-05-06T13:12:13.352Z","title":"Apache Airflow: Dag Code and Import Error Permissions Ignored","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2024-23946","published":"2024-02-28T15:44:41.714Z","updated":"2025-02-13T17:40:01.762Z","title":"Apache OFBiz: Path traversal or file inclusion","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.03146,"kevAdded":null},{"id":"CVE-2024-25065","published":"2024-02-28T15:42:50.448Z","updated":"2025-02-13T17:40:46.357Z","title":"Apache OFBiz: Path traversal allowing authentication bypass.","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.47667,"kevAdded":null},{"id":"CVE-2024-23807","published":"2024-02-28T13:50:39.904Z","updated":"2026-01-22T04:55:53.687Z","title":"Apache Xerces C++: Use-after-free on external DTD scan","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Xerces C++","kev":false,"epss":0.01482,"kevAdded":null},{"id":"CVE-2024-26016","published":"2024-02-28T11:28:38.319Z","updated":"2025-04-22T15:57:40.166Z","title":"Apache Superset: Improper authorization validation on dashboards and charts import","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00873,"kevAdded":null},{"id":"CVE-2024-24779","published":"2024-02-28T11:28:02.395Z","updated":"2025-02-13T17:40:23.167Z","title":"Apache Superset: Improper data authorization when creating a new dataset","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00733,"kevAdded":null},{"id":"CVE-2024-24772","published":"2024-02-28T11:26:45.745Z","updated":"2025-02-12T09:27:34.758Z","title":"Apache Superset: Improper Neutralisation of custom SQL on embedded context","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00953,"kevAdded":null},{"id":"CVE-2024-24773","published":"2024-02-28T11:24:58.179Z","updated":"2025-02-13T17:40:22.462Z","title":"Apache Superset: Improper validation of SQL statements allows for unauthorized access to data","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00779,"kevAdded":null},{"id":"CVE-2024-27315","published":"2024-02-28T10:06:48.685Z","updated":"2024-10-03T12:30:59.889Z","title":"Apache Superset: Improper error handling on alerts","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00978,"kevAdded":null},{"id":"CVE-2023-50380","published":"2024-02-27T16:51:33.978Z","updated":"2025-03-27T19:53:06.868Z","title":"Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.00865,"kevAdded":null},{"id":"CVE-2024-21742","published":"2024-02-27T16:21:16.432Z","updated":"2025-05-06T13:11:44.183Z","title":"Apache James Mime4J: Mime4J DOM header injection","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache James Mime4J","kev":false,"epss":0.01091,"kevAdded":null},{"id":"CVE-2024-27905","published":"2024-02-27T14:29:22.497Z","updated":"2025-04-22T16:13:10.660Z","title":"Apache Aurora: padding oracle can allow construction an authentication cookie","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Aurora","kev":false,"epss":0.01471,"kevAdded":null},{"id":"CVE-2023-51747","published":"2024-02-27T13:08:01.807Z","updated":"2025-02-13T17:19:50.944Z","title":"SMTP smuggling in Apache James","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache James server","kev":false,"epss":0.01045,"kevAdded":null},{"id":"CVE-2023-51518","published":"2024-02-27T09:09:31.579Z","updated":"2024-08-22T20:42:38.254Z","title":"Apache James server: Privilege escalation via JMX pre-authentication deserialisation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache James server","kev":false,"epss":0.01189,"kevAdded":null},{"id":"CVE-2023-50379","published":"2024-02-27T08:27:03.120Z","updated":"2025-02-13T17:19:25.008Z","title":"Apache Ambari: authenticated users could perform command injection to perform RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01064,"kevAdded":null},{"id":"CVE-2024-22371","published":"2024-02-26T09:22:38.384Z","updated":"2024-10-31T13:03:53.000Z","title":"Apache Camel issue on ExchangeCreatedEvent","severity":"LOW","score":2.9,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00695,"kevAdded":null},{"id":"CVE-2024-23320","published":"2024-02-23T16:57:09.741Z","updated":"2025-02-13T17:39:41.154Z","title":"Apache DolphinScheduler: Arbitrary js execution as root for authenticated users","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01388,"kevAdded":null},{"id":"CVE-2024-22393","published":"2024-02-22T09:51:43.432Z","updated":"2025-04-22T16:20:44.318Z","title":"Apache Answer: Pixel Flood Attack by uploading the large pixel file","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.02459,"kevAdded":null},{"id":"CVE-2024-23349","published":"2024-02-22T09:48:20.873Z","updated":"2025-03-28T19:39:55.576Z","title":"Apache Answer: XSS vulnerability when submitting summary","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.01073,"kevAdded":null},{"id":"CVE-2024-26578","published":"2024-02-22T09:28:15.274Z","updated":"2025-03-20T19:16:28.646Z","title":"Apache Answer: Repeated submission at registration created duplicate users with the same name","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00895,"kevAdded":null},{"id":"CVE-2024-25141","published":"2024-02-20T20:30:28.924Z","updated":"2025-02-13T17:40:48.227Z","title":"Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Airflow Mongo Provider","kev":false,"epss":0.00625,"kevAdded":null},{"id":"CVE-2024-23114","published":"2024-02-20T14:59:38.326Z","updated":"2024-08-28T19:49:48.296Z","title":"Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.01273,"kevAdded":null},{"id":"CVE-2024-22369","published":"2024-02-20T14:58:36.291Z","updated":"2024-11-05T19:47:09.797Z","title":"Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.00749,"kevAdded":null},{"id":"CVE-2023-51770","published":"2024-02-20T10:02:12.991Z","updated":"2025-03-27T16:50:01.449Z","title":"Apache DolphinScheduler: Arbitrary File Read Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01239,"kevAdded":null},{"id":"CVE-2023-50270","published":"2024-02-20T10:01:32.260Z","updated":"2024-08-29T15:08:36.166Z","title":"Apache DolphinScheduler: Session do not expire after password change","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01306,"kevAdded":null},{"id":"CVE-2023-49250","published":"2024-02-20T10:00:06.733Z","updated":"2025-02-13T17:18:36.587Z","title":"Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.00704,"kevAdded":null},{"id":"CVE-2023-49109","published":"2024-02-20T09:58:56.779Z","updated":"2025-02-13T17:18:34.198Z","title":"Remote Code Execution in Apache Dolphinscheduler","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.02301,"kevAdded":null},{"id":"CVE-2024-25710","published":"2024-02-19T08:33:40.627Z","updated":"2025-11-04T16:11:24.559Z","title":"Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.00441,"kevAdded":null},{"id":"CVE-2024-26308","published":"2024-02-19T08:31:50.192Z","updated":"2025-03-27T19:10:43.565Z","title":"Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.00898,"kevAdded":null},{"id":"CVE-2024-23952","published":"2024-02-14T11:09:47.113Z","updated":"2025-02-13T17:40:06.510Z","title":"Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01699,"kevAdded":null},{"id":"CVE-2023-50291","published":"2024-02-09T17:29:32.882Z","updated":"2025-05-15T19:39:09.044Z","title":"Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.03278,"kevAdded":null},{"id":"CVE-2023-50292","published":"2024-02-09T17:29:21.249Z","updated":"2025-05-15T19:39:15.762Z","title":"Apache Solr: Solr Schema Designer blindly \"trusts\" all configsets, possibly leading to RCE by unauthenticated users","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.03024,"kevAdded":null},{"id":"CVE-2023-50298","published":"2024-02-09T17:29:07.889Z","updated":"2025-02-13T17:19:05.273Z","title":"Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.01564,"kevAdded":null},{"id":"CVE-2023-50386","published":"2024-02-09T17:28:51.290Z","updated":"2025-04-24T15:47:50.228Z","title":"Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.83719,"kevAdded":null},{"id":"CVE-2024-23452","published":"2024-02-08T09:00:04.809Z","updated":"2025-06-04T15:07:20.721Z","title":"Apache bRPC: HTTP request smuggling vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.01637,"kevAdded":null},{"id":"CVE-2023-39196","published":"2024-02-07T12:56:29.534Z","updated":"2025-02-13T17:02:38.948Z","title":"Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.00794,"kevAdded":null},{"id":"CVE-2023-51437","published":"2024-02-07T09:18:19.080Z","updated":"2024-08-02T22:32:09.454Z","title":"Apache Pulsar: Timing attack in SASL token signature verification","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00763,"kevAdded":null},{"id":"CVE-2024-23673","published":"2024-02-06T10:04:21.294Z","updated":"2025-05-09T16:27:44.139Z","title":"Apache Sling Servlets Resolver: Malicious code execution via path traversal","severity":"HIGH","score":8.5,"vendor":"Apache Software Foundation","product":"Apache Sling Servlets Resolver","kev":false,"epss":0.01321,"kevAdded":null},{"id":"CVE-2023-44313","published":"2024-01-31T08:49:45.962Z","updated":"2025-02-13T17:13:39.249Z","title":"Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend API","severity":"HIGH","score":7.6,"vendor":"Apache Software Foundation","product":"Apache ServiceComb Service-Center","kev":false,"epss":0.0346,"kevAdded":null},{"id":"CVE-2023-44312","published":"2024-01-31T08:49:12.741Z","updated":"2025-05-30T18:39:28.124Z","title":"Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center server","severity":"MEDIUM","score":5.8,"vendor":"Apache Software Foundation","product":"Apache ServiceComb Service-Center","kev":false,"epss":0.00814,"kevAdded":null},{"id":"CVE-2023-29055","published":"2024-01-29T12:20:55.147Z","updated":"2025-06-20T19:41:27.944Z","title":"Apache Kylin: Insufficiently protected credentials in config file","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.01149,"kevAdded":null},{"id":"CVE-2023-50944","published":"2024-01-24T12:58:18.873Z","updated":"2025-06-11T17:02:59.150Z","title":"Apache Airflow: Bypass permission verification to read code of other dags","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00979,"kevAdded":null},{"id":"CVE-2023-50943","published":"2024-01-24T12:57:07.287Z","updated":"2025-05-30T14:16:49.346Z","title":"Apache Airflow: Potential pickle deserialization vulnerability in XComs","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0122,"kevAdded":null},{"id":"CVE-2023-51702","published":"2024-01-24T12:56:17.869Z","updated":"2025-06-11T16:48:05.292Z","title":"Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow CNCF Kubernetes provider","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2023-49657","published":"2024-01-23T15:06:59.901Z","updated":"2025-06-17T21:19:26.476Z","title":"Apache Superset: Stored XSS in Dashboard Title and Chart Title","severity":"CRITICAL","score":9.6,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00837,"kevAdded":null},{"id":"CVE-2024-21733","published":"2024-01-19T10:29:04.694Z","updated":"2025-11-03T20:36:42.598Z","title":"Apache Tomcat: Leaking of unrelated request bodies in default error page","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.14286,"kevAdded":null},{"id":"CVE-2023-46226","published":"2024-01-15T10:35:49.810Z","updated":"2025-06-20T16:51:31.364Z","title":"Apache IoTDB: Remote Code Execution (RCE) risk via the UDF","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01917,"kevAdded":null},{"id":"CVE-2023-46749","published":"2024-01-15T09:57:31.613Z","updated":"2025-11-03T21:50:03.484Z","title":"Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.01187,"kevAdded":null},{"id":"CVE-2023-50290","published":"2024-01-15T09:32:44.532Z","updated":"2025-05-09T20:18:08.133Z","title":"Apache Solr: Host environment variables are published via the Metrics API","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.68446,"kevAdded":null},{"id":"CVE-2023-49619","published":"2024-01-10T08:25:01.610Z","updated":"2025-06-11T17:00:45.974Z","title":"Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.","severity":"LOW","score":3.1,"vendor":"Apache Software Foundation","product":"Apache Answer","kev":false,"epss":0.00891,"kevAdded":null},{"id":"CVE-2023-51441","published":"2024-01-06T11:59:37.769Z","updated":"2025-06-18T15:50:11.058Z","title":"Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Axis","kev":false,"epss":0.01213,"kevAdded":null},{"id":"CVE-2023-51784","published":"2024-01-03T09:39:23.382Z","updated":"2025-05-16T15:53:16.443Z","title":"Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.0162,"kevAdded":null},{"id":"CVE-2023-51785","published":"2024-01-03T09:36:24.189Z","updated":"2025-02-13T17:19:55.037Z","title":"Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01012,"kevAdded":null},{"id":"CVE-2023-49299","published":"2023-12-30T16:27:12.045Z","updated":"2025-02-13T17:18:42.096Z","title":"Apache DolphinScheduler: Arbitrary js execute as root for authenticated users","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.0143,"kevAdded":null},{"id":"CVE-2023-47804","published":"2023-12-29T14:31:28.081Z","updated":"2025-02-13T17:18:09.085Z","title":"Apache OpenOffice: Macro URL arbitrary script execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.02727,"kevAdded":null},{"id":"CVE-2023-51467","published":"2023-12-26T14:46:59.800Z","updated":"2024-08-19T07:48:14.509Z","title":"Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.96001,"kevAdded":null},{"id":"CVE-2023-50968","published":"2023-12-26T11:45:55.393Z","updated":"2025-02-13T17:19:42.335Z","title":"Apache OFBiz: Arbitrary file properties reading and SSRF attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.63373,"kevAdded":null},{"id":"CVE-2023-51656","published":"2023-12-21T11:47:57.912Z","updated":"2025-02-13T17:19:46.209Z","title":"Apache IoTDB: Unsafe deserialize map in Sync Tool","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01035,"kevAdded":null},{"id":"CVE-2023-48291","published":"2023-12-21T09:30:46.557Z","updated":"2025-02-13T17:18:16.717Z","title":"Apache Airflow: Improper access control to DAG resources","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.018,"kevAdded":null},{"id":"CVE-2023-50783","published":"2023-12-21T09:28:47.746Z","updated":"2025-02-13T17:19:40.647Z","title":"Apache Airflow: Improper access control vulnerability on the \"varimport\" endpoint","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0139,"kevAdded":null},{"id":"CVE-2023-47265","published":"2023-12-21T09:28:09.653Z","updated":"2025-02-13T17:17:57.265Z","title":"Apache Airflow: DAG Params alllow to embed unchecked Javascript","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01344,"kevAdded":null},{"id":"CVE-2023-49920","published":"2023-12-21T09:27:09.651Z","updated":"2025-02-13T17:18:58.218Z","title":"Apache Airflow: Missing CSRF protection on DAG/trigger","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01032,"kevAdded":null},{"id":"CVE-2023-37544","published":"2023-12-20T08:34:02.393Z","updated":"2025-02-13T17:01:29.212Z","title":"Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Pulsar WebSocket Proxy","kev":false,"epss":0.01351,"kevAdded":null},{"id":"CVE-2023-43826","published":"2023-12-19T19:50:15.188Z","updated":"2026-02-25T17:51:44.807Z","title":"Apache Guacamole: Integer overflow in handling of VNC image buffers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.0089,"kevAdded":null},{"id":"CVE-2023-49734","published":"2023-12-19T09:52:13.373Z","updated":"2025-02-13T17:18:54.094Z","title":"Apache Superset: Privilege Escalation Vulnerability","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0095,"kevAdded":null},{"id":"CVE-2023-49736","published":"2023-12-19T09:33:10.415Z","updated":"2025-02-13T17:18:54.638Z","title":"Apache Superset: SQL Injection on where_in JINJA macro","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01188,"kevAdded":null},{"id":"CVE-2023-46104","published":"2023-12-19T09:30:53.790Z","updated":"2025-02-13T17:14:16.088Z","title":"Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01667,"kevAdded":null},{"id":"CVE-2023-41314","published":"2023-12-18T08:27:51.999Z","updated":"2024-11-20T18:11:21.234Z","title":"Apache Doris: Missing API authentication allowed DoS","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Doris","kev":false,"epss":0.00898,"kevAdded":null},{"id":"CVE-2023-30867","published":"2023-12-15T12:14:02.074Z","updated":"2024-08-02T14:37:15.494Z","title":"Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.00852,"kevAdded":null},{"id":"CVE-2023-49898","published":"2023-12-15T12:13:25.086Z","updated":"2024-08-02T22:09:49.388Z","title":"Apache StreamPark (incubating): Authenticated system users could trigger remote command execution","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.02299,"kevAdded":null},{"id":"CVE-2023-46279","published":"2023-12-15T08:15:56.146Z","updated":"2025-02-13T17:14:24.160Z","title":"Apache Dubbo: Bypass deny serialize list check in Apache Dubbo","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.01666,"kevAdded":null},{"id":"CVE-2023-29234","published":"2023-12-15T08:14:47.561Z","updated":"2025-02-13T16:49:03.349Z","title":"Bypass serialize checks in Apache Dubbo","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.07401,"kevAdded":null},{"id":"CVE-2023-46750","published":"2023-12-14T08:15:58.031Z","updated":"2025-11-03T21:50:05.435Z","title":"Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.01484,"kevAdded":null},{"id":"CVE-2023-45725","published":"2023-12-13T08:02:17.326Z","updated":"2024-08-02T20:29:31.714Z","title":"Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents","severity":"MEDIUM","score":5.7,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.01232,"kevAdded":null},{"id":"CVE-2023-50164","published":"2023-12-07T08:49:19.853Z","updated":"2025-03-14T03:55:16.463Z","title":"Apache Struts: File upload component had a directory traversal vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.80819,"kevAdded":null},{"id":"CVE-2023-41835","published":"2023-12-05T08:37:31.602Z","updated":"2025-11-04T19:21:09.564Z","title":"Apache Struts: excessive disk usage","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.073,"kevAdded":null},{"id":"CVE-2023-49070","published":"2023-12-05T08:05:06.966Z","updated":"2025-02-13T17:18:28.237Z","title":"Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.95368,"kevAdded":null},{"id":"CVE-2023-49735","published":"2023-11-30T21:17:28.243Z","updated":"2024-11-20T18:12:54.281Z","title":"Apache Tiles: Unvalidated input may lead to path traversal and XXE","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tiles","kev":false,"epss":0.01356,"kevAdded":null},{"id":"CVE-2023-49733","published":"2023-11-30T11:29:35.188Z","updated":"2025-02-13T17:18:53.184Z","title":"Apache Cocoon's StreamGenerator is vulnerable to XXE injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.01292,"kevAdded":null},{"id":"CVE-2023-49620","published":"2023-11-30T08:17:01.765Z","updated":"2025-02-13T17:18:46.703Z","title":"Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01132,"kevAdded":null},{"id":"CVE-2022-45135","published":"2023-11-30T08:05:45.604Z","updated":"2025-02-13T16:33:44.260Z","title":"Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Cocoon","kev":false,"epss":0.01102,"kevAdded":null},{"id":"CVE-2023-42504","published":"2023-11-28T17:59:59.504Z","updated":"2025-02-13T17:09:25.157Z","title":"Apache Superset: Lack of rate limiting allows for possible denial of service","severity":"MEDIUM","score":5.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01149,"kevAdded":null},{"id":"CVE-2023-42505","published":"2023-11-28T16:26:58.326Z","updated":"2025-02-13T17:09:25.693Z","title":"Apache Superset: Sensitive information disclosure on db connection details","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01018,"kevAdded":null},{"id":"CVE-2023-42502","published":"2023-11-28T16:25:43.177Z","updated":"2024-08-02T19:23:39.566Z","title":"Apache Superset: Open Redirect Vulnerability","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0083,"kevAdded":null},{"id":"CVE-2023-46589","published":"2023-11-28T15:31:52.366Z","updated":"2025-10-29T12:00:24.622Z","title":"Apache Tomcat: HTTP request smuggling via malformed trailer headers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02651,"kevAdded":null},{"id":"CVE-2022-41678","published":"2023-11-28T15:08:38.338Z","updated":"2025-11-03T21:46:33.574Z","title":"Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.8581,"kevAdded":null},{"id":"CVE-2023-49145","published":"2023-11-27T22:14:02.850Z","updated":"2025-02-13T17:18:35.345Z","title":"Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt","severity":"HIGH","score":7.9,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.01212,"kevAdded":null},{"id":"CVE-2023-43701","published":"2023-11-27T10:52:09.754Z","updated":"2024-08-02T19:44:43.832Z","title":"Apache Superset: Stored XSS on API endpoint","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01004,"kevAdded":null},{"id":"CVE-2023-42501","published":"2023-11-27T10:23:47.721Z","updated":"2025-06-05T14:08:25.751Z","title":"Apache Superset: Unnecessary read permissions within the Gamma role","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0086,"kevAdded":null},{"id":"CVE-2023-40610","published":"2023-11-27T10:22:41.083Z","updated":"2025-06-03T13:59:39.739Z","title":"Apache Superset: Privilege escalation with default examples database","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01335,"kevAdded":null},{"id":"CVE-2023-49068","published":"2023-11-27T09:49:42.477Z","updated":"2024-08-02T21:46:28.937Z","title":"Apache DolphinScheduler: Information Leakage Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01052,"kevAdded":null},{"id":"CVE-2023-48796","published":"2023-11-24T07:56:43.542Z","updated":"2025-11-28T11:03:38.390Z","title":"Apache dolphinscheduler sensitive information disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01191,"kevAdded":null},{"id":"CVE-2023-43123","published":"2023-11-23T09:16:34.705Z","updated":"2025-02-13T17:13:14.205Z","title":"Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2023-37924","published":"2023-11-22T09:19:23.372Z","updated":"2024-08-02T17:23:27.763Z","title":"Apache Submarine: SQL injection from unauthorized login","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Submarine","kev":false,"epss":0.07225,"kevAdded":null},{"id":"CVE-2022-46337","published":"2023-11-20T08:49:38.619Z","updated":"2025-06-10T13:44:34.288Z","title":"Apache Derby: LDAP injection vulnerability in authenticator","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Derby","kev":false,"epss":0.01418,"kevAdded":null},{"id":"CVE-2023-46302","published":"2023-11-20T08:46:56.197Z","updated":"2024-08-02T20:45:40.909Z","title":"Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Submarine","kev":false,"epss":0.01761,"kevAdded":null},{"id":"CVE-2023-26031","published":"2023-11-16T08:15:50.808Z","updated":"2025-02-13T16:44:42.474Z","title":"Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.02089,"kevAdded":null},{"id":"CVE-2023-42781","published":"2023-11-12T13:14:09.700Z","updated":"2025-02-13T17:09:41.138Z","title":"Apache Airflow: Permission verification bypass allows viewing dagruns of other dags","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01657,"kevAdded":null},{"id":"CVE-2023-47037","published":"2023-11-12T13:12:23.137Z","updated":"2025-02-13T17:14:45.806Z","title":"Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01497,"kevAdded":null},{"id":"CVE-2023-47248","published":"2023-11-09T08:17:08.431Z","updated":"2025-02-13T17:17:56.649Z","title":"PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"PyArrow","kev":false,"epss":0.14528,"kevAdded":null},{"id":"CVE-2023-39913","published":"2023-11-08T08:04:23.911Z","updated":"2025-02-13T17:03:15.196Z","title":"Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache UIMA Java SDK Core","kev":false,"epss":0.01483,"kevAdded":null},{"id":"CVE-2023-46819","published":"2023-11-07T11:02:03.305Z","updated":"2024-09-04T19:09:30.869Z","title":"Apache OFBiz: Execution of Solr plugin queries without authentication","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.01793,"kevAdded":null},{"id":"CVE-2023-46851","published":"2023-11-07T08:56:35.172Z","updated":"2024-09-04T20:12:28.257Z","title":"Apache Allura: sensitive information exposure via import","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.01647,"kevAdded":null},{"id":"CVE-2023-46215","published":"2023-10-28T07:10:57.943Z","updated":"2025-06-12T14:43:45.163Z","title":"Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Celery provider","kev":false,"epss":0.01561,"kevAdded":null},{"id":"CVE-2023-46604","published":"2023-10-27T14:59:31.046Z","updated":"2025-11-03T21:50:00.516Z","title":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":true,"epss":0.99992,"kevAdded":"2023-11-02"},{"id":"CVE-2023-46288","published":"2023-10-23T18:13:04.412Z","updated":"2025-02-13T17:14:24.702Z","title":"Apache Airflow: Sensitive parameters exposed in API when \"non-sensitive-only\" configuration is set","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01839,"kevAdded":null},{"id":"CVE-2023-31122","published":"2023-10-23T06:51:59.705Z","updated":"2025-02-13T16:49:43.236Z","title":"Apache HTTP Server: mod_macro buffer over-read","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0304,"kevAdded":null},{"id":"CVE-2023-43622","published":"2023-10-23T06:50:51.555Z","updated":"2025-02-13T17:13:24.282Z","title":"Apache HTTP Server: DoS in HTTP/2 with initial windows size 0","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.68818,"kevAdded":null},{"id":"CVE-2023-45802","published":"2023-10-23T06:50:23.991Z","updated":"2024-10-14T09:01:44.836Z","title":"Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.03168,"kevAdded":null},{"id":"CVE-2023-44483","published":"2023-10-20T09:23:53.483Z","updated":"2025-11-03T21:49:47.169Z","title":"Apache Santuario: Private Key disclosure in debug-log output","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Santuario","kev":false,"epss":0.01547,"kevAdded":null},{"id":"CVE-2023-46227","published":"2023-10-19T09:40:46.423Z","updated":"2024-09-12T20:13:07.162Z","title":"Apache inlong has an Arbitrary File Read Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01372,"kevAdded":null},{"id":"CVE-2023-25753","published":"2023-10-19T08:35:24.075Z","updated":"2024-09-12T20:32:26.867Z","title":"Server-Side Request Forgery in Apache ShenYu","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache ShenYu","kev":false,"epss":0.01137,"kevAdded":null},{"id":"CVE-2023-39456","published":"2023-10-17T06:58:17.515Z","updated":"2025-06-12T15:10:53.829Z","title":"Apache Traffic Server: Malformed http/2 frames can cause an abort","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.58286,"kevAdded":null},{"id":"CVE-2023-41752","published":"2023-10-17T06:57:47.508Z","updated":"2025-06-12T15:11:59.407Z","title":"Apache Traffic Server: s3_auth plugin problem with hash calculation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01626,"kevAdded":null},{"id":"CVE-2023-43666","published":"2023-10-16T08:08:10.148Z","updated":"2024-09-16T18:18:16.678Z","title":"Apache InLong: General user Unauthorized access User Management","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.00616,"kevAdded":null},{"id":"CVE-2023-43667","published":"2023-10-16T08:08:01.762Z","updated":"2025-06-16T16:50:38.393Z","title":"Apache InLong: Log Injection in Global functions","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.0171,"kevAdded":null},{"id":"CVE-2023-43668","published":"2023-10-16T08:07:42.681Z","updated":"2024-09-16T18:25:25.535Z","title":"Apache InLong: Jdbc Connection Security Bypass in InLong","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.0143,"kevAdded":null},{"id":"CVE-2023-45757","published":"2023-10-16T08:01:41.036Z","updated":"2025-02-13T17:14:10.463Z","title":"Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.01233,"kevAdded":null},{"id":"CVE-2023-42663","published":"2023-10-14T09:47:26.494Z","updated":"2025-02-13T17:09:31.436Z","title":"Apache Airflow: Bypass permission verification to view task instances of other dags","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02014,"kevAdded":null},{"id":"CVE-2023-42792","published":"2023-10-14T09:47:07.741Z","updated":"2025-02-13T17:09:43.150Z","title":"Apache Airflow: Improper access control to DAG resources","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01901,"kevAdded":null},{"id":"CVE-2023-45348","published":"2023-10-14T09:46:44.563Z","updated":"2025-02-13T17:14:03.098Z","title":"Apache Airflow: Configuration information leakage vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.016,"kevAdded":null},{"id":"CVE-2023-42780","published":"2023-10-14T09:46:09.845Z","updated":"2024-09-17T15:31:24.756Z","title":"Apache Airflow: Improper access control vulnerability in the \"List dag warnings\" feature","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01439,"kevAdded":null},{"id":"CVE-2023-44981","published":"2023-10-11T11:55:47.925Z","updated":"2025-04-23T16:15:15.138Z","title":"Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.02221,"kevAdded":null},{"id":"CVE-2023-45648","published":"2023-10-10T18:38:34.097Z","updated":"2025-10-29T12:00:47.484Z","title":"Apache Tomcat: Trailer header parsing too lenient","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.05883,"kevAdded":null},{"id":"CVE-2023-42795","published":"2023-10-10T17:42:16.705Z","updated":"2025-10-29T12:02:59.708Z","title":"Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02515,"kevAdded":null},{"id":"CVE-2023-42794","published":"2023-10-10T17:17:01.378Z","updated":"2026-10-08T21:13:49.714Z","title":"Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02304,"kevAdded":null},{"id":"CVE-2023-39410","published":"2023-09-29T16:23:34.021Z","updated":"2025-02-13T17:03:03.075Z","title":"Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Avro Java SDK","kev":false,"epss":0.02221,"kevAdded":null},{"id":"CVE-2023-41834","published":"2023-09-19T12:34:16.970Z","updated":"2025-02-13T17:09:03.658Z","title":"Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Flink Stateful Functions","kev":false,"epss":0.02312,"kevAdded":null},{"id":"CVE-2023-41267","published":"2023-09-14T07:46:42.191Z","updated":"2025-02-13T17:09:00.280Z","title":"Apache HDFS Provider error message suggested installation of incorrect pip package","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Airflow HDFS Provider","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2023-42503","published":"2023-09-14T07:45:14.520Z","updated":"2025-02-13T17:09:24.584Z","title":"Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2023-41081","published":"2023-09-13T09:30:05.584Z","updated":"2024-09-25T17:21:30.509Z","title":"Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat Connectors","kev":false,"epss":0.01589,"kevAdded":null},{"id":"CVE-2023-40712","published":"2023-09-12T11:05:48.763Z","updated":"2024-09-25T15:23:45.803Z","title":"Apache Airflow: Secrets can be unmasked in the \"Rendered Template\"","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02,"kevAdded":null},{"id":"CVE-2023-40611","published":"2023-09-12T11:05:22.841Z","updated":"2025-06-25T13:39:24.245Z","title":"Apache Airflow Dag Runs Broken Access Control Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01741,"kevAdded":null},{"id":"CVE-2023-32672","published":"2023-09-06T13:16:02.396Z","updated":"2024-09-26T15:52:02.025Z","title":"Apache Superset: SQL parser edge case bypasses data access authorization","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01038,"kevAdded":null},{"id":"CVE-2023-37941","published":"2023-09-06T13:06:20.879Z","updated":"2025-02-13T17:01:41.199Z","title":"Apache Superset: Metadata db write access can lead to remote code execution","severity":"MEDIUM","score":6.6,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.35455,"kevAdded":null},{"id":"CVE-2023-39265","published":"2023-09-06T13:00:11.612Z","updated":"2025-02-13T17:02:41.251Z","title":"Apache Superset: Possible Unauthorized Registration of SQLite Database Connections","severity":"LOW","score":3.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.86032,"kevAdded":null},{"id":"CVE-2023-39264","published":"2023-09-06T12:58:59.791Z","updated":"2024-09-26T15:23:54.656Z","title":"Apache Superset: Stack traces enabled by default","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01128,"kevAdded":null},{"id":"CVE-2023-27523","published":"2023-09-06T12:55:31.286Z","updated":"2024-09-26T15:24:13.311Z","title":"Apache Superset: Improper data permission validation on Jinja templated queries","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01019,"kevAdded":null},{"id":"CVE-2023-36388","published":"2023-09-06T12:53:57.035Z","updated":"2024-09-26T15:29:00.723Z","title":"Apache Superset: Improper API permission for low privilege users allows for SSRF","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01113,"kevAdded":null},{"id":"CVE-2023-27526","published":"2023-09-06T12:44:45.161Z","updated":"2024-09-26T15:29:27.835Z","title":"Apache Superset: Improper Authorization check on import charts","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01209,"kevAdded":null},{"id":"CVE-2023-36387","published":"2023-09-06T12:19:39.908Z","updated":"2024-09-26T18:10:35.983Z","title":"Apache Superset: Improper API permission for low privilege users","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01134,"kevAdded":null},{"id":"CVE-2023-40743","published":"2023-09-05T14:42:13.317Z","updated":"2025-02-13T17:08:43.713Z","title":"Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Axis","kev":false,"epss":0.03281,"kevAdded":null},{"id":"CVE-2023-41180","published":"2023-09-03T15:52:52.884Z","updated":"2024-09-27T18:47:25.827Z","title":"Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache NiFi MiNiFi C++","kev":false,"epss":0.00586,"kevAdded":null},{"id":"CVE-2023-40195","published":"2023-08-28T07:50:01.211Z","updated":"2025-04-23T16:19:19.884Z","title":"Apache Airflow Spark Provider Deserialization Vulnerability RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Spark Provider","kev":false,"epss":0.01858,"kevAdded":null},{"id":"CVE-2023-27604","published":"2023-08-28T07:47:29.702Z","updated":"2024-09-27T18:46:43.906Z","title":"Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Sqoop Provider","kev":false,"epss":0.01655,"kevAdded":null},{"id":"CVE-2023-41080","published":"2023-08-25T20:39:36.584Z","updated":"2025-10-29T12:04:40.271Z","title":"Apache Tomcat: Open redirect with FORM authentication","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.06459,"kevAdded":null},{"id":"CVE-2023-39441","published":"2023-08-23T15:39:51.632Z","updated":"2025-02-13T17:03:05.348Z","title":"Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Airflow SMTP Provider","kev":false,"epss":0.00804,"kevAdded":null},{"id":"CVE-2023-37379","published":"2023-08-23T15:38:56.047Z","updated":"2025-02-13T17:01:16.710Z","title":"Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on \"test connection\" feature","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01957,"kevAdded":null},{"id":"CVE-2023-40273","published":"2023-08-23T15:37:49.378Z","updated":"2024-09-27T20:29:59.422Z","title":"Session fixation in Apache Airflow web interface","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01845,"kevAdded":null},{"id":"CVE-2022-44729","published":"2023-08-22T14:12:50.301Z","updated":"2026-10-08T21:24:17.324Z","title":"Apache XML Graphics Batik: Information disclosure vulnerability","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache XML Graphics Batik","kev":false,"epss":0.00919,"kevAdded":null},{"id":"CVE-2022-44730","published":"2023-08-22T13:57:00.282Z","updated":"2025-02-13T16:33:42.755Z","title":"Apache XML Graphics Batik: Information disclosure vulnerability","severity":"MEDIUM","score":4.4,"vendor":"Apache Software Foundation","product":"Apache XML Graphics Batik","kev":false,"epss":0.00876,"kevAdded":null},{"id":"CVE-2022-46751","published":"2023-08-21T06:55:00.181Z","updated":"2025-02-13T16:33:53.044Z","title":"Apache Ivy: XML External Entity vulnerability in Apache Ivy","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Ivy","kev":false,"epss":0.01999,"kevAdded":null},{"id":"CVE-2023-40037","published":"2023-08-18T21:54:52.454Z","updated":"2025-02-13T17:03:21.877Z","title":"Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.02085,"kevAdded":null},{"id":"CVE-2023-40272","published":"2023-08-17T13:52:30.647Z","updated":"2025-02-13T17:07:44.473Z","title":"Apache Airflow Spark Provider Arbitrary File Read via JDBC","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Spark Provider","kev":false,"epss":0.02144,"kevAdded":null},{"id":"CVE-2023-39553","published":"2023-08-11T07:18:14.202Z","updated":"2025-02-13T17:03:14.052Z","title":"Apache Airflow Drill Provider Arbitrary File Read Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Drill Provider","kev":false,"epss":0.02284,"kevAdded":null},{"id":"CVE-2023-33934","published":"2023-08-09T06:58:06.516Z","updated":"2025-02-13T16:55:12.908Z","title":"Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01563,"kevAdded":null},{"id":"CVE-2022-47185","published":"2023-08-09T06:57:40.407Z","updated":"2025-02-13T16:34:00.177Z","title":"Apache Traffic Server: Invalid Range header causes a crash","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02003,"kevAdded":null},{"id":"CVE-2023-37581","published":"2023-08-06T07:21:04.307Z","updated":"2024-10-01T18:19:40.307Z","title":"Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.01172,"kevAdded":null},{"id":"CVE-2023-39508","published":"2023-08-05T06:47:14.951Z","updated":"2025-02-13T17:03:08.290Z","title":"Apache Airflow: Airflow \"Run task\" feature allows execution with unnecessary priviledges","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0263,"kevAdded":null},{"id":"CVE-2023-36542","published":"2023-07-29T07:12:18.290Z","updated":"2025-02-13T16:56:21.633Z","title":"Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.01903,"kevAdded":null},{"id":"CVE-2023-38647","published":"2023-07-26T07:52:29.741Z","updated":"2024-10-02T19:38:48.882Z","title":"Apache Helix: Deserialization vulnerability in Helix workflow and REST","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Helix","kev":false,"epss":0.01953,"kevAdded":null},{"id":"CVE-2023-38435","published":"2023-07-25T15:40:05.363Z","updated":"2025-02-13T17:01:51.002Z","title":"Apache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole plugin","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Felix Healthcheck Webconsole Plugin","kev":false,"epss":0.02247,"kevAdded":null},{"id":"CVE-2023-37895","published":"2023-07-25T14:02:10.036Z","updated":"2025-02-13T17:01:36.333Z","title":"Apache Jackrabbit RMI access can lead to RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Jackrabbit Webapp (jackrabbit-webapp)","kev":false,"epss":0.03239,"kevAdded":null},{"id":"CVE-2023-35088","published":"2023-07-25T07:10:19.460Z","updated":"2025-02-13T16:55:46.689Z","title":"Apache InLong: SQL injection in audit endpoint","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01643,"kevAdded":null},{"id":"CVE-2023-34434","published":"2023-07-25T07:09:58.676Z","updated":"2025-02-13T16:55:34.105Z","title":"Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01701,"kevAdded":null},{"id":"CVE-2023-34189","published":"2023-07-25T07:08:53.608Z","updated":"2025-02-13T16:55:21.374Z","title":"Apache InLong: General user can delete and update process","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01286,"kevAdded":null},{"id":"CVE-2023-34478","published":"2023-07-24T18:24:45.619Z","updated":"2025-02-13T16:55:37.269Z","title":"Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.02074,"kevAdded":null},{"id":"CVE-2023-28754","published":"2023-07-19T07:15:31.262Z","updated":"2025-02-13T16:48:51.364Z","title":"ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"ShardingSphere-Agent","kev":false,"epss":0.01458,"kevAdded":null},{"id":"CVE-2023-26512","published":"2023-07-17T07:16:12.413Z","updated":"2024-10-02T18:06:06.619Z","title":"Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache EventMesh (incubating) RabbitMQ connector","kev":false,"epss":0.01359,"kevAdded":null},{"id":"CVE-2023-37415","published":"2023-07-13T07:35:33.474Z","updated":"2025-02-13T17:01:18.439Z","title":"Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Apache Hive Provider","kev":false,"epss":0.01586,"kevAdded":null},{"id":"CVE-2022-45855","published":"2023-07-12T09:59:44.492Z","updated":"2024-10-04T13:50:54.277Z","title":"Apache Ambari: Allows authenticated metrics consumers to perform RCE","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01212,"kevAdded":null},{"id":"CVE-2022-42009","published":"2023-07-12T09:58:19.752Z","updated":"2024-10-04T13:49:38.984Z","title":"Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01212,"kevAdded":null},{"id":"CVE-2023-37582","published":"2023-07-12T09:26:18.652Z","updated":"2025-04-23T16:20:32.805Z","title":"Apache RocketMQ: Possible remote code execution when using the update configuration function","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache RocketMQ","kev":false,"epss":0.90427,"kevAdded":null},{"id":"CVE-2023-22888","published":"2023-07-12T09:17:55.338Z","updated":"2024-10-04T13:48:16.076Z","title":"Apache Airflow: Scheduler remote DoS","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01415,"kevAdded":null},{"id":"CVE-2023-36543","published":"2023-07-12T09:17:33.707Z","updated":"2024-10-04T13:47:18.046Z","title":"Apache Airflow: ReDoS via dags function","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01568,"kevAdded":null},{"id":"CVE-2022-46651","published":"2023-07-12T09:17:06.966Z","updated":"2024-10-04T13:45:35.520Z","title":"Apache Airflow: Security vulnerability on AirFlow Connections","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01201,"kevAdded":null},{"id":"CVE-2023-22887","published":"2023-07-12T09:14:25.892Z","updated":"2024-10-04T13:44:50.075Z","title":"Apache Airflow path traversal by authenticated user","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01787,"kevAdded":null},{"id":"CVE-2023-35908","published":"2023-07-12T09:14:10.491Z","updated":"2024-10-04T13:43:55.033Z","title":"Apache Airflow: Access to DAGs without relevant permission","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01026,"kevAdded":null},{"id":"CVE-2023-30428","published":"2023-07-12T09:10:03.369Z","updated":"2024-10-04T13:43:04.819Z","title":"Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Pulsar Broker","kev":false,"epss":0.00819,"kevAdded":null},{"id":"CVE-2023-30429","published":"2023-07-12T09:08:23.703Z","updated":"2024-10-03T20:43:48.694Z","title":"Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy","severity":"CRITICAL","score":9.6,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01035,"kevAdded":null},{"id":"CVE-2023-31007","published":"2023-07-12T09:07:03.227Z","updated":"2024-10-08T13:35:57.720Z","title":"Apache Pulsar: Broker does not always disconnect client when authentication data expires","severity":"NONE","score":0,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.0102,"kevAdded":null},{"id":"CVE-2023-37579","published":"2023-07-12T09:05:24.408Z","updated":"2024-10-08T13:35:12.605Z","title":"Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache Pulsar Function Worker","kev":false,"epss":0.00819,"kevAdded":null},{"id":"CVE-2023-32200","published":"2023-07-12T07:49:55.432Z","updated":"2024-10-07T19:42:49.706Z","title":"Apache Jena: Exposure of execution in script engine expressions.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Jena","kev":false,"epss":0.01473,"kevAdded":null},{"id":"CVE-2023-34442","published":"2023-07-10T09:31:05.286Z","updated":"2024-10-07T19:41:16.865Z","title":"Apache Camel JIRA: Temporary file information disclosure in Camel-Jira","severity":"LOW","score":3.3,"vendor":"Apache Software Foundation","product":"Apache Camel JIRA","kev":false,"epss":0.00428,"kevAdded":null},{"id":"CVE-2023-35887","published":"2023-07-10T09:28:54.987Z","updated":"2024-10-07T19:40:46.159Z","title":"Apache MINA SSHD: Information disclosure bugs with RootedFilesystem","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.01311,"kevAdded":null},{"id":"CVE-2023-33008","published":"2023-07-07T09:07:31.070Z","updated":"2024-10-07T19:13:58.440Z","title":"Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Johnzon","kev":false,"epss":0.01442,"kevAdded":null},{"id":"CVE-2023-34150","published":"2023-07-05T07:28:35.592Z","updated":"2024-08-02T16:01:53.904Z","title":"Apache Any23: Possible excessive allocation of resources reading input.","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Any23","kev":false,"epss":0.01484,"kevAdded":null},{"id":"CVE-2023-35797","published":"2023-07-03T09:08:53.795Z","updated":"2025-02-13T16:55:55.149Z","title":"Apache Airflow Hive Provider Beeline RCE with Principal","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Apache Hive Provider","kev":false,"epss":0.02791,"kevAdded":null},{"id":"CVE-2023-22886","published":"2023-06-29T09:41:00.074Z","updated":"2024-10-07T18:27:17.133Z","title":"Apache Airflow JDBC Provider: RCE Vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow JDBC Provider","kev":false,"epss":0.01518,"kevAdded":null},{"id":"CVE-2023-35798","published":"2023-06-27T11:39:51.759Z","updated":"2024-10-07T18:25:05.749Z","title":"Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Airflow ODBC Provider","kev":false,"epss":0.01263,"kevAdded":null},{"id":"CVE-2023-34395","published":"2023-06-27T11:36:58.116Z","updated":"2024-10-07T18:24:32.391Z","title":"Apache Airflow ODBC Provider: Remote code execution vulnerability","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Airflow ODBC Provider","kev":false,"epss":0.00756,"kevAdded":null},{"id":"CVE-2023-31469","published":"2023-06-23T07:07:42.875Z","updated":"2024-10-09T15:11:39.555Z","title":"Apache StreamPipes: Privilege escalation through non-admin user","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache StreamPipes","kev":false,"epss":0.01096,"kevAdded":null},{"id":"CVE-2023-34981","published":"2023-06-21T10:26:16.916Z","updated":"2025-02-13T16:55:41.813Z","title":"Apache Tomcat: AJP response header mix-up","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01116,"kevAdded":null},{"id":"CVE-2023-34340","published":"2023-06-21T07:01:48.171Z","updated":"2024-10-09T14:46:37.243Z","title":"Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentials","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Accumulo","kev":false,"epss":0.01432,"kevAdded":null},{"id":"CVE-2023-35005","published":"2023-06-19T08:15:18.029Z","updated":"2024-10-09T14:11:44.152Z","title":"Apache Airflow: Information disclosure on configuration view","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01531,"kevAdded":null},{"id":"CVE-2023-34396","published":"2023-06-14T07:50:59.730Z","updated":"2025-02-13T16:55:30.737Z","title":"Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.05512,"kevAdded":null},{"id":"CVE-2023-34149","published":"2023-06-14T07:48:54.926Z","updated":"2025-02-13T16:55:20.286Z","title":"Apache Struts: DoS via OOM owing to not properly checking of list bounds","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.05448,"kevAdded":null},{"id":"CVE-2023-30631","published":"2023-06-14T07:44:55.149Z","updated":"2025-02-13T16:49:34.433Z","title":"Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02005,"kevAdded":null},{"id":"CVE-2023-33933","published":"2023-06-14T07:44:12.626Z","updated":"2025-02-13T16:55:12.292Z","title":"Apache Traffic Server: s3_auth plugin problem with hash calculation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01508,"kevAdded":null},{"id":"CVE-2022-47184","published":"2023-06-14T07:42:36.126Z","updated":"2025-02-13T16:33:59.589Z","title":"Apache Traffic Server: The TRACE method can be use to disclose network information","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01496,"kevAdded":null},{"id":"CVE-2023-34212","published":"2023-06-12T15:14:06.990Z","updated":"2025-02-13T16:55:23.157Z","title":"Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.02351,"kevAdded":null},{"id":"CVE-2023-34468","published":"2023-06-12T15:09:20.711Z","updated":"2025-02-13T16:55:36.706Z","title":"Apache NiFi: Potential Code Injection with Database Services using H2","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.61869,"kevAdded":null},{"id":"CVE-2023-30576","published":"2023-06-07T08:06:54.840Z","updated":"2024-10-10T14:43:27.765Z","title":"Apache Guacamole: Use-after-free in handling of RDP audio input buffer","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.01113,"kevAdded":null},{"id":"CVE-2023-30575","published":"2023-06-07T08:06:36.061Z","updated":"2024-10-10T14:39:33.936Z","title":"Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.01007,"kevAdded":null},{"id":"CVE-2023-33234","published":"2023-05-30T10:56:56.139Z","updated":"2024-10-10T14:29:26.536Z","title":"Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Airflow CNCF Kubernetes Provider","kev":false,"epss":0.01544,"kevAdded":null},{"id":"CVE-2023-30601","published":"2023-05-30T07:25:49.920Z","updated":"2024-10-09T20:55:28.951Z","title":"Apache Cassandra: Privilege escalation when enabling FQL/Audit logs","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.00344,"kevAdded":null},{"id":"CVE-2022-46907","published":"2023-05-25T06:58:18.912Z","updated":"2025-02-13T16:33:58.435Z","title":"Apache JSPWiki: XSS Injection points in several plugins","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.01162,"kevAdded":null},{"id":"CVE-2023-33246","published":"2023-05-24T14:45:25.684Z","updated":"2025-10-21T23:05:47.340Z","title":"Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache RocketMQ","kev":true,"epss":0.96568,"kevAdded":"2023-09-06"},{"id":"CVE-2023-31062","published":"2023-05-22T15:47:35.709Z","updated":"2024-10-09T19:55:50.624Z","title":"Apache InLong: Privilege escalation vulnerability for InLong","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01289,"kevAdded":null},{"id":"CVE-2023-31064","published":"2023-05-22T15:44:22.343Z","updated":"2024-10-09T19:53:56.810Z","title":"Apache InLong: Insecurity direct object references cancelling applications","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01247,"kevAdded":null},{"id":"CVE-2023-31065","published":"2023-05-22T15:40:56.183Z","updated":"2024-10-09T17:18:40.599Z","title":"Apache InLong: Insufficient Session Expiration in InLong","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01162,"kevAdded":null},{"id":"CVE-2023-31066","published":"2023-05-22T15:35:41.768Z","updated":"2024-10-09T17:17:20.748Z","title":"Apache InLong: Insecure direct object references for inlong sources","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01355,"kevAdded":null},{"id":"CVE-2023-31098","published":"2023-05-22T15:31:53.989Z","updated":"2024-10-11T13:59:56.171Z","title":"Apache InLong: Weak Password Implementation in InLong","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01233,"kevAdded":null},{"id":"CVE-2023-31101","published":"2023-05-22T15:17:42.609Z","updated":"2024-10-11T13:53:51.731Z","title":"Apache InLong: Users who joined later can see the data of deleted users","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.0111,"kevAdded":null},{"id":"CVE-2023-31103","published":"2023-05-22T15:13:30.690Z","updated":"2024-10-11T13:51:46.298Z","title":"Apache InLong: Attackers can change the immutable name and type of cluster","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01304,"kevAdded":null},{"id":"CVE-2023-31206","published":"2023-05-22T13:58:19.083Z","updated":"2024-10-11T13:50:02.517Z","title":"Apache InLong: Attackers can change the immutable name and type of nodes","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01247,"kevAdded":null},{"id":"CVE-2023-31453","published":"2023-05-22T13:25:47.820Z","updated":"2024-10-11T13:46:50.433Z","title":"Apache InLong: IDOR make users can delete others' subscription","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01182,"kevAdded":null},{"id":"CVE-2023-31454","published":"2023-05-22T13:23:17.332Z","updated":"2024-10-09T17:14:26.742Z","title":"Apache InLong: IDOR make users can bind any cluster","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01182,"kevAdded":null},{"id":"CVE-2023-31058","published":"2023-05-22T12:54:12.153Z","updated":"2024-10-10T20:51:23.077Z","title":"Apache InLong: JDBC URL bypassing by adding blanks","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01228,"kevAdded":null},{"id":"CVE-2023-28709","published":"2023-05-22T10:08:49.541Z","updated":"2025-02-13T16:48:49.704Z","title":"Apache Tomcat: Fix for CVE-2023-24998 is incomplete","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.48031,"kevAdded":null},{"id":"CVE-2022-47937","published":"2023-05-15T09:20:23.238Z","updated":"2024-10-10T20:47:45.503Z","title":"Multiple parsing problems in the Apache Sling Commons JSON module","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"org.apache.sling.commons.json","kev":false,"epss":0.02187,"kevAdded":null},{"id":"CVE-2023-28936","published":"2023-05-12T07:45:04.835Z","updated":"2024-10-10T20:30:03.380Z","title":"Apache OpenMeetings: insufficient check of invitation hash","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01204,"kevAdded":null},{"id":"CVE-2023-29032","published":"2023-05-12T07:43:30.483Z","updated":"2024-10-10T19:48:37.089Z","title":"Apache OpenMeetings: allows bypass authentication","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01093,"kevAdded":null},{"id":"CVE-2023-29246","published":"2023-05-12T07:43:20.422Z","updated":"2024-10-10T19:35:57.172Z","title":"Apache OpenMeetings: allows null-byte Injection","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01464,"kevAdded":null},{"id":"CVE-2023-25754","published":"2023-05-08T11:57:45.144Z","updated":"2025-02-13T16:44:37.529Z","title":"Apache Airflow: Privilege escalation using airflow logs","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0228,"kevAdded":null},{"id":"CVE-2023-29247","published":"2023-05-08T09:01:40.033Z","updated":"2024-10-15T18:26:11.465Z","title":"Stored XSS on Apache Airflow","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01984,"kevAdded":null},{"id":"CVE-2023-31039","published":"2023-05-08T08:57:14.714Z","updated":"2025-02-13T16:49:42.005Z","title":"Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache bRPC","kev":false,"epss":0.01522,"kevAdded":null},{"id":"CVE-2023-31038","published":"2023-05-08T08:54:10.234Z","updated":"2024-10-15T18:24:15.291Z","title":"Apache Log4cxx: SQL injection when using ODBC appender","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Log4cxx","kev":false,"epss":0.01597,"kevAdded":null},{"id":"CVE-2021-40331","published":"2023-05-05T07:55:06.554Z","updated":"2024-10-11T17:07:19.817Z","title":"Permissions problem in the Apache Ranger Hive Plugin","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Ranger Hive Plugin","kev":false,"epss":0.00918,"kevAdded":null},{"id":"CVE-2022-45048","published":"2023-05-05T07:50:25.762Z","updated":"2024-10-15T18:12:43.127Z","title":"Apache Ranger: code execution vulnerability in policy expressions","severity":"HIGH","score":8.4,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.01126,"kevAdded":null},{"id":"CVE-2023-26268","published":"2023-05-02T20:06:09.352Z","updated":"2024-10-15T18:11:19.560Z","title":"Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes","severity":"MEDIUM","score":4.4,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.01429,"kevAdded":null},{"id":"CVE-2023-32007","published":"2023-05-02T08:37:22.118Z","updated":"2025-02-13T16:50:19.521Z","title":"Apache Spark: Shell command injection via Spark UI","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.75955,"kevAdded":null},{"id":"CVE-2022-46365","published":"2023-05-01T14:53:50.130Z","updated":"2024-10-15T16:43:14.987Z","title":"Apache StreamPark (incubating): Logic error causing any account reset","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.01475,"kevAdded":null},{"id":"CVE-2022-45801","published":"2023-05-01T14:50:11.110Z","updated":"2024-10-15T16:05:19.229Z","title":"Apache StreamPark (incubating): LDAP Injection Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.01103,"kevAdded":null},{"id":"CVE-2022-45802","published":"2023-05-01T14:04:57.625Z","updated":"2024-10-21T15:10:45.155Z","title":"Apache StreamPark (incubating): Upload any file to any directory","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache StreamPark (incubating)","kev":false,"epss":0.01308,"kevAdded":null},{"id":"CVE-2023-22665","published":"2023-04-25T06:44:21.516Z","updated":"2025-02-13T16:44:03.940Z","title":"Apache Jena: Exposure of arbitrary execution in script engine expressions.","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Jena","kev":false,"epss":0.01335,"kevAdded":null},{"id":"CVE-2023-30776","published":"2023-04-24T15:29:53.498Z","updated":"2024-10-21T15:08:55.113Z","title":"Apache Superset: Database connection password leak","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.02067,"kevAdded":null},{"id":"CVE-2023-27524","published":"2023-04-24T15:28:16.573Z","updated":"2025-10-21T23:05:48.552Z","title":"Apache Superset: Session validation vulnerability when using provided default SECRET_KEY","severity":"HIGH","score":8.9,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":true,"epss":0.98148,"kevAdded":"2024-01-08"},{"id":"CVE-2023-25601","published":"2023-04-20T15:07:00.310Z","updated":"2025-02-13T16:44:34.179Z","title":"Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01127,"kevAdded":null},{"id":"CVE-2023-25504","published":"2023-04-17T16:29:43.729Z","updated":"2025-02-13T16:44:30.258Z","title":"Apache Superset: Possible SSRF on import datasets","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00957,"kevAdded":null},{"id":"CVE-2023-27525","published":"2023-04-17T16:28:00.286Z","updated":"2024-10-15T16:04:34.641Z","title":"Apache Superset: Incorrect default permissions for Gamma role","severity":"LOW","score":3.1,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0078,"kevAdded":null},{"id":"CVE-2023-22946","published":"2023-04-17T07:30:19.865Z","updated":"2024-10-21T15:06:58.145Z","title":"Apache Spark proxy-user privilege escalation from malicious configuration class","severity":"MEDIUM","score":6.4,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.01109,"kevAdded":null},{"id":"CVE-2023-30771","published":"2023-04-17T07:26:12.996Z","updated":"2025-02-13T16:49:35.515Z","title":"Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB Workbench","kev":false,"epss":0.01447,"kevAdded":null},{"id":"CVE-2023-24831","published":"2023-04-17T06:42:06.404Z","updated":"2024-10-21T14:17:36.529Z","title":"Apache IoTDB grafana-connector Login Bypass Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01222,"kevAdded":null},{"id":"CVE-2022-47501","published":"2023-04-14T15:01:31.987Z","updated":"2025-02-13T16:34:00.709Z","title":"Apache OFBiz: Arbitrary file reading vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.1018,"kevAdded":null},{"id":"CVE-2022-45064","published":"2023-04-13T10:01:14.502Z","updated":"2024-10-17T20:31:19.485Z","title":"Apache Sling Engine: Include-based XSS","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache Sling Engine","kev":false,"epss":0.01121,"kevAdded":null},{"id":"CVE-2023-30465","published":"2023-04-11T14:35:11.308Z","updated":"2025-02-13T16:49:29.206Z","title":"Apache InLong: SQL injection in apache inLong 1.5.0","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01164,"kevAdded":null},{"id":"CVE-2023-29216","published":"2023-04-10T07:37:29.383Z","updated":"2025-02-13T16:49:02.797Z","title":"Apache Linkis DatasourceManager module has a deserialization command execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.0212,"kevAdded":null},{"id":"CVE-2023-27987","published":"2023-04-10T07:37:07.558Z","updated":"2024-10-17T20:20:41.204Z","title":"Apache Linkis gateway module token authentication bypass","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.00811,"kevAdded":null},{"id":"CVE-2023-27603","published":"2023-04-10T07:36:50.250Z","updated":"2024-10-22T15:24:50.114Z","title":"Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.01808,"kevAdded":null},{"id":"CVE-2023-27602","published":"2023-04-10T07:36:28.437Z","updated":"2025-02-13T16:45:29.640Z","title":"Apache Linkis publicsercice module unrestricted upload of file","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.01996,"kevAdded":null},{"id":"CVE-2023-29215","published":"2023-04-10T07:35:23.690Z","updated":"2025-02-13T16:49:02.260Z","title":"Apache Linkis JDBC EngineCon  has a deserialization command execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.0212,"kevAdded":null},{"id":"CVE-2023-28710","published":"2023-04-07T14:55:44.450Z","updated":"2024-10-22T15:30:02.808Z","title":"Apache Airflow Spark Provider Arbitrary File Read via JDBC","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Spark Provider","kev":false,"epss":0.02152,"kevAdded":null},{"id":"CVE-2023-28706","published":"2023-04-07T14:54:37.177Z","updated":"2024-10-22T15:31:35.270Z","title":"Apache Airflow Hive Provider Beeline Remote Command Execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Hive Provider","kev":false,"epss":0.02765,"kevAdded":null},{"id":"CVE-2023-28707","published":"2023-04-07T14:53:24.274Z","updated":"2025-02-13T16:48:49.151Z","title":"Airflow Apache Drill Provider Arbitrary File Read Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Drill Provider","kev":false,"epss":0.02062,"kevAdded":null},{"id":"CVE-2023-26269","published":"2023-04-03T07:59:13.228Z","updated":"2025-02-13T16:44:53.250Z","title":"Apache James server: Privilege escalation through unauthenticated JMX","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache James server","kev":false,"epss":0.00654,"kevAdded":null},{"id":"CVE-2023-28935","published":"2023-03-30T09:10:11.178Z","updated":"2024-10-23T15:12:10.819Z","title":"Apache UIMA DUCC: DUCC (EOL) allows RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache UIMA DUCC","kev":false,"epss":0.02872,"kevAdded":null},{"id":"CVE-2023-28158","published":"2023-03-29T12:21:46.932Z","updated":"2025-02-13T16:45:40.751Z","title":"Apache Archiva privilege escalation","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.01162,"kevAdded":null},{"id":"CVE-2023-28326","published":"2023-03-28T12:36:11.566Z","updated":"2024-10-23T15:13:50.704Z","title":"Apache OpenMeetings: allows user impersonation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01262,"kevAdded":null},{"id":"CVE-2023-25197","published":"2023-03-28T11:17:19.026Z","updated":"2024-10-23T15:14:18.730Z","title":"apache fineract: SQL injection vulnerability in certain procedure calls","severity":"MEDIUM","score":6.3,"vendor":"Apache Software Foundation","product":"apache fineract","kev":false,"epss":0.01055,"kevAdded":null},{"id":"CVE-2023-25196","published":"2023-03-28T11:16:57.603Z","updated":"2024-10-23T15:14:44.993Z","title":"Apache Fineract: SQL injection vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.01297,"kevAdded":null},{"id":"CVE-2023-25195","published":"2023-03-28T11:16:28.304Z","updated":"2024-10-23T15:16:08.717Z","title":"Apache Fineract: SSRF template type vulnerability in certain authenticated users","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.00982,"kevAdded":null},{"id":"CVE-2023-27296","published":"2023-03-27T14:10:32.785Z","updated":"2024-10-23T16:39:30.822Z","title":"Apache InLong: JDBC Deserialization Vulnerability in InLong","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01475,"kevAdded":null},{"id":"CVE-2022-47502","published":"2023-03-24T15:57:28.611Z","updated":"2025-02-13T16:34:01.266Z","title":"Apache OpenOffice: Macro URL arbitrary script execution","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00958,"kevAdded":null},{"id":"CVE-2022-38745","published":"2023-03-24T15:56:48.549Z","updated":"2025-02-13T14:38:34.784Z","title":"Apache OpenOffice: Empty entry in Java class path","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00872,"kevAdded":null},{"id":"CVE-2023-28708","published":"2023-03-22T10:10:58.956Z","updated":"2025-11-04T19:15:54.760Z","title":"Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01831,"kevAdded":null},{"id":"CVE-2023-26513","published":"2023-03-20T12:20:17.346Z","updated":"2025-02-13T14:32:39.905Z","title":"Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Sling Resource Merger","kev":false,"epss":0.01464,"kevAdded":null},{"id":"CVE-2023-25695","published":"2023-03-15T09:37:11.437Z","updated":"2025-02-13T14:29:40.759Z","title":"Information disclosure in Apache Airflow","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01382,"kevAdded":null},{"id":"CVE-2023-26464","published":"2023-03-10T13:38:16.190Z","updated":"2025-02-13T16:44:55.555Z","title":"Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Log4j","kev":false,"epss":0.01905,"kevAdded":null},{"id":"CVE-2023-23638","published":"2023-03-08T10:48:58.574Z","updated":"2024-10-23T16:41:29.622Z","title":"Apache Dubbo Deserialization Vulnerability Gadgets Bypass","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.04887,"kevAdded":null},{"id":"CVE-2023-27522","published":"2023-03-07T15:09:30.122Z","updated":"2025-02-13T16:45:26.302Z","title":"Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.02134,"kevAdded":null},{"id":"CVE-2023-25690","published":"2023-03-07T15:09:03.080Z","updated":"2025-12-18T15:37:41.866Z","title":"Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.84508,"kevAdded":null},{"id":"CVE-2023-25956","published":"2023-02-24T11:48:33.110Z","updated":"2024-10-23T16:44:57.125Z","title":"Apache Airflow AWS Provider: Arbitrary file read via AWS provider","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow AWS Provider","kev":false,"epss":0.01499,"kevAdded":null},{"id":"CVE-2023-25696","published":"2023-02-24T11:48:21.189Z","updated":"2024-10-23T19:10:47.536Z","title":"Apache Airflow Hive Provider Beeline RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Hive Provider","kev":false,"epss":0.01982,"kevAdded":null},{"id":"CVE-2023-25693","published":"2023-02-24T11:48:11.397Z","updated":"2025-02-13T14:27:04.792Z","title":"Sqoop Apache Airflow Provider Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Sqoop Provider","kev":false,"epss":0.01895,"kevAdded":null},{"id":"CVE-2023-25692","published":"2023-02-24T11:48:00.202Z","updated":"2025-03-11T20:36:18.446Z","title":"Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Google Provider","kev":false,"epss":0.01826,"kevAdded":null},{"id":"CVE-2023-25691","published":"2023-02-24T11:35:49.091Z","updated":"2025-03-11T20:44:52.284Z","title":"Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Google Provider","kev":false,"epss":0.01597,"kevAdded":null},{"id":"CVE-2023-25621","published":"2023-02-23T08:42:37.104Z","updated":"2025-03-18T15:01:24.410Z","title":"Apache Sling does not allow to handle i18n content in a secure way","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Sling","kev":false,"epss":0.01148,"kevAdded":null},{"id":"CVE-2023-24998","published":"2023-02-20T15:57:07.372Z","updated":"2026-10-07T16:20:25.380Z","title":"Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons FileUpload","kev":false,"epss":0.48788,"kevAdded":null},{"id":"CVE-2023-25613","published":"2023-02-20T15:29:39.154Z","updated":"2024-08-02T11:25:19.226Z","title":"LDAP Injection Vulnerability in Apache Kerby","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kerby LDAP Backend","kev":false,"epss":0.01491,"kevAdded":null},{"id":"CVE-2022-42735","published":"2023-02-15T09:38:55.301Z","updated":"2025-03-19T15:27:12.113Z","title":"Apache ShenYu Admin ultra vires","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ShenYu","kev":false,"epss":0.0119,"kevAdded":null},{"id":"CVE-2023-25141","published":"2023-02-14T12:12:21.224Z","updated":"2025-03-20T18:11:22.386Z","title":"JNDI injection into Apache sling-org-apache-sling-jcr-base","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Sling JCR Base","kev":false,"epss":0.0116,"kevAdded":null},{"id":"CVE-2023-22832","published":"2023-02-10T07:45:36.964Z","updated":"2025-03-24T16:31:38.479Z","title":"Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0141,"kevAdded":null},{"id":"CVE-2023-25194","published":"2023-02-07T19:11:22.260Z","updated":"2025-03-25T14:12:50.930Z","title":"Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kafka Connect API","kev":false,"epss":0.9581,"kevAdded":null},{"id":"CVE-2022-45786","published":"2023-02-04T20:40:58.631Z","updated":"2025-03-26T13:58:49.953Z","title":"Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache AGE","kev":false,"epss":0.00956,"kevAdded":null},{"id":"CVE-2023-22849","published":"2023-02-04T20:37:05.831Z","updated":"2025-03-25T18:51:46.346Z","title":"Apache Sling App CMS: XSS in CMS Reference / UI Components","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling App CMS","kev":false,"epss":0.01445,"kevAdded":null},{"id":"CVE-2023-24997","published":"2023-02-01T14:49:44.930Z","updated":"2025-03-26T14:33:30.143Z","title":"Apache InLong: Jdbc Connection Security Bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.01325,"kevAdded":null},{"id":"CVE-2023-24977","published":"2023-02-01T09:09:55.963Z","updated":"2025-03-27T13:34:22.350Z","title":"Apache InLong: Jdbc Connection causes arbitrary file reading in InLong","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.0116,"kevAdded":null},{"id":"CVE-2022-28331","published":"2023-01-31T15:55:21.488Z","updated":"2025-03-27T14:31:30.494Z","title":"Apache Portable Runtime (APR):  Windows out-of-bounds write in apr_socket_sendv function","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime (APR)","kev":false,"epss":0.01575,"kevAdded":null},{"id":"CVE-2022-25147","published":"2023-01-31T15:54:51.395Z","updated":"2025-02-13T16:32:27.154Z","title":"Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime Utility (APR-util)","kev":false,"epss":0.01429,"kevAdded":null},{"id":"CVE-2022-24963","published":"2023-01-31T15:52:09.716Z","updated":"2025-03-27T14:33:39.826Z","title":"Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime (APR)","kev":false,"epss":0.01472,"kevAdded":null},{"id":"CVE-2022-44644","published":"2023-01-31T09:40:52.676Z","updated":"2025-03-27T14:34:42.612Z","title":"Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Linkis (incubating)","kev":false,"epss":0.01161,"kevAdded":null},{"id":"CVE-2022-44645","published":"2023-01-31T09:38:07.355Z","updated":"2025-03-27T14:35:59.646Z","title":"Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Linkis (incubating)","kev":false,"epss":0.01933,"kevAdded":null},{"id":"CVE-2023-24829","published":"2023-01-31T09:22:41.587Z","updated":"2025-03-27T17:13:42.494Z","title":"Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB Workbench","kev":false,"epss":0.01245,"kevAdded":null},{"id":"CVE-2023-24830","published":"2023-01-30T16:25:33.163Z","updated":"2025-03-28T14:24:59.531Z","title":"Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB Workbench","kev":false,"epss":0.01331,"kevAdded":null},{"id":"CVE-2023-22884","published":"2023-01-21T13:02:49.475Z","updated":"2025-03-31T14:53:54.464Z","title":"Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.11906,"kevAdded":null},{"id":"CVE-2022-37436","published":"2023-01-17T19:12:59.968Z","updated":"2025-04-04T18:06:37.763Z","title":"Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.55911,"kevAdded":null},{"id":"CVE-2022-36760","published":"2023-01-17T19:11:55.106Z","updated":"2025-04-04T18:08:02.696Z","title":"Apache HTTP Server: mod_proxy_ajp Possible request smuggling","severity":"CRITICAL","score":9,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.01931,"kevAdded":null},{"id":"CVE-2006-20001","published":"2023-01-17T19:07:27.136Z","updated":"2025-02-13T16:27:07.996Z","title":"Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.03583,"kevAdded":null},{"id":"CVE-2022-41703","published":"2023-01-16T10:14:01.332Z","updated":"2025-04-08T20:33:49.417Z","title":"Apache Superset: SQL injection vulnerability in adhoc clauses","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01237,"kevAdded":null},{"id":"CVE-2022-45438","published":"2023-01-16T10:12:02.872Z","updated":"2025-04-07T14:59:56.105Z","title":"Apache Superset: Dashboard metadata information leak","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01273,"kevAdded":null},{"id":"CVE-2022-43721","published":"2023-01-16T10:10:52.583Z","updated":"2025-04-07T15:01:48.626Z","title":"Apache Superset: Open Redirect Vulnerability","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0103,"kevAdded":null},{"id":"CVE-2022-43720","published":"2023-01-16T10:10:41.565Z","updated":"2025-04-07T15:03:05.455Z","title":"Apache Superset: Improper rendering of user input","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01288,"kevAdded":null},{"id":"CVE-2022-43719","published":"2023-01-16T10:10:27.487Z","updated":"2025-04-07T15:04:38.899Z","title":"Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.00587,"kevAdded":null},{"id":"CVE-2022-43718","published":"2023-01-16T10:10:04.630Z","updated":"2025-04-07T15:06:28.119Z","title":"Apache Superset: Cross-Site Scripting vulnerability on upload forms","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01173,"kevAdded":null},{"id":"CVE-2022-43717","published":"2023-01-16T10:08:04.670Z","updated":"2025-04-04T13:54:56.210Z","title":"Apache Superset: Cross-Site Scripting on dashboards","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01285,"kevAdded":null},{"id":"CVE-2023-22602","published":"2023-01-14T09:33:39.775Z","updated":"2024-08-02T10:13:49.411Z","title":"Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.01596,"kevAdded":null},{"id":"CVE-2022-46769","published":"2023-01-09T10:14:56.823Z","updated":"2025-04-09T19:26:54.690Z","title":"Apache Sling App CMS: XSS in CMS Site Group Detail","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Sling App CMS","kev":false,"epss":0.0142,"kevAdded":null},{"id":"CVE-2022-45935","published":"2023-01-06T09:33:30.150Z","updated":"2025-04-10T13:35:31.647Z","title":"Apache James server: Temporary File Information Disclosure","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache James server","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2022-45787","published":"2023-01-06T09:31:40.118Z","updated":"2025-04-09T19:32:09.206Z","title":"Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache James MIME4J","kev":false,"epss":0.00279,"kevAdded":null},{"id":"CVE-2022-45875","published":"2023-01-04T14:57:45.334Z","updated":"2025-04-03T15:27:57.287Z","title":"Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.02754,"kevAdded":null},{"id":"CVE-2022-45143","published":"2023-01-03T18:12:28.351Z","updated":"2024-08-03T14:09:56.475Z","title":"Apache Tomcat: JsonErrorReportValve escaping","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02669,"kevAdded":null},{"id":"CVE-2022-44621","published":"2022-12-30T10:31:52.614Z","updated":"2025-04-11T14:45:20.170Z","title":"Apache Kylin: Command injection by Diagnosis Controller","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.03052,"kevAdded":null},{"id":"CVE-2022-43396","published":"2022-12-30T10:30:45.627Z","updated":"2025-04-11T14:49:56.691Z","title":"Apache Kylin: Command injection by Useless configuration","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.55279,"kevAdded":null},{"id":"CVE-2022-45347","published":"2022-12-22T10:47:44.716Z","updated":"2025-04-15T13:41:08.826Z","title":"Apache ShardingSphere-Proxy: MySQL authentication bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache ShardingSphere-Proxy","kev":false,"epss":0.01479,"kevAdded":null},{"id":"CVE-2022-40145","published":"2022-12-21T15:23:42.847Z","updated":"2025-04-15T18:03:47.618Z","title":"Apache Karaf: JDBC JAAS LDAP injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.02596,"kevAdded":null},{"id":"CVE-2022-46421","published":"2022-12-20T10:20:39.431Z","updated":"2025-04-16T18:10:28.787Z","title":"Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Hive Provider","kev":false,"epss":0.03286,"kevAdded":null},{"id":"CVE-2022-40743","published":"2022-12-19T11:06:14.186Z","updated":"2025-04-17T14:19:43.233Z","title":"Apache Traffic Server: Security issues with the xdebug plugin","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01149,"kevAdded":null},{"id":"CVE-2022-37392","published":"2022-12-19T10:59:05.957Z","updated":"2025-04-17T14:20:28.706Z","title":"Apache Traffic Server: Improperly reading the client requests","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01175,"kevAdded":null},{"id":"CVE-2022-32749","published":"2022-12-19T10:51:57.466Z","updated":"2025-04-17T14:21:28.511Z","title":"Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01386,"kevAdded":null},{"id":"CVE-2022-47500","published":"2022-12-19T10:03:41.428Z","updated":"2025-04-17T14:22:18.663Z","title":"Apache Helix: Open redirect","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Helix","kev":false,"epss":0.01122,"kevAdded":null},{"id":"CVE-2022-46870","published":"2022-12-16T12:55:37.597Z","updated":"2025-04-17T15:36:28.153Z","title":"Apache Zeppelin: Stored XSS in note permissions","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01192,"kevAdded":null},{"id":"CVE-2021-28655","published":"2022-12-16T12:51:51.927Z","updated":"2025-04-17T15:37:14.575Z","title":"Apache Zeppelin: Arbitrary file deletion vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.01641,"kevAdded":null},{"id":"CVE-2022-32531","published":"2022-12-15T10:17:19.660Z","updated":"2025-04-17T18:20:47.178Z","title":"Apache BookKeeper: Java Client Uses Connection to Host that Failed Hostname Verification","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache BookKeeper","kev":false,"epss":0.01088,"kevAdded":null},{"id":"CVE-2022-34271","published":"2022-12-14T08:35:59.499Z","updated":"2025-04-18T14:28:47.874Z","title":"Apache Atlas: zip path traversal in import functionality","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.01476,"kevAdded":null},{"id":"CVE-2022-46364","published":"2022-12-13T16:20:26.765Z","updated":"2025-04-22T02:48:36.211Z","title":"Apache CXF SSRF Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.02315,"kevAdded":null},{"id":"CVE-2022-46363","published":"2022-12-13T14:46:55.619Z","updated":"2025-04-22T02:50:45.431Z","title":"Apache CXF directory listing / code exfiltration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.01261,"kevAdded":null},{"id":"CVE-2022-45910","published":"2022-12-07T09:50:52.700Z","updated":"2025-04-22T21:02:38.711Z","title":"Apache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory Authorities","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache ManifoldCF","kev":false,"epss":0.01567,"kevAdded":null},{"id":"CVE-2021-37533","published":"2022-12-03T00:00:00.000Z","updated":"2025-04-24T15:25:18.237Z","title":"Apache Commons Net's FTP client trusts the host from PASV response by default","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Commons Net","kev":false,"epss":0.02129,"kevAdded":null},{"id":"CVE-2022-46366","published":"2022-12-02T00:00:00.000Z","updated":"2024-08-03T14:31:46.317Z","title":"Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tapestry","kev":false,"epss":0.03523,"kevAdded":null},{"id":"CVE-2022-44635","published":"2022-11-29T00:00:00.000Z","updated":"2025-04-25T14:51:14.718Z","title":"Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.68802,"kevAdded":null},{"id":"CVE-2022-26885","published":"2022-11-24T00:00:00.000Z","updated":"2025-04-25T18:17:36.266Z","title":"Apache DolphinScheduler config file read by task risk","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01362,"kevAdded":null},{"id":"CVE-2022-45462","published":"2022-11-23T00:00:00.000Z","updated":"2025-04-25T19:08:33.652Z","title":"Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.02886,"kevAdded":null},{"id":"CVE-2022-41131","published":"2022-11-22T00:00:00.000Z","updated":"2025-04-29T15:11:16.156Z","title":"Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Hive Provider","kev":false,"epss":0.01764,"kevAdded":null},{"id":"CVE-2022-40954","published":"2022-11-22T00:00:00.000Z","updated":"2025-04-29T13:50:28.084Z","title":"Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Airflow Spark Provider","kev":false,"epss":0.0139,"kevAdded":null},{"id":"CVE-2022-40189","published":"2022-11-22T00:00:00.000Z","updated":"2025-04-29T04:25:48.603Z","title":"Apache Airlfow Pig Provider RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airlfow Pig Provider","kev":false,"epss":0.04158,"kevAdded":null},{"id":"CVE-2022-38649","published":"2022-11-22T00:00:00.000Z","updated":"2025-04-29T04:35:58.414Z","title":"Apache Airflow Pinot provider allowed Command Injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow Pinot Provider","kev":false,"epss":0.03404,"kevAdded":null},{"id":"CVE-2022-45470","published":"2022-11-21T00:00:00.000Z","updated":"2025-04-29T13:56:28.845Z","title":"Apache Hama allows XSS and information disclosure","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Hama","kev":false,"epss":0.01367,"kevAdded":null},{"id":"CVE-2022-45047","published":"2022-11-16T00:00:00.000Z","updated":"2026-05-01T15:28:31.575Z","title":"Apache MINA SSHD: Java unsafe deserialization vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache MINA SSHD","kev":false,"epss":0.0381,"kevAdded":null},{"id":"CVE-2022-45402","published":"2022-11-15T00:00:00.000Z","updated":"2025-04-30T15:55:11.656Z","title":"Apache Airflow: Open redirect during login","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.81836,"kevAdded":null},{"id":"CVE-2022-40309","published":"2022-11-15T00:00:00.000Z","updated":"2025-04-30T16:02:30.071Z","title":"Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.01496,"kevAdded":null},{"id":"CVE-2022-40308","published":"2022-11-15T00:00:00.000Z","updated":"2025-04-30T16:03:13.651Z","title":"Apache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary files","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.01316,"kevAdded":null},{"id":"CVE-2022-45378","published":"2022-11-14T00:00:00.000Z","updated":"2024-08-03T14:09:56.954Z","title":"Apache SOAP allows unauthenticated users to potentially invoke arbitrary code","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache SOAP","kev":false,"epss":0.02466,"kevAdded":null},{"id":"CVE-2022-45136","published":"2022-11-14T00:00:00.000Z","updated":"2024-08-03T14:09:56.492Z","title":"Apache Jena SDB allows arbitrary deserialisation via JDBC","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Jena SDB","kev":false,"epss":0.01658,"kevAdded":null},{"id":"CVE-2022-40127","published":"2022-11-14T00:00:00.000Z","updated":"2025-04-30T18:58:45.160Z","title":"Apache Airflow <2.4.0 has an RCE in a bash example","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.85653,"kevAdded":null},{"id":"CVE-2022-27949","published":"2022-11-14T00:00:00.000Z","updated":"2025-04-30T19:44:13.705Z","title":"Apache Airflow prior to 2.3.1 may include sensitive values in rendered template","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01992,"kevAdded":null},{"id":"CVE-2022-42920","published":"2022-11-07T00:00:00.000Z","updated":"2024-08-03T13:19:05.457Z","title":"Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Commons BCEL","kev":false,"epss":0.03501,"kevAdded":null},{"id":"CVE-2022-37866","published":"2022-11-07T00:00:00.000Z","updated":"2025-05-01T20:46:04.704Z","title":"Apache Ivy allows path traversal in the presence of a malicious repository","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ivy","kev":false,"epss":0.01906,"kevAdded":null},{"id":"CVE-2022-37865","published":"2022-11-07T00:00:00.000Z","updated":"2025-05-02T18:35:06.895Z","title":"Apache Ivy allows creating/overwriting any file on the system","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Ivy","kev":false,"epss":0.02139,"kevAdded":null},{"id":"CVE-2022-33684","published":"2022-11-04T00:00:00.000Z","updated":"2025-05-02T18:58:10.037Z","title":"Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00929,"kevAdded":null},{"id":"CVE-2022-32287","published":"2022-11-03T00:00:00.000Z","updated":"2025-05-02T20:24:43.887Z","title":"Apache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache UIMA","kev":false,"epss":0.02076,"kevAdded":null},{"id":"CVE-2022-43985","published":"2022-11-02T00:00:00.000Z","updated":"2025-05-02T20:26:58.562Z","title":"Apache Airflow prior to 2.4.2 has an open redirect","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01831,"kevAdded":null},{"id":"CVE-2022-43982","published":"2022-11-02T00:00:00.000Z","updated":"2025-05-02T20:27:57.851Z","title":"Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01759,"kevAdded":null},{"id":"CVE-2022-43670","published":"2022-11-02T00:00:00.000Z","updated":"2025-05-02T20:28:50.391Z","title":"XSS in Sling CMS Reference App Taxonomy Path","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Sling App CMS","kev":false,"epss":0.01697,"kevAdded":null},{"id":"CVE-2022-42252","published":"2022-11-01T00:00:00.000Z","updated":"2025-05-06T15:09:20.374Z","title":"Apache Tomcat request smuggling via malformed content-length","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0178,"kevAdded":null},{"id":"CVE-2022-34662","published":"2022-11-01T00:00:00.000Z","updated":"2025-05-06T03:17:02.317Z","title":"Apache DolphinScheduler prior to 3.0.0 allows path traversal","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01728,"kevAdded":null},{"id":"CVE-2022-31777","published":"2022-11-01T00:00:00.000Z","updated":"2025-05-06T03:36:31.908Z","title":"Apache Spark XSS vulnerability in log viewer UI Javascript","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.0182,"kevAdded":null},{"id":"CVE-2022-26884","published":"2022-10-28T00:00:00.000Z","updated":"2025-05-07T15:36:46.343Z","title":"Apache DolphinScheduler exposes files without authentication","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01821,"kevAdded":null},{"id":"CVE-2022-43766","published":"2022-10-26T00:00:00.000Z","updated":"2025-05-07T13:39:27.151Z","title":"Apache IoTDB prior to 0.13.3 allows DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01584,"kevAdded":null},{"id":"CVE-2022-42468","published":"2022-10-26T00:00:00.000Z","updated":"2025-05-07T13:53:00.467Z","title":"Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Flume","kev":false,"epss":0.03722,"kevAdded":null},{"id":"CVE-2022-39944","published":"2022-10-26T00:00:00.000Z","updated":"2025-05-07T18:33:27.944Z","title":"The Apache Linkis JDBC EngineConn module has a RCE Vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Linkis","kev":false,"epss":0.02237,"kevAdded":null},{"id":"CVE-2022-42890","published":"2022-10-25T00:00:00.000Z","updated":"2024-08-03T13:19:05.216Z","title":"Apache Batik prior to 1.16 allows RCE via scripting","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XML Graphics","kev":false,"epss":0.03355,"kevAdded":null},{"id":"CVE-2022-41704","published":"2022-10-25T00:00:00.000Z","updated":"2026-02-25T16:56:27.451Z","title":"Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XML Graphics","kev":false,"epss":0.03099,"kevAdded":null},{"id":"CVE-2022-34870","published":"2022-10-25T00:00:00.000Z","updated":"2025-05-09T18:54:23.644Z","title":"Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.01375,"kevAdded":null},{"id":"CVE-2021-42010","published":"2022-10-24T00:00:00.000Z","updated":"2025-05-07T15:53:35.603Z","title":"CRLF log injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Heron (Incubating)","kev":false,"epss":0.0176,"kevAdded":null},{"id":"CVE-2022-42467","published":"2022-10-19T00:00:00.000Z","updated":"2024-08-03T13:10:40.997Z","title":"h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Isis","kev":false,"epss":0.0162,"kevAdded":null},{"id":"CVE-2022-42466","published":"2022-10-19T00:00:00.000Z","updated":"2025-05-08T19:54:09.104Z","title":"XSS vulnerability, eg for String properties.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Isis","kev":false,"epss":0.01444,"kevAdded":null},{"id":"CVE-2022-39198","published":"2022-10-18T00:00:00.000Z","updated":"2025-05-13T14:48:42.604Z","title":"Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.03308,"kevAdded":null},{"id":"CVE-2022-42889","published":"2022-10-13T00:00:00.000Z","updated":"2024-11-20T16:19:41.416Z","title":"Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Commons Text","kev":false,"epss":0.99931,"kevAdded":null},{"id":"CVE-2022-24697","published":"2022-10-13T00:00:00.000Z","updated":"2025-05-16T13:42:57.582Z","title":"Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.84777,"kevAdded":null},{"id":"CVE-2022-40664","published":"2022-10-12T00:00:00.000Z","updated":"2025-05-15T15:02:41.513Z","title":"Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.03615,"kevAdded":null},{"id":"CVE-2022-41672","published":"2022-10-07T00:00:00.000Z","updated":"2024-08-03T12:49:43.427Z","title":"Session still functional after user is deactivated","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01478,"kevAdded":null},{"id":"CVE-2022-40160","published":"2022-10-06T00:00:00.000Z","updated":"2024-08-03T12:14:39.660Z","title":"Stack Overflow in JXPath","severity":"MEDIUM","score":6.5,"vendor":"jxpath","product":"jxpath","kev":false,"epss":0.01437,"kevAdded":null},{"id":"CVE-2022-40159","published":"2022-10-06T00:00:00.000Z","updated":"2024-08-03T12:14:39.803Z","title":"Stack Overflow in JXPath","severity":"MEDIUM","score":6.5,"vendor":"jxpath","product":"jxpath","kev":false,"epss":0.01437,"kevAdded":null},{"id":"CVE-2021-43980","published":"2022-09-28T00:00:00.000Z","updated":"2025-05-21T15:00:10.097Z","title":"Apache Tomcat: Information disclosure","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.02362,"kevAdded":null},{"id":"CVE-2022-33683","published":"2022-09-23T09:25:15.000Z","updated":"2025-05-22T18:27:17.447Z","title":"Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00682,"kevAdded":null},{"id":"CVE-2022-33682","published":"2022-09-23T09:25:14.000Z","updated":"2025-05-27T14:46:07.468Z","title":"Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00717,"kevAdded":null},{"id":"CVE-2022-33681","published":"2022-09-23T09:25:13.000Z","updated":"2025-05-22T20:37:29.107Z","title":"Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.00697,"kevAdded":null},{"id":"CVE-2022-24280","published":"2022-09-23T09:25:12.000Z","updated":"2025-05-22T20:39:48.210Z","title":"Apache Pulsar Proxy target broker address isn't validated","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01451,"kevAdded":null},{"id":"CVE-2022-26112","published":"2022-09-23T08:05:13.000Z","updated":"2025-05-27T14:46:56.726Z","title":"Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Pinot","kev":false,"epss":0.01644,"kevAdded":null},{"id":"CVE-2022-40705","published":"2022-09-22T08:15:16.000Z","updated":"2024-08-03T12:21:46.448Z","title":"Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache SOAP","kev":false,"epss":0.01918,"kevAdded":null},{"id":"CVE-2022-40146","published":"2022-09-22T00:00:00.000Z","updated":"2025-11-03T19:27:34.505Z","title":"Jar url should be blocked by DefaultScriptSecurity","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache XML Graphics","kev":false,"epss":0.07431,"kevAdded":null},{"id":"CVE-2022-38648","published":"2022-09-22T00:00:00.000Z","updated":"2025-11-03T19:27:25.993Z","title":"PDFTranscoder does not block external resources","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache XML Graphics","kev":false,"epss":0.02425,"kevAdded":null},{"id":"CVE-2022-38398","published":"2022-09-22T00:00:00.000Z","updated":"2025-11-03T19:27:24.506Z","title":"Server-Side Request Forgery Information Disclosure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache XML Graphics","kev":false,"epss":0.02584,"kevAdded":null},{"id":"CVE-2022-40754","published":"2022-09-21T07:25:12.000Z","updated":"2025-05-27T18:20:58.998Z","title":"Open Redirect","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01759,"kevAdded":null},{"id":"CVE-2022-40604","published":"2022-09-21T07:25:11.000Z","updated":"2025-05-27T18:20:24.284Z","title":"Format String Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02083,"kevAdded":null},{"id":"CVE-2022-40955","published":"2022-09-20T13:50:08.000Z","updated":"2025-05-29T13:55:00.126Z","title":"Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache InLong","kev":false,"epss":0.02685,"kevAdded":null},{"id":"CVE-2022-34917","published":"2022-09-20T08:35:07.000Z","updated":"2025-05-29T13:39:10.405Z","title":"Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.01483,"kevAdded":null},{"id":"CVE-2022-39135","published":"2022-09-11T00:00:00.000Z","updated":"2024-08-03T11:10:32.601Z","title":"Apache Calcite: potential XEE attacks","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Calcite","kev":false,"epss":0.02201,"kevAdded":null},{"id":"CVE-2022-28220","published":"2022-09-08T07:40:09.000Z","updated":"2024-08-03T05:48:37.476Z","title":"STARTTLS command injection in Apache JAMES","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.02032,"kevAdded":null},{"id":"CVE-2022-38370","published":"2022-09-05T09:50:10.000Z","updated":"2024-08-03T10:54:03.893Z","title":"No authorization of DatabaseConnectController in grafana-connector.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01379,"kevAdded":null},{"id":"CVE-2022-38369","published":"2022-09-05T09:50:09.000Z","updated":"2024-08-03T10:54:03.709Z","title":"Login check vulnerability by session Id","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache IoTDB","kev":false,"epss":0.01301,"kevAdded":null},{"id":"CVE-2022-38170","published":"2022-09-02T07:10:21.000Z","updated":"2024-08-03T10:45:52.810Z","title":"Overly permissive umask for daemons","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.00617,"kevAdded":null},{"id":"CVE-2022-38054","published":"2022-09-02T07:10:21.000Z","updated":"2024-08-03T10:45:51.955Z","title":"Session Fixation","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02191,"kevAdded":null},{"id":"CVE-2022-29158","published":"2022-09-02T07:10:20.000Z","updated":"2024-08-03T06:10:59.432Z","title":"Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.0218,"kevAdded":null},{"id":"CVE-2022-29063","published":"2022-09-02T07:10:19.000Z","updated":"2024-08-03T06:10:59.274Z","title":"Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.05083,"kevAdded":null},{"id":"CVE-2022-25813","published":"2022-09-02T07:10:18.000Z","updated":"2024-08-03T04:49:43.983Z","title":"Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.67261,"kevAdded":null},{"id":"CVE-2022-25371","published":"2022-09-02T07:10:17.000Z","updated":"2024-11-20T15:11:11.129Z","title":"Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.05438,"kevAdded":null},{"id":"CVE-2022-25370","published":"2022-09-02T07:10:16.000Z","updated":"2024-08-03T04:36:06.924Z","title":"Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.02807,"kevAdded":null},{"id":"CVE-2022-37435","published":"2022-09-01T14:00:14.000Z","updated":"2024-08-03T10:29:20.982Z","title":"Apache ShenYu Admin Improper Privilege Management","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ShenYu","kev":false,"epss":0.01341,"kevAdded":null},{"id":"CVE-2022-37023","published":"2022-08-31T07:00:16.000Z","updated":"2024-08-03T10:21:32.603Z","title":"Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.01783,"kevAdded":null},{"id":"CVE-2022-37022","published":"2022-08-31T07:00:15.000Z","updated":"2024-08-03T10:21:32.458Z","title":"Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.01509,"kevAdded":null},{"id":"CVE-2022-37021","published":"2022-08-31T07:00:14.000Z","updated":"2024-08-03T10:21:32.657Z","title":"Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02638,"kevAdded":null},{"id":"CVE-2022-22728","published":"2022-08-25T00:00:00.000Z","updated":"2024-08-03T03:21:49.039Z","title":"libapreq2 multipart form parse memory corruption","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"libapreq2","kev":false,"epss":0.05922,"kevAdded":null},{"id":"CVE-2021-25642","published":"2022-08-25T00:00:00.000Z","updated":"2024-08-03T20:11:28.113Z","title":"Apache Hadoop YARN remote code execution in ZKConfigurationStore of capacity scheduler","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.02304,"kevAdded":null},{"id":"CVE-2022-35278","published":"2022-08-23T00:00:00.000Z","updated":"2024-08-03T09:36:44.249Z","title":"HTML Injection in ActiveMQ Artemis Web Console","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Artemis","kev":false,"epss":0.01749,"kevAdded":null},{"id":"CVE-2022-34916","published":"2022-08-21T08:15:19.000Z","updated":"2024-08-03T09:22:10.646Z","title":"Improper Input Validation (JNDI Injection) in JMSMessageConsumer","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Flume","kev":false,"epss":0.02942,"kevAdded":null},{"id":"CVE-2022-38362","published":"2022-08-16T14:10:09.000Z","updated":"2024-08-03T10:54:03.738Z","title":"Docker Provider <3.0 RCE vulnerability in example dag","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01953,"kevAdded":null},{"id":"CVE-2022-37401","published":"2022-08-13T06:40:25.000Z","updated":"2024-08-03T10:29:21.020Z","title":"Apache OpenOffice Weak Master Keys","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01946,"kevAdded":null},{"id":"CVE-2022-37400","published":"2022-08-13T06:40:11.000Z","updated":"2024-08-03T10:29:20.978Z","title":"Apache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00983,"kevAdded":null},{"id":"CVE-2022-31779","published":"2022-08-10T05:50:40.000Z","updated":"2024-08-03T07:26:01.104Z","title":"Improper HTTP/2 scheme and method validation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02483,"kevAdded":null},{"id":"CVE-2022-25763","published":"2022-08-10T05:50:21.000Z","updated":"2025-10-20T17:59:18.396Z","title":"Improper input validation on HTTP/2 headers","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02088,"kevAdded":null},{"id":"CVE-2022-31780","published":"2022-08-10T00:00:00.000Z","updated":"2024-08-03T07:26:01.168Z","title":"HTTP/2 framing vulnerabilities","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02482,"kevAdded":null},{"id":"CVE-2022-31778","published":"2022-08-10T00:00:00.000Z","updated":"2024-08-03T07:26:01.210Z","title":"Transfer-Encoding not treated as hop-by-hop","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02142,"kevAdded":null},{"id":"CVE-2022-28129","published":"2022-08-10T00:00:00.000Z","updated":"2024-08-03T05:48:36.561Z","title":"Insufficient Validation of HTTP/1.x Headers","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02482,"kevAdded":null},{"id":"CVE-2021-37150","published":"2022-08-10T00:00:00.000Z","updated":"2025-09-08T18:45:49.320Z","title":"Protocol vs scheme mismatch","severity":"MEDIUM","score":4.2,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02253,"kevAdded":null},{"id":"CVE-2022-36125","published":"2022-08-09T06:50:40.000Z","updated":"2026-03-06T17:35:01.794Z","title":"Integer overflow when reading corrupted .avro file in Avro Rust SDK","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Avro","kev":false,"epss":0.01589,"kevAdded":null},{"id":"CVE-2022-36124","published":"2022-08-09T06:50:32.000Z","updated":"2026-06-23T14:37:21.548Z","title":"Memory overconsumption in Avro Rust SDK","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Avro","kev":false,"epss":0.01553,"kevAdded":null},{"id":"CVE-2022-35724","published":"2022-08-09T06:50:24.000Z","updated":"2024-08-03T09:44:21.667Z","title":"Denial of service while reading data in Avro Rust SDK","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Avro","kev":false,"epss":0.01822,"kevAdded":null},{"id":"CVE-2022-25168","published":"2022-08-04T14:30:17.000Z","updated":"2024-08-03T04:36:05.786Z","title":"Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.04587,"kevAdded":null},{"id":"CVE-2022-34158","published":"2022-08-04T06:16:11.000Z","updated":"2024-08-03T08:16:17.225Z","title":"User Group Privilege Escalation","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.01277,"kevAdded":null},{"id":"CVE-2022-28732","published":"2022-08-04T06:15:57.000Z","updated":"2024-08-03T06:03:52.589Z","title":"Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.82827,"kevAdded":null},{"id":"CVE-2022-28731","published":"2022-08-04T06:15:43.000Z","updated":"2024-08-03T06:03:52.648Z","title":"Apache JSPWiki CSRF in UserPreferences.jsp","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.58724,"kevAdded":null},{"id":"CVE-2022-28730","published":"2022-08-04T06:15:29.000Z","updated":"2024-08-03T06:03:52.583Z","title":"Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.86157,"kevAdded":null},{"id":"CVE-2022-27166","published":"2022-08-04T06:15:17.000Z","updated":"2024-08-03T05:18:39.251Z","title":"XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.86157,"kevAdded":null},{"id":"CVE-2022-36364","published":"2022-07-28T08:35:10.000Z","updated":"2024-08-03T10:00:04.292Z","title":"Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Calcite Avatica","kev":false,"epss":0.03159,"kevAdded":null},{"id":"CVE-2022-24294","published":"2022-07-24T17:45:12.000Z","updated":"2024-08-03T04:07:02.340Z","title":"ReDoS in Apache MXNet RTC Module","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MXNet","kev":false,"epss":0.01882,"kevAdded":null},{"id":"CVE-2022-34169","published":"2022-07-19T00:00:00.000Z","updated":"2026-05-27T12:51:15.955Z","title":"Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Xalan-J","kev":false,"epss":0.81759,"kevAdded":null},{"id":"CVE-2022-35741","published":"2022-07-18T14:30:14.000Z","updated":"2024-08-03T09:44:21.691Z","title":"Apache CloudStack SAML Single Sign-On XXE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.0801,"kevAdded":null},{"id":"CVE-2022-36127","published":"2022-07-18T11:30:13.000Z","updated":"2024-08-03T10:00:01.456Z","title":"Service unavailability impact in NodeJS agent(version <= 0.5.0)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache SkyWalking NodeJS Agent","kev":false,"epss":0.01866,"kevAdded":null},{"id":"CVE-2022-33891","published":"2022-07-18T00:00:00.000Z","updated":"2025-10-21T23:15:38.160Z","title":"Apache Spark shell command injection vulnerability via Spark UI","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":true,"epss":0.93244,"kevAdded":"2023-03-07"},{"id":"CVE-2021-34538","published":"2022-07-16T07:10:09.000Z","updated":"2024-08-04T00:12:50.447Z","title":"Apache Hive Security vulnerability in Hive with UDFs","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01859,"kevAdded":null},{"id":"CVE-2022-31781","published":"2022-07-13T07:25:10.000Z","updated":"2024-08-03T07:26:01.066Z","title":"Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tapestry","kev":false,"epss":0.01973,"kevAdded":null},{"id":"CVE-2022-28889","published":"2022-07-07T18:35:22.000Z","updated":"2024-08-03T06:10:56.784Z","title":"Clickjacking in the web console","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.01872,"kevAdded":null},{"id":"CVE-2021-44791","published":"2022-07-07T18:35:16.000Z","updated":"2024-08-04T04:32:13.108Z","title":"Reflected XSS on certain HTTP endpoints","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.02221,"kevAdded":null},{"id":"CVE-2021-37839","published":"2022-07-06T12:35:10.000Z","updated":"2024-08-04T01:30:08.212Z","title":"Improper access to dataset metadata information","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01405,"kevAdded":null},{"id":"CVE-2022-32533","published":"2022-07-06T09:40:12.000Z","updated":"2024-08-03T07:46:43.528Z","title":"Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Portals","kev":false,"epss":0.04179,"kevAdded":null},{"id":"CVE-2022-33980","published":"2022-07-06T00:00:00.000Z","updated":"2024-08-03T08:16:16.672Z","title":"Apache Commons Configuration insecure interpolation defaults","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Commons Configuration","kev":false,"epss":0.44644,"kevAdded":null},{"id":"CVE-2022-32532","published":"2022-06-28T23:20:11.000Z","updated":"2024-08-03T07:46:43.634Z","title":"Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.25536,"kevAdded":null},{"id":"CVE-2022-33879","published":"2022-06-27T21:40:10.000Z","updated":"2024-08-03T08:09:22.671Z","title":"Incomplete fix and new regex DoS in StandardsExtractingContentHandler","severity":"LOW","score":3.3,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02032,"kevAdded":null},{"id":"CVE-2022-26477","published":"2022-06-27T17:15:18.000Z","updated":"2024-08-03T05:03:32.880Z","title":"Denial of service in readExternal method","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache SystemDS","kev":false,"epss":0.02253,"kevAdded":null},{"id":"CVE-2022-34305","published":"2022-06-23T10:30:16.000Z","updated":"2026-10-08T21:13:48.481Z","title":"XSS in examples web application","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.06714,"kevAdded":null},{"id":"CVE-2022-32549","published":"2022-06-22T14:25:10.000Z","updated":"2024-08-03T07:46:43.499Z","title":"log injection in Sling logging","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Sling","kev":false,"epss":0.02449,"kevAdded":null},{"id":"CVE-2022-33140","published":"2022-06-15T14:25:15.000Z","updated":"2024-08-03T08:01:19.873Z","title":"Improper Neutralization of Command Elements in Shell User Group Provider","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03519,"kevAdded":null},{"id":"CVE-2021-33036","published":"2022-06-15T14:25:14.000Z","updated":"2024-08-03T23:42:19.282Z","title":"Apache Hadoop Privilege escalation vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.04033,"kevAdded":null},{"id":"CVE-2022-25167","published":"2022-06-14T07:55:10.000Z","updated":"2024-08-03T04:36:05.047Z","title":"Apache Flume vulnerable to a JNDI RCE in JMSSource","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Flume","kev":false,"epss":0.05397,"kevAdded":null},{"id":"CVE-2021-37404","published":"2022-06-13T07:00:16.000Z","updated":"2024-08-04T01:16:03.989Z","title":"Heap buffer overflow in libhdfs native library","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.03108,"kevAdded":null},{"id":"CVE-2022-31813","published":"2022-06-08T10:00:57.000Z","updated":"2024-08-03T07:26:01.124Z","title":"mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.03543,"kevAdded":null},{"id":"CVE-2022-30556","published":"2022-06-08T10:00:55.000Z","updated":"2024-08-03T06:48:36.447Z","title":"Information Disclosure in mod_lua with websockets","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.05268,"kevAdded":null},{"id":"CVE-2022-30522","published":"2022-06-08T10:00:54.000Z","updated":"2024-08-03T06:48:36.355Z","title":"mod_sed denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.89529,"kevAdded":null},{"id":"CVE-2022-29404","published":"2022-06-08T10:00:52.000Z","updated":"2024-08-03T06:17:55.325Z","title":"Denial of service in mod_lua r:parsebody","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.06378,"kevAdded":null},{"id":"CVE-2022-28615","published":"2022-06-08T10:00:51.000Z","updated":"2025-12-18T15:26:47.398Z","title":"Read beyond bounds in ap_strcmp_match()","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.06282,"kevAdded":null},{"id":"CVE-2022-28614","published":"2022-06-08T10:00:48.000Z","updated":"2024-08-03T05:56:16.107Z","title":"read beyond bounds via ap_rwrite()","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.04977,"kevAdded":null},{"id":"CVE-2022-28330","published":"2022-06-08T10:00:34.000Z","updated":"2024-08-03T05:48:37.891Z","title":"read beyond bounds in mod_isapi","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.0382,"kevAdded":null},{"id":"CVE-2022-26377","published":"2022-06-08T10:00:20.000Z","updated":"2024-08-03T05:03:32.881Z","title":"mod_proxy_ajp: Possible request smuggling","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.21079,"kevAdded":null},{"id":"CVE-2022-24969","published":"2022-06-06T22:00:16.000Z","updated":"2024-08-03T04:29:01.633Z","title":"bypass of CVE-2021-25640","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.01865,"kevAdded":null},{"id":"CVE-2022-30973","published":"2022-05-31T13:20:10.000Z","updated":"2024-08-03T07:03:40.228Z","title":"Missing fix for CVE-2022-30126 in 1.28.2","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.01982,"kevAdded":null},{"id":"CVE-2022-29405","published":"2022-05-25T07:15:11.000Z","updated":"2024-08-03T06:17:55.082Z","title":"Apache Archiva Arbitrary user password reset vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.01724,"kevAdded":null},{"id":"CVE-2022-29599","published":"2022-05-23T10:25:10.000Z","updated":"2024-08-03T06:26:06.558Z","title":"Commandline class shell injection vulnerabilities","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Maven","kev":false,"epss":0.04423,"kevAdded":null},{"id":"CVE-2022-26650","published":"2022-05-17T08:05:10.000Z","updated":"2024-08-03T05:11:43.499Z","title":"Apache ShenYu (incubating) Regular expression denial of service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ShenYu (incubating)","kev":false,"epss":0.02663,"kevAdded":null},{"id":"CVE-2022-30126","published":"2022-05-16T17:05:13.000Z","updated":"2024-08-03T06:40:47.590Z","title":"Apache Tika Regular Expression Denial of Service in Standards Extractor","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02598,"kevAdded":null},{"id":"CVE-2022-25169","published":"2022-05-16T17:05:11.000Z","updated":"2024-08-03T04:36:05.111Z","title":"Apache Tika BPGParser Memory Usage DoS","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02196,"kevAdded":null},{"id":"CVE-2022-25762","published":"2022-05-13T07:50:09.000Z","updated":"2026-10-08T21:14:02.790Z","title":"Response mix-up with WebSocket concurrent send and close","severity":"HIGH","score":8.6,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.08405,"kevAdded":null},{"id":"CVE-2022-29885","published":"2022-05-12T00:00:00.000Z","updated":"2026-10-08T21:13:48.611Z","title":"EncryptInterceptor does not provide complete protection on insecure networks","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.73474,"kevAdded":null},{"id":"CVE-2022-28890","published":"2022-05-05T08:40:09.000Z","updated":"2024-08-03T06:10:56.881Z","title":"Processing external DTDs","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Jena","kev":false,"epss":0.02668,"kevAdded":null},{"id":"CVE-2022-29265","published":"2022-04-30T08:05:10.000Z","updated":"2024-08-03T06:17:54.476Z","title":"Improper Restriction of XML External Entity References in Multiple Components","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.02597,"kevAdded":null},{"id":"CVE-2022-23942","published":"2022-04-26T16:05:10.000Z","updated":"2024-08-03T03:59:23.369Z","title":"Apache Doris hardcoded cryptography initialization","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Doris(Incubating)","kev":false,"epss":0.0336,"kevAdded":null},{"id":"CVE-2022-24706","published":"2022-04-26T00:00:00.000Z","updated":"2025-10-21T23:15:40.735Z","title":"Remote Code Execution Vulnerability in Packaging","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":true,"epss":0.9251,"kevAdded":"2022-08-25"},{"id":"CVE-2022-29266","published":"2022-04-20T07:15:13.000Z","updated":"2024-08-03T06:17:54.494Z","title":"apisix/jwt-auth may leak secrets in error response","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.0814,"kevAdded":null},{"id":"CVE-2022-27479","published":"2022-04-13T19:05:11.000Z","updated":"2024-08-03T05:25:32.815Z","title":"SQL injection vulnerability in chart data API","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.02901,"kevAdded":null},{"id":"CVE-2022-24070","published":"2022-04-12T17:50:14.000Z","updated":"2024-08-03T03:59:23.785Z","title":"Apache Subversion mod_dav_svn is vulnerable to memory corruption","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.09473,"kevAdded":null},{"id":"CVE-2021-28544","published":"2022-04-12T17:50:13.000Z","updated":"2024-08-03T21:47:32.637Z","title":"Apache Subversion SVN authz protected copyfrom paths regression","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.02788,"kevAdded":null},{"id":"CVE-2021-31805","published":"2022-04-12T15:25:11.000Z","updated":"2024-08-03T23:10:30.193Z","title":"Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.85433,"kevAdded":null},{"id":"CVE-2022-26612","published":"2022-04-07T18:20:12.000Z","updated":"2024-08-03T05:11:43.529Z","title":"Arbitrary file write in FileUtil#unpackEntries on Windows","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.04241,"kevAdded":null},{"id":"CVE-2022-26850","published":"2022-04-06T17:40:09.000Z","updated":"2024-08-03T05:11:45.347Z","title":"Insufficiently protected credentials","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.01493,"kevAdded":null},{"id":"CVE-2022-23974","published":"2022-04-05T19:55:08.000Z","updated":"2024-08-03T03:59:23.228Z","title":"Pinot segment push endpoint has a vulnerability in unprotected environments","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Pinot","kev":false,"epss":0.02076,"kevAdded":null},{"id":"CVE-2022-25598","published":"2022-03-30T09:20:12.000Z","updated":"2024-08-03T04:42:49.991Z","title":"Apache DolphinScheduler user registration is vulnerable to ReDoS attacks","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01981,"kevAdded":null},{"id":"CVE-2022-25757","published":"2022-03-28T07:00:16.000Z","updated":"2024-08-03T04:49:43.256Z","title":"Apache APISIX: the body_schema check in request-validation plugin can be bypassed","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.02481,"kevAdded":null},{"id":"CVE-2021-44759","published":"2022-03-23T14:05:20.000Z","updated":"2024-08-04T04:32:12.307Z","title":"Improper authentication vulnerability in TLS origin verification","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01576,"kevAdded":null},{"id":"CVE-2021-44040","published":"2022-03-23T14:05:15.000Z","updated":"2024-08-04T04:10:17.217Z","title":"HTTP request line fuzzing attacks","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01991,"kevAdded":null},{"id":"CVE-2022-26779","published":"2022-03-15T15:40:11.000Z","updated":"2024-08-03T05:11:45.092Z","title":"Apache Cloudstack insecure random number generation affects project email invitation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.0285,"kevAdded":null},{"id":"CVE-2022-23943","published":"2022-03-14T10:15:54.000Z","updated":"2024-08-03T03:59:23.156Z","title":"mod_sed: Read/write beyond bounds","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.50401,"kevAdded":null},{"id":"CVE-2022-22721","published":"2022-03-14T10:15:40.000Z","updated":"2024-08-03T03:21:48.950Z","title":"core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.41713,"kevAdded":null},{"id":"CVE-2022-22720","published":"2022-03-14T10:15:29.000Z","updated":"2024-08-03T03:21:48.980Z","title":"HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.28189,"kevAdded":null},{"id":"CVE-2022-22719","published":"2022-03-14T10:15:16.000Z","updated":"2024-08-03T03:21:49.091Z","title":"mod_lua Use of uninitialized value of in r:parsebody","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.69097,"kevAdded":null},{"id":"CVE-2021-38296","published":"2022-03-10T08:20:12.000Z","updated":"2024-08-04T01:37:16.315Z","title":"Apache Spark Key Negotiation Vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.01845,"kevAdded":null},{"id":"CVE-2022-25312","published":"2022-03-04T23:25:08.000Z","updated":"2024-08-03T04:36:06.814Z","title":"An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Any23","kev":false,"epss":0.02858,"kevAdded":null},{"id":"CVE-2022-26336","published":"2022-03-04T00:00:00.000Z","updated":"2024-08-03T05:03:32.643Z","title":"A carefully crafted TNEF file can cause an out of memory exception","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"poi-scratchpad","kev":false,"epss":0.01526,"kevAdded":null},{"id":"CVE-2022-24948","published":"2022-02-25T08:30:19.000Z","updated":"2024-08-03T04:29:01.128Z","title":"Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.02251,"kevAdded":null},{"id":"CVE-2022-24947","published":"2022-02-25T08:30:18.000Z","updated":"2024-08-03T04:29:01.578Z","title":"Apache JSPWiki CSRF Account Takeover","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.0116,"kevAdded":null},{"id":"CVE-2022-24288","published":"2022-02-25T08:30:16.000Z","updated":"2024-08-03T04:07:02.359Z","title":"Apache Airflow: RCE in example DAGs","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.78368,"kevAdded":null},{"id":"CVE-2021-45229","published":"2022-02-25T08:30:15.000Z","updated":"2024-08-04T04:39:20.190Z","title":"Apache Airflow: Reflected XSS via Origin Query Argument in URL","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02601,"kevAdded":null},{"id":"CVE-2022-24289","published":"2022-02-11T12:20:15.000Z","updated":"2024-08-03T04:07:02.369Z","title":"Deserialization of untrusted data in the Hessian Component of Apache Cayenne 4.1 with older Java versions","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Cayenne","kev":false,"epss":0.02282,"kevAdded":null},{"id":"CVE-2022-24112","published":"2022-02-11T12:20:13.000Z","updated":"2025-10-21T23:15:46.674Z","title":"apisix/batch-requests plugin allows overwriting the X-REAL-IP header","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":true,"epss":0.96069,"kevAdded":"2022-08-25"},{"id":"CVE-2021-44521","published":"2022-02-11T12:20:12.000Z","updated":"2024-08-04T04:25:16.640Z","title":"Remote code execution for scripted UDFs","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.58896,"kevAdded":null},{"id":"CVE-2022-22931","published":"2022-02-07T18:50:10.000Z","updated":"2024-08-03T03:28:42.456Z","title":"Path traversal in Apache James 3.6.1","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.01761,"kevAdded":null},{"id":"CVE-2022-23206","published":"2022-02-06T15:15:10.000Z","updated":"2024-08-03T03:36:20.177Z","title":"Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Control","kev":false,"epss":0.01978,"kevAdded":null},{"id":"CVE-2022-23913","published":"2022-02-04T22:33:01.000Z","updated":"2024-08-03T03:59:22.547Z","title":"Apache ActiveMQ Artemis DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Artemis","kev":false,"epss":0.0274,"kevAdded":null},{"id":"CVE-2021-36152","published":"2022-02-04T22:32:57.000Z","updated":"2024-08-04T00:47:43.811Z","title":"Insecure TrustManager used in LDAP connections","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Gobblin","kev":false,"epss":0.01302,"kevAdded":null},{"id":"CVE-2021-36151","published":"2022-02-04T22:32:56.000Z","updated":"2024-08-04T00:47:43.865Z","title":"Local Credentials Disclosure Vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Gobblin","kev":false,"epss":0.00437,"kevAdded":null},{"id":"CVE-2021-44451","published":"2022-02-01T13:16:32.000Z","updated":"2024-08-04T04:25:16.474Z","title":"API sensitive information leak","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.07863,"kevAdded":null},{"id":"CVE-2021-41571","published":"2022-02-01T12:40:53.000Z","updated":"2024-08-04T03:15:29.204Z","title":"Pulsar Admin API allows access to data from other tenants using getMessageById API","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.01726,"kevAdded":null},{"id":"CVE-2022-23181","published":"2022-01-27T00:00:00.000Z","updated":"2024-08-03T03:36:20.071Z","title":"Local privilege escalation with FileStore","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2022-22932","published":"2022-01-26T11:10:12.000Z","updated":"2024-08-03T03:28:42.479Z","title":"Path traversal flaws","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.02753,"kevAdded":null},{"id":"CVE-2021-41766","published":"2022-01-26T11:10:11.000Z","updated":"2024-08-04T03:15:29.312Z","title":"Insecure Java Deserialization in Apache Karaf","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.02033,"kevAdded":null},{"id":"CVE-2022-23945","published":"2022-01-25T13:00:25.000Z","updated":"2024-08-03T03:59:23.281Z","title":"Apache ShenYu missing authentication allows gateway registration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ShenYu (incubating)","kev":false,"epss":0.03771,"kevAdded":null},{"id":"CVE-2022-23944","published":"2022-01-25T13:00:24.000Z","updated":"2024-08-03T03:59:23.263Z","title":"Apache ShenYu 2.4.1 Improper access control","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache ShenYu (incubating)","kev":false,"epss":0.79007,"kevAdded":null},{"id":"CVE-2022-23223","published":"2022-01-25T13:00:22.000Z","updated":"2024-08-03T03:36:20.334Z","title":"Apache ShenYu Password leakage","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ShenYu (incubating)","kev":false,"epss":0.04306,"kevAdded":null},{"id":"CVE-2021-45029","published":"2022-01-25T13:00:21.000Z","updated":"2024-08-04T04:32:13.478Z","title":"Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache ShenYu (incubating)","kev":false,"epss":0.06029,"kevAdded":null},{"id":"CVE-2022-23437","published":"2022-01-24T00:00:00.000Z","updated":"2026-10-08T21:13:53.905Z","title":"Infinite loop within Apache XercesJ xml parser","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Xerces","kev":false,"epss":0.11615,"kevAdded":null},{"id":"CVE-2022-22733","published":"2022-01-20T10:25:12.000Z","updated":"2024-08-03T03:21:49.071Z","title":"Access-Token in ElasticJob UI causes password disclosure","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache ShardingSphere ElasticJob-UI","kev":false,"epss":0.37594,"kevAdded":null},{"id":"CVE-2021-45230","published":"2022-01-20T10:25:10.000Z","updated":"2024-08-04T04:39:20.469Z","title":"Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01709,"kevAdded":null},{"id":"CVE-2022-23307","published":"2022-01-18T15:25:23.000Z","updated":"2026-05-27T13:44:43.452Z","title":"A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Log4j 1.x","kev":false,"epss":0.54411,"kevAdded":null},{"id":"CVE-2022-23305","published":"2022-01-18T15:25:22.000Z","updated":"2026-05-27T13:40:57.853Z","title":"SQL injection in JDBC Appender in Apache Log4j V1","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Log4j 1.x","kev":false,"epss":0.66537,"kevAdded":null},{"id":"CVE-2022-23302","published":"2022-01-18T15:25:20.000Z","updated":"2026-05-27T13:46:05.384Z","title":"Deserialization of untrusted data in JMSSink in Apache Log4j 1.x","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Log4j 1.x","kev":false,"epss":0.63841,"kevAdded":null},{"id":"CVE-2021-42357","published":"2022-01-17T19:25:09.000Z","updated":"2024-08-04T03:30:38.347Z","title":"DOM based XSS Vulnerability in Apache Knox","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Knox","kev":false,"epss":0.02579,"kevAdded":null},{"id":"CVE-2021-43999","published":"2022-01-11T22:10:12.000Z","updated":"2024-08-04T04:10:17.191Z","title":"Improper validation of SAML responses","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.01843,"kevAdded":null},{"id":"CVE-2021-41767","published":"2022-01-11T22:10:11.000Z","updated":"2024-08-04T03:15:29.360Z","title":"Private tunnel identifier may be included in the non-private details of active connections","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.01997,"kevAdded":null},{"id":"CVE-2021-43297","published":"2022-01-10T15:25:48.000Z","updated":"2024-08-04T03:55:28.375Z","title":"Dubbo Hessian cause RCE when parse error","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.17431,"kevAdded":null},{"id":"CVE-2021-43045","published":"2022-01-06T18:00:12.000Z","updated":"2024-08-04T03:47:13.525Z","title":"Possible DOS vulnerabilities in C# Avro SDK","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Avro","kev":false,"epss":0.03057,"kevAdded":null},{"id":"CVE-2021-45458","published":"2022-01-06T12:35:24.000Z","updated":"2024-08-04T04:39:21.117Z","title":"Hardcoded credentials","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.02148,"kevAdded":null},{"id":"CVE-2021-45457","published":"2022-01-06T12:35:22.000Z","updated":"2024-08-04T04:39:21.127Z","title":"Overly broad CORS configuration","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.02462,"kevAdded":null},{"id":"CVE-2021-45456","published":"2022-01-06T12:35:21.000Z","updated":"2024-08-04T04:39:21.067Z","title":"Command injection","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.88887,"kevAdded":null},{"id":"CVE-2021-36774","published":"2022-01-06T12:35:20.000Z","updated":"2024-08-04T01:01:59.491Z","title":"Mysql JDBC Connector Deserialize RCE","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.02013,"kevAdded":null},{"id":"CVE-2021-31522","published":"2022-01-06T12:35:18.000Z","updated":"2024-08-03T23:03:33.379Z","title":"Apache Kylin unsafe class loading","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.02998,"kevAdded":null},{"id":"CVE-2021-27738","published":"2022-01-06T12:35:17.000Z","updated":"2024-08-03T21:26:10.756Z","title":"Improper Access Control to Streaming Coordinator & SSRF","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Kylin","kev":false,"epss":0.02641,"kevAdded":null},{"id":"CVE-2021-36739","published":"2022-01-06T08:50:16.000Z","updated":"2025-05-22T18:35:31.820Z","title":"XSS vulnerability in the MVCBean JSP portlet maven archetype","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Portals","kev":false,"epss":0.02404,"kevAdded":null},{"id":"CVE-2021-36738","published":"2022-01-06T08:50:15.000Z","updated":"2024-08-04T01:01:59.086Z","title":"XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Portals","kev":false,"epss":0.02404,"kevAdded":null},{"id":"CVE-2021-36737","published":"2022-01-06T08:50:13.000Z","updated":"2024-08-04T01:01:58.974Z","title":"XSS in V3 Demo Portlet","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Portals","kev":false,"epss":0.02404,"kevAdded":null},{"id":"CVE-2021-40525","published":"2022-01-04T08:55:25.000Z","updated":"2024-08-04T02:44:10.863Z","title":"Sieve file storage vulnerable to path traversal attacks","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.03828,"kevAdded":null},{"id":"CVE-2021-40111","published":"2022-01-04T08:55:24.000Z","updated":"2024-08-04T02:27:31.847Z","title":"Apache James IMAP parsing Denial Of Service","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.02192,"kevAdded":null},{"id":"CVE-2021-40110","published":"2022-01-04T08:55:22.000Z","updated":"2024-08-04T02:27:31.846Z","title":"Apache James IMAP vulnerable to a ReDoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.02954,"kevAdded":null},{"id":"CVE-2021-38542","published":"2022-01-04T08:55:21.000Z","updated":"2024-08-04T01:44:23.485Z","title":"Apache James vulnerable to STARTTLS command injection (IMAP and POP3)","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.02347,"kevAdded":null},{"id":"CVE-2021-34797","published":"2022-01-04T08:55:20.000Z","updated":"2024-08-04T00:26:54.012Z","title":"Apache Geode project log file redaction of sensitive information vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02597,"kevAdded":null},{"id":"CVE-2021-44832","published":"2021-12-28T19:35:11.000Z","updated":"2026-05-29T18:53:46.103Z","title":"Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration","severity":"MEDIUM","score":6.6,"vendor":"Apache Software Foundation","product":"Apache Log4j2","kev":false,"epss":0.97906,"kevAdded":null},{"id":"CVE-2021-45232","published":"2021-12-27T15:06:50.000Z","updated":"2024-08-04T04:39:20.275Z","title":"security vulnerability on unauthorized access.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache APISIX Dashboard","kev":false,"epss":0.86327,"kevAdded":null},{"id":"CVE-2021-44548","published":"2021-12-23T08:55:09.000Z","updated":"2024-08-04T04:25:16.937Z","title":"Apache Solr information disclosure vulnerability through DataImportHandler","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.05234,"kevAdded":null},{"id":"CVE-2021-44224","published":"2021-12-20T11:20:13.000Z","updated":"2024-08-04T04:17:24.919Z","title":"Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.82295,"kevAdded":null},{"id":"CVE-2021-41561","published":"2021-12-20T11:20:11.000Z","updated":"2024-08-04T03:15:29.260Z","title":"Apache Parquet-MR potential DoS in case of malicious Parquet file","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Parquet","kev":false,"epss":0.03152,"kevAdded":null},{"id":"CVE-2021-44790","published":"2021-12-20T00:00:00.000Z","updated":"2024-08-04T04:32:13.543Z","title":"Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.9684,"kevAdded":null},{"id":"CVE-2021-43083","published":"2021-12-19T08:25:09.000Z","updated":"2024-08-04T03:47:13.291Z","title":"Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache PLC4X","kev":false,"epss":0.01985,"kevAdded":null},{"id":"CVE-2021-45105","published":"2021-12-18T11:55:08.000Z","updated":"2026-05-29T11:45:26.064Z","title":"Apache Log4j2 does not always protect from infinite recursion in lookup evaluation","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Log4j2","kev":false,"epss":0.99999,"kevAdded":null},{"id":"CVE-2021-44145","published":"2021-12-17T08:50:09.000Z","updated":"2024-08-04T04:17:24.439Z","title":"Apache NiFi information disclosure by XXE","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.01757,"kevAdded":null},{"id":"CVE-2021-45046","published":"2021-12-14T16:55:09.000Z","updated":"2025-10-21T23:25:22.768Z","title":"Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack","severity":"CRITICAL","score":9,"vendor":"Apache Software Foundation","product":"Apache Log4j","kev":true,"epss":0.99977,"kevAdded":"2023-05-01"},{"id":"CVE-2021-44549","published":"2021-12-14T15:15:10.000Z","updated":"2024-08-04T04:25:16.815Z","title":"SMTPS server hostname not checked when making TLS connection to SMTPS server","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Sling Commons Messaging Mail","kev":false,"epss":0.02081,"kevAdded":null},{"id":"CVE-2021-4104","published":"2021-12-14T00:00:00.000Z","updated":"2026-05-28T19:53:14.378Z","title":"Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Log4j 1.x","kev":false,"epss":0.80599,"kevAdded":null},{"id":"CVE-2021-44228","published":"2021-12-10T00:00:00.000Z","updated":"2025-10-21T23:25:23.121Z","title":"Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache Log4j2","kev":true,"epss":0.99999,"kevAdded":"2021-12-10"},{"id":"CVE-2021-43410","published":"2021-12-09T09:00:12.000Z","updated":"2024-08-04T03:55:29.278Z","title":"airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airavata Django Portal","kev":false,"epss":0.02472,"kevAdded":null},{"id":"CVE-2021-44140","published":"2021-11-24T11:15:14.000Z","updated":"2024-08-04T04:17:24.421Z","title":"Arbitrary file deletion on logout","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.06358,"kevAdded":null},{"id":"CVE-2021-40369","published":"2021-11-24T11:15:13.000Z","updated":"2024-08-04T02:44:09.644Z","title":"XSS vulnerability on Denounce plugin","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.03419,"kevAdded":null},{"id":"CVE-2021-43557","published":"2021-11-22T08:25:09.000Z","updated":"2024-08-04T04:03:07.927Z","title":"Path traversal in request_uri variable","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.13044,"kevAdded":null},{"id":"CVE-2021-41532","published":"2021-11-19T09:20:26.000Z","updated":"2024-08-04T03:15:29.160Z","title":"Unauthenticated access to Ozone Recon HTTP endpoints","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.02391,"kevAdded":null},{"id":"CVE-2021-39236","published":"2021-11-19T09:20:25.000Z","updated":"2024-08-04T02:06:40.807Z","title":"Owners of the S3 tokens are not validated","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.02636,"kevAdded":null},{"id":"CVE-2021-39235","published":"2021-11-19T09:20:23.000Z","updated":"2024-08-04T02:06:41.327Z","title":"Access mode of block tokens are not enforced","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.01551,"kevAdded":null},{"id":"CVE-2021-39234","published":"2021-11-19T09:20:22.000Z","updated":"2024-08-04T01:58:18.340Z","title":"Raw block data can be read bypassing ACL/authorization","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.01412,"kevAdded":null},{"id":"CVE-2021-39233","published":"2021-11-19T09:20:20.000Z","updated":"2024-08-04T01:58:18.231Z","title":"Container-related datanode operations can be called without authorization","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.02372,"kevAdded":null},{"id":"CVE-2021-39232","published":"2021-11-19T09:20:19.000Z","updated":"2024-08-04T01:58:18.342Z","title":"Missing admin check for SCM related admin commands","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.01686,"kevAdded":null},{"id":"CVE-2021-39231","published":"2021-11-19T09:20:17.000Z","updated":"2024-08-04T01:58:18.341Z","title":"Missing authentication/authorization on internal RPC endpoints","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.02372,"kevAdded":null},{"id":"CVE-2021-36372","published":"2021-11-19T09:20:16.000Z","updated":"2024-08-04T00:54:51.493Z","title":"Original block tokens are persisted and can be retrieved","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.02526,"kevAdded":null},{"id":"CVE-2021-42250","published":"2021-11-17T15:10:10.000Z","updated":"2024-08-04T03:30:37.952Z","title":"Possible log injection","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.0182,"kevAdded":null},{"id":"CVE-2021-37580","published":"2021-11-16T09:35:11.000Z","updated":"2024-08-04T01:23:01.186Z","title":"Apache ShenYu Admin bypass JWT authentication","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache ShenYu Admin","kev":false,"epss":0.4212,"kevAdded":null},{"id":"CVE-2021-41972","published":"2021-11-12T18:55:13.000Z","updated":"2024-08-04T03:22:25.770Z","title":"Credentials leak","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01497,"kevAdded":null},{"id":"CVE-2021-43350","published":"2021-11-11T13:00:15.000Z","updated":"2024-08-04T03:55:28.477Z","title":"LDAP filter injection vulnerability in Traffic Ops","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Control","kev":false,"epss":0.04761,"kevAdded":null},{"id":"CVE-2021-26558","published":"2021-11-11T09:35:09.000Z","updated":"2024-08-03T20:26:25.540Z","title":"Deserialization of Untrusted Data","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ShardingSphere-UI","kev":false,"epss":0.02491,"kevAdded":null},{"id":"CVE-2021-43082","published":"2021-11-03T15:20:27.000Z","updated":"2024-08-04T03:47:13.379Z","title":"heap-buffer-overflow with stats-over-http plugin","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02407,"kevAdded":null},{"id":"CVE-2021-41585","published":"2021-11-03T15:20:25.000Z","updated":"2024-08-04T03:15:28.820Z","title":"ATS stops accepting connections on FreeBSD","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02487,"kevAdded":null},{"id":"CVE-2021-38161","published":"2021-11-03T15:20:24.000Z","updated":"2024-08-04T01:37:15.519Z","title":"Not validating origin TLS certificate","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0195,"kevAdded":null},{"id":"CVE-2021-37149","published":"2021-11-03T15:20:22.000Z","updated":"2024-08-04T01:16:03.937Z","title":"Request Smuggling - multiple attacks","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02695,"kevAdded":null},{"id":"CVE-2021-37148","published":"2021-11-03T15:20:20.000Z","updated":"2024-08-04T01:16:03.219Z","title":"Request Smuggling - transfer encoding validation","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02695,"kevAdded":null},{"id":"CVE-2021-37147","published":"2021-11-03T15:20:19.000Z","updated":"2024-08-04T01:16:02.883Z","title":"Request Smuggling - LF line ending","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02519,"kevAdded":null},{"id":"CVE-2021-27644","published":"2021-11-01T09:15:10.000Z","updated":"2024-08-03T21:26:10.756Z","title":"DolphinScheduler mysql jdbc connector parameters deserialize remote code execution","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.01922,"kevAdded":null},{"id":"CVE-2021-41973","published":"2021-11-01T08:35:09.000Z","updated":"2024-08-04T03:22:25.568Z","title":"Apache MINA HTTP listener DOS","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.04634,"kevAdded":null},{"id":"CVE-2021-40865","published":"2021-10-25T12:22:37.000Z","updated":"2024-08-04T02:51:07.676Z","title":"Unsafe Pre-Authentication Deserialization In Workers","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.6418,"kevAdded":null},{"id":"CVE-2021-38294","published":"2021-10-25T12:22:36.000Z","updated":"2024-08-04T01:37:16.384Z","title":"Shell Command Injection Vulnerability in Nimbus Thrift Server","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.83805,"kevAdded":null},{"id":"CVE-2021-41971","published":"2021-10-18T14:30:14.000Z","updated":"2024-08-04T03:22:25.815Z","title":"Possible SQL Injection when template processing is enabled","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01765,"kevAdded":null},{"id":"CVE-2021-32609","published":"2021-10-18T14:30:12.000Z","updated":"2024-08-03T23:25:30.488Z","title":"XSS vulnerability on Explore page","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01655,"kevAdded":null},{"id":"CVE-2021-42340","published":"2021-10-14T19:55:14.000Z","updated":"2024-08-04T03:30:38.354Z","title":"DoS via memory leak with WebSocket connections","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.11796,"kevAdded":null},{"id":"CVE-2021-38295","published":"2021-10-14T19:55:12.000Z","updated":"2024-08-04T01:37:16.335Z","title":"Privilege escalation vulnerability when using HTML attachments","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.02749,"kevAdded":null},{"id":"CVE-2021-42009","published":"2021-10-12T07:40:11.000Z","updated":"2024-08-04T03:22:25.843Z","title":"Apache Traffic Control Traffic Ops Email Injection Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Control","kev":false,"epss":0.02824,"kevAdded":null},{"id":"CVE-2021-41832","published":"2021-10-11T08:10:15.000Z","updated":"2024-08-04T03:22:24.932Z","title":"Content Manipulation with Certificate Validation Attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01343,"kevAdded":null},{"id":"CVE-2021-41831","published":"2021-10-11T08:10:14.000Z","updated":"2024-08-04T03:22:24.979Z","title":"Timestamp Manipulation with Signature Wrapping","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01502,"kevAdded":null},{"id":"CVE-2021-41830","published":"2021-10-11T08:10:12.000Z","updated":"2024-08-04T03:22:24.927Z","title":"Double Certificate Attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.0139,"kevAdded":null},{"id":"CVE-2021-42013","published":"2021-10-07T15:50:14.000Z","updated":"2025-10-21T23:25:30.222Z","title":"Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":true,"epss":0.99964,"kevAdded":"2021-11-03"},{"id":"CVE-2021-40439","published":"2021-10-07T15:50:12.000Z","updated":"2024-08-04T02:44:10.415Z","title":"Billion Laughs","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.03866,"kevAdded":null},{"id":"CVE-2021-28129","published":"2021-10-07T15:50:11.000Z","updated":"2024-08-03T21:33:17.499Z","title":"DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupid","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.00534,"kevAdded":null},{"id":"CVE-2021-41773","published":"2021-10-05T08:40:12.000Z","updated":"2025-10-21T23:25:30.864Z","title":"Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":true,"epss":0.99992,"kevAdded":"2021-11-03"},{"id":"CVE-2021-41524","published":"2021-10-05T08:40:11.000Z","updated":"2024-08-04T03:15:28.450Z","title":"null pointer dereference in h2 fuzzing","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.2517,"kevAdded":null},{"id":"CVE-2021-41616","published":"2021-09-30T07:55:11.000Z","updated":"2025-04-23T19:25:26.214Z","title":"Apache ddlutils 1.0 readobject vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache DB ddlutils","kev":false,"epss":0.03454,"kevAdded":null},{"id":"CVE-2021-36749","published":"2021-09-24T09:30:11.000Z","updated":"2024-08-04T01:01:59.216Z","title":"Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.80907,"kevAdded":null},{"id":"CVE-2021-33035","published":"2021-09-23T08:10:10.000Z","updated":"2024-08-03T23:42:19.143Z","title":"Buffer overflow from a crafted DBF file","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.50563,"kevAdded":null},{"id":"CVE-2021-38153","published":"2021-09-22T09:05:11.000Z","updated":"2024-08-04T01:37:15.929Z","title":"Timing Attack Vulnerability for Apache Kafka Connect and Clients","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.06201,"kevAdded":null},{"id":"CVE-2021-40690","published":"2021-09-19T00:00:00.000Z","updated":"2026-10-08T21:24:19.865Z","title":"Bypass of the secureValidation property","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Santuario","kev":false,"epss":0.07441,"kevAdded":null},{"id":"CVE-2021-41303","published":"2021-09-17T08:20:12.000Z","updated":"2024-08-04T03:08:32.012Z","title":"Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.7613,"kevAdded":null},{"id":"CVE-2021-41079","published":"2021-09-16T14:40:25.000Z","updated":"2026-10-08T21:13:52.220Z","title":"Apache Tomcat DoS with unexpected TLS packet","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.07182,"kevAdded":null},{"id":"CVE-2021-40438","published":"2021-09-16T14:40:23.000Z","updated":"2026-08-06T03:55:20.326Z","title":"mod_proxy SSRF","severity":"CRITICAL","score":9,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":true,"epss":0.99999,"kevAdded":"2021-12-01"},{"id":"CVE-2021-39275","published":"2021-09-16T14:40:22.000Z","updated":"2024-08-04T02:06:42.326Z","title":"ap_escape_quotes buffer overflow","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.39402,"kevAdded":null},{"id":"CVE-2021-39239","published":"2021-09-16T14:40:20.000Z","updated":"2024-08-04T02:06:40.799Z","title":"XML External Entity (XXE) vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Jena","kev":false,"epss":0.04342,"kevAdded":null},{"id":"CVE-2021-36160","published":"2021-09-16T14:40:18.000Z","updated":"2024-08-04T00:47:43.818Z","title":"mod_proxy_uwsgi out of bound read","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.62887,"kevAdded":null},{"id":"CVE-2021-34798","published":"2021-09-16T14:40:17.000Z","updated":"2024-08-04T00:26:54.014Z","title":"NULL pointer dereference in httpd core","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.64509,"kevAdded":null},{"id":"CVE-2021-40146","published":"2021-09-11T11:05:12.000Z","updated":"2024-08-04T02:27:31.542Z","title":"A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Any23","kev":false,"epss":0.05685,"kevAdded":null},{"id":"CVE-2021-38555","published":"2021-09-11T11:05:11.000Z","updated":"2024-08-04T01:44:23.463Z","title":"An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Any23","kev":false,"epss":0.02752,"kevAdded":null},{"id":"CVE-2021-38540","published":"2021-09-09T15:05:09.000Z","updated":"2024-08-04T01:44:23.448Z","title":"Apache Airflow: Variable Import endpoint missed authentication check","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.80938,"kevAdded":null},{"id":"CVE-2021-37579","published":"2021-09-09T07:45:12.000Z","updated":"2024-08-04T01:23:01.305Z","title":"Bypass deserialization checks in Apache Dubbo","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.06561,"kevAdded":null},{"id":"CVE-2021-36161","published":"2021-09-09T07:45:11.000Z","updated":"2024-08-04T00:47:43.813Z","title":"Unprotected input value toString cause RCE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.02467,"kevAdded":null},{"id":"CVE-2021-36163","published":"2021-09-07T09:25:11.000Z","updated":"2024-08-04T00:47:43.869Z","title":"Unsafe deserialization in providers using the Hessian protocol","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.03253,"kevAdded":null},{"id":"CVE-2021-36162","published":"2021-09-07T09:25:10.000Z","updated":"2024-08-04T00:47:43.888Z","title":"Unprotected yaml deserialization cause RCE","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.02261,"kevAdded":null},{"id":"CVE-2021-27578","published":"2021-09-02T00:00:00.000Z","updated":"2024-08-03T21:26:09.867Z","title":"Cross Site Scripting in markdown interpreter","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.03232,"kevAdded":null},{"id":"CVE-2020-13929","published":"2021-09-02T00:00:00.000Z","updated":"2024-08-04T12:32:14.441Z","title":"Notebook permissions bypass","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.03258,"kevAdded":null},{"id":"CVE-2019-10095","published":"2021-09-02T00:00:00.000Z","updated":"2024-08-04T22:10:09.552Z","title":"bash command injection in spark interpreter","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.05747,"kevAdded":null},{"id":"CVE-2021-33191","published":"2021-08-24T11:20:09.000Z","updated":"2024-08-03T23:42:20.264Z","title":"MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NiFi - MiNiFi C++","kev":false,"epss":0.04024,"kevAdded":null},{"id":"CVE-2021-35940","published":"2021-08-23T10:00:10.000Z","updated":"2024-08-04T00:40:47.582Z","title":"Regression of CVE-2017-12613","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime (APR)","kev":false,"epss":0.01185,"kevAdded":null},{"id":"CVE-2021-37608","published":"2021-08-18T07:50:12.000Z","updated":"2024-08-04T01:23:01.228Z","title":"Arbitrary file upload vulnerability in OFBiz","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.0603,"kevAdded":null},{"id":"CVE-2021-33580","published":"2021-08-18T07:50:10.000Z","updated":"2024-08-03T23:50:43.188Z","title":"regex injection leading to DoS","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.03298,"kevAdded":null},{"id":"CVE-2021-35936","published":"2021-08-16T07:25:11.000Z","updated":"2024-08-04T00:40:47.453Z","title":"No Authentication on Logging Server","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0545,"kevAdded":null},{"id":"CVE-2021-33193","published":"2021-08-16T00:00:00.000Z","updated":"2024-08-03T23:42:20.253Z","title":"Request splitting via HTTP/2 method injection and mod_proxy","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.46179,"kevAdded":null},{"id":"CVE-2021-21501","published":"2021-08-10T09:20:09.000Z","updated":"2024-08-03T18:16:22.624Z","title":"ServiceComb ServiceCenter Directory Traversal","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ServiceComb","kev":false,"epss":0.04441,"kevAdded":null},{"id":"CVE-2021-37578","published":"2021-07-29T07:05:10.000Z","updated":"2024-08-04T01:23:01.344Z","title":"Remote code execution via RMI","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache jUDDI","kev":false,"epss":0.04115,"kevAdded":null},{"id":"CVE-2021-33900","published":"2021-07-26T07:05:10.000Z","updated":"2024-08-04T00:05:51.036Z","title":"StartTLS and SASL confidentiality protection bypass","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Directory Studio","kev":false,"epss":0.00793,"kevAdded":null},{"id":"CVE-2021-28131","published":"2021-07-22T10:05:13.000Z","updated":"2024-08-03T21:33:17.543Z","title":"Impala logs contain secrets","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.03324,"kevAdded":null},{"id":"CVE-2021-36374","published":"2021-07-14T06:20:12.000Z","updated":"2024-08-04T00:54:51.456Z","title":"Apache Ant ZIP, and ZIP based, archive denial of service vulerability","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Ant","kev":false,"epss":0.02642,"kevAdded":null},{"id":"CVE-2021-36373","published":"2021-07-14T06:20:11.000Z","updated":"2024-08-04T00:54:51.488Z","title":"Apache Ant TAR archive denial of service vulnerability","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Ant","kev":false,"epss":0.02532,"kevAdded":null},{"id":"CVE-2021-36090","published":"2021-07-13T07:15:23.000Z","updated":"2026-10-08T21:03:29.070Z","title":"Apache Commons Compress 1.0 to 1.20 denial of service vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.12945,"kevAdded":null},{"id":"CVE-2021-35517","published":"2021-07-13T07:15:22.000Z","updated":"2026-10-08T21:13:50.230Z","title":"Apache Commons Compress 1.1 to 1.20 denial of service vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.10614,"kevAdded":null},{"id":"CVE-2021-35516","published":"2021-07-13T07:15:20.000Z","updated":"2024-08-04T00:40:46.628Z","title":"Apache Commons Compress 1.6 to 1.20 denial of service vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.12365,"kevAdded":null},{"id":"CVE-2021-35515","published":"2021-07-13T07:15:19.000Z","updated":"2024-08-04T00:40:47.264Z","title":"Apache Commons Compress 1.6 to 1.20 denial of service vulnerability","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.11567,"kevAdded":null},{"id":"CVE-2021-33037","published":"2021-07-12T14:55:15.000Z","updated":"2026-10-08T21:13:49.981Z","title":"Incorrect Transfer-Encoding handling with HTTP/1.0","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.74667,"kevAdded":null},{"id":"CVE-2021-30640","published":"2021-07-12T14:55:13.000Z","updated":"2026-10-08T21:03:16.938Z","title":"Auth weakness in JNDIRealm","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.09886,"kevAdded":null},{"id":"CVE-2021-30639","published":"2021-07-12T14:55:12.000Z","updated":"2024-08-03T22:40:31.655Z","title":"DoS after non-blocking IO error","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.06889,"kevAdded":null},{"id":"CVE-2021-30129","published":"2021-07-12T12:10:10.000Z","updated":"2024-08-03T22:24:59.565Z","title":"DoS/OOM leak vulnerability in Apache Mina SSHD Server","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Mina SSHD","kev":false,"epss":0.03049,"kevAdded":null},{"id":"CVE-2021-33192","published":"2021-07-05T09:15:11.000Z","updated":"2024-08-03T23:42:20.271Z","title":"Display information UI XSS","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Jena Fuseki","kev":false,"epss":0.02881,"kevAdded":null},{"id":"CVE-2021-26920","published":"2021-07-02T07:20:13.000Z","updated":"2024-08-03T20:33:41.311Z","title":"Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.09498,"kevAdded":null},{"id":"CVE-2021-35474","published":"2021-06-30T07:15:22.000Z","updated":"2024-08-04T00:40:46.453Z","title":"Dynamic stack buffer overflow in cachekey plugin","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02711,"kevAdded":null},{"id":"CVE-2021-32567","published":"2021-06-30T07:15:21.000Z","updated":"2024-08-03T23:25:30.398Z","title":"Reading HTTP/2 frames too many times","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02447,"kevAdded":null},{"id":"CVE-2021-32566","published":"2021-06-30T07:15:19.000Z","updated":"2024-08-03T23:25:30.377Z","title":"Specific sequence of HTTP/2 frames can cause ATS to crash","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02447,"kevAdded":null},{"id":"CVE-2021-32565","published":"2021-06-29T11:45:20.000Z","updated":"2024-08-03T23:25:30.615Z","title":"HTTP Request Smuggling, content length with invalid charters","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02137,"kevAdded":null},{"id":"CVE-2021-27577","published":"2021-06-29T11:45:19.000Z","updated":"2024-08-03T21:26:09.764Z","title":"Incorrect handling of url fragment leads to cache poisoning","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.03447,"kevAdded":null},{"id":"CVE-2021-26461","published":"2021-06-21T17:10:11.000Z","updated":"2024-08-03T20:26:25.470Z","title":"malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NuttX","kev":false,"epss":0.05038,"kevAdded":null},{"id":"CVE-2021-30468","published":"2021-06-16T12:00:18.000Z","updated":"2024-08-03T22:32:41.089Z","title":"Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.07024,"kevAdded":null},{"id":"CVE-2020-9493","published":"2021-06-16T07:30:11.000Z","updated":"2026-10-07T16:00:37.877Z","title":"Java deserialization in Chainsaw","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Chainsaw","kev":false,"epss":0.04612,"kevAdded":null},{"id":"CVE-2021-31618","published":"2021-06-15T00:00:00.000Z","updated":"2024-08-03T23:03:33.651Z","title":"NULL pointer dereference on specially crafted HTTP/2 request","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.51489,"kevAdded":null},{"id":"CVE-2021-31812","published":"2021-06-12T09:45:11.000Z","updated":"2024-08-03T23:10:30.239Z","title":"A carefully crafted PDF file can trigger an infinite loop while loading the file","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache PDFBox","kev":false,"epss":0.03054,"kevAdded":null},{"id":"CVE-2021-31811","published":"2021-06-12T09:45:11.000Z","updated":"2024-08-03T23:10:30.183Z","title":"A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache PDFBox","kev":false,"epss":0.03572,"kevAdded":null},{"id":"CVE-2021-30641","published":"2021-06-10T07:10:24.000Z","updated":"2024-08-03T22:40:31.820Z","title":"Unexpected URL matching with 'MergeSlashes OFF'","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.52612,"kevAdded":null},{"id":"CVE-2021-26691","published":"2021-06-10T07:10:23.000Z","updated":"2024-08-03T20:33:40.152Z","title":"Apache HTTP Server mod_session response handling heap overflow","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.68289,"kevAdded":null},{"id":"CVE-2021-26690","published":"2021-06-10T07:10:22.000Z","updated":"2024-08-03T20:33:40.192Z","title":"mod_session NULL pointer dereference","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.65308,"kevAdded":null},{"id":"CVE-2020-35452","published":"2021-06-10T07:10:21.000Z","updated":"2024-08-04T17:02:08.055Z","title":"mod_auth_digest possible stack overflow by one nul byte","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.54808,"kevAdded":null},{"id":"CVE-2020-13950","published":"2021-06-10T07:10:21.000Z","updated":"2024-08-04T12:32:14.669Z","title":"mod_proxy_http NULL pointer dereference","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.4937,"kevAdded":null},{"id":"CVE-2020-13938","published":"2021-06-10T07:10:20.000Z","updated":"2024-08-04T12:32:14.566Z","title":"Improper Handling of Insufficient Privileges","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.11867,"kevAdded":null},{"id":"CVE-2019-17567","published":"2021-06-10T07:10:19.000Z","updated":"2024-08-05T01:40:15.824Z","title":"mod_proxy_wstunnel tunneling of non Upgraded connections","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.60266,"kevAdded":null},{"id":"CVE-2021-33190","published":"2021-06-08T15:05:11.000Z","updated":"2024-08-03T23:42:20.273Z","title":"Bypass network access control","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache APISIX Dashboard","kev":false,"epss":0.02694,"kevAdded":null},{"id":"CVE-2021-30180","published":"2021-05-31T07:25:14.000Z","updated":"2024-08-03T22:24:59.649Z","title":"Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.60282,"kevAdded":null},{"id":"CVE-2021-30179","published":"2021-05-31T07:25:13.000Z","updated":"2024-08-03T22:24:59.625Z","title":"Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.04084,"kevAdded":null},{"id":"CVE-2021-25640","published":"2021-05-31T07:25:12.000Z","updated":"2024-08-03T20:11:27.531Z","title":"Open Redirect or SSRF vulnerability usage of parseURL","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.02073,"kevAdded":null},{"id":"CVE-2021-30181","published":"2021-05-29T07:30:12.000Z","updated":"2024-08-03T22:24:59.650Z","title":"Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.60858,"kevAdded":null},{"id":"CVE-2021-25641","published":"2021-05-29T07:30:12.000Z","updated":"2024-08-03T20:11:27.972Z","title":"Dubbo Zookeeper does not check serialization id","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.21221,"kevAdded":null},{"id":"CVE-2020-17514","published":"2021-05-27T12:10:10.000Z","updated":"2024-08-04T14:00:48.549Z","title":"disabled hostname verificiation","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.03401,"kevAdded":null},{"id":"CVE-2021-22160","published":"2021-05-26T12:22:31.000Z","updated":"2024-08-03T18:37:18.090Z","title":"Authentication with JWT allows use of “none”-algorithm","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Pulsar","kev":false,"epss":0.52926,"kevAdded":null},{"id":"CVE-2021-23937","published":"2021-05-25T08:05:10.000Z","updated":"2024-08-03T19:14:09.890Z","title":"DNS proxy and possible amplification attack","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.0426,"kevAdded":null},{"id":"CVE-2021-27737","published":"2021-05-14T20:39:39.000Z","updated":"2024-08-03T21:26:10.829Z","title":"Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.03694,"kevAdded":null},{"id":"CVE-2021-31164","published":"2021-05-04T06:55:12.000Z","updated":"2024-08-03T22:55:53.073Z","title":"Apache Unomi log injection","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Unomi","kev":false,"epss":0.02283,"kevAdded":null},{"id":"CVE-2021-28359","published":"2021-05-02T07:55:12.000Z","updated":"2024-08-03T21:40:14.401Z","title":"Apache Airflow Reflected XSS via Origin Query Argument in URL","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.14389,"kevAdded":null},{"id":"CVE-2021-30128","published":"2021-04-27T19:50:14.000Z","updated":"2024-08-03T22:24:59.428Z","title":"Unsafe deserialization in Apache OFBiz","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.81209,"kevAdded":null},{"id":"CVE-2021-29200","published":"2021-04-27T19:50:13.000Z","updated":"2024-08-03T22:02:50.505Z","title":"RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.5537,"kevAdded":null},{"id":"CVE-2021-30638","published":"2021-04-27T18:30:15.000Z","updated":"2024-08-03T22:40:31.642Z","title":"An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tapestry","kev":false,"epss":0.06559,"kevAdded":null},{"id":"CVE-2021-28125","published":"2021-04-27T09:27:22.000Z","updated":"2024-08-03T21:33:17.571Z","title":"Apache Superset Open Redirect","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.64016,"kevAdded":null},{"id":"CVE-2020-17517","published":"2021-04-27T08:22:22.000Z","updated":"2024-08-04T14:00:48.532Z","title":"Ozone S3 Gateway allows bucket and key access to non authenticated users","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ozone","kev":false,"epss":0.02266,"kevAdded":null},{"id":"CVE-2021-26291","published":"2021-04-23T14:20:13.000Z","updated":"2024-08-03T20:19:20.126Z","title":"block repositories using http by default","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Maven","kev":false,"epss":0.08691,"kevAdded":null},{"id":"CVE-2021-30245","published":"2021-04-15T19:30:14.000Z","updated":"2024-08-03T22:24:59.592Z","title":"Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.04942,"kevAdded":null},{"id":"CVE-2021-27850","published":"2021-04-15T07:40:11.000Z","updated":"2024-08-03T21:33:15.996Z","title":"Bypass of the fix for CVE-2019-0195","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tapestry","kev":false,"epss":0.9356,"kevAdded":null},{"id":"CVE-2021-29425","published":"2021-04-13T06:50:12.000Z","updated":"2026-10-07T18:16:03.279Z","title":"Possible limited path traversal vulnerabily in Apache Commons IO","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Commons IO","kev":false,"epss":0.10549,"kevAdded":null},{"id":"CVE-2021-29943","published":"2021-04-13T06:35:22.000Z","updated":"2024-08-03T22:18:03.277Z","title":"Apache Solr Unprivileged users may be able to perform unauthorized read/write to collections","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.04665,"kevAdded":null},{"id":"CVE-2021-29262","published":"2021-04-13T06:35:21.000Z","updated":"2024-08-03T22:02:51.423Z","title":"Misapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settings","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.06724,"kevAdded":null},{"id":"CVE-2021-27905","published":"2021-04-13T06:35:20.000Z","updated":"2024-08-03T21:33:16.792Z","title":"SSRF vulnerability with the Replication handler","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.93053,"kevAdded":null},{"id":"CVE-2021-22696","published":"2021-04-02T10:05:14.000Z","updated":"2025-02-13T16:27:45.767Z","title":"OAuth 2 authorization service vulnerable to DDos attacks","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.06593,"kevAdded":null},{"id":"CVE-2021-28657","published":"2021-03-31T07:35:14.000Z","updated":"2025-02-13T16:27:59.935Z","title":"Infinite loop in Apache Tika's MP3 parser","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02739,"kevAdded":null},{"id":"CVE-2021-26919","published":"2021-03-30T07:50:10.000Z","updated":"2025-02-13T16:27:55.797Z","title":"Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.35192,"kevAdded":null},{"id":"CVE-2020-1946","published":"2021-03-25T09:20:11.000Z","updated":"2025-02-13T16:27:40.012Z","title":"Apache SpamAssassin has an OS Command Injection vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache SpamAssassin","kev":false,"epss":0.06132,"kevAdded":null},{"id":"CVE-2021-26295","published":"2021-03-22T12:00:18.000Z","updated":"2025-02-13T16:27:51.958Z","title":"RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.97822,"kevAdded":null},{"id":"CVE-2021-27906","published":"2021-03-19T16:05:21.000Z","updated":"2025-02-13T16:27:57.655Z","title":"A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache PDFBox","kev":false,"epss":0.03337,"kevAdded":null},{"id":"CVE-2021-27807","published":"2021-03-19T16:05:20.000Z","updated":"2025-02-13T16:27:57.032Z","title":"A carefully crafted PDF file can trigger an infinite loop while loading the file","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache PDFBox","kev":false,"epss":0.02993,"kevAdded":null},{"id":"CVE-2020-17525","published":"2021-03-17T09:20:14.000Z","updated":"2025-02-13T16:27:35.247Z","title":"Remote unauthenticated denial-of-service in Subversion mod_authz_svn","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.40075,"kevAdded":null},{"id":"CVE-2020-13924","published":"2021-03-17T09:05:19.000Z","updated":"2025-02-13T16:27:28.694Z","title":"In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.0404,"kevAdded":null},{"id":"CVE-2020-1926","published":"2021-03-16T13:00:16.000Z","updated":"2025-02-13T16:27:38.760Z","title":"Timing attack in Cookie signature verification","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.02458,"kevAdded":null},{"id":"CVE-2021-27576","published":"2021-03-15T09:05:17.000Z","updated":"2025-02-13T16:27:56.370Z","title":"Apache OpenMeetings: bandwidth can be overloaded with public web service","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.0284,"kevAdded":null},{"id":"CVE-2020-13959","published":"2021-03-10T08:00:19.000Z","updated":"2025-02-13T16:27:31.176Z","title":"Velocity Tools XSS Vulnerability","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Velocity Tools","kev":false,"epss":0.05723,"kevAdded":null},{"id":"CVE-2020-13936","published":"2021-03-10T08:00:19.000Z","updated":"2025-02-13T16:27:29.361Z","title":"Velocity Sandbox Bypass","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Velocity Engine","kev":false,"epss":0.22709,"kevAdded":null},{"id":"CVE-2020-35451","published":"2021-03-09T15:20:13.000Z","updated":"2025-02-13T16:27:42.773Z","title":"Oozie local privilege escalation","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Oozie","kev":false,"epss":0.00434,"kevAdded":null},{"id":"CVE-2021-27907","published":"2021-03-05T11:35:15.000Z","updated":"2025-02-13T16:27:58.281Z","title":"Apache Superset stored XSS on Dashboard markdown","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.86393,"kevAdded":null},{"id":"CVE-2020-1936","published":"2021-03-02T09:00:22.000Z","updated":"2025-02-13T16:27:39.386Z","title":"Stored XSS in Apache Ambari","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.02864,"kevAdded":null},{"id":"CVE-2020-9479","published":"2021-03-01T15:55:12.000Z","updated":"2025-02-13T16:27:44.434Z","title":"unzip directory traversal","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache AsterixDB","kev":false,"epss":0.01977,"kevAdded":null},{"id":"CVE-2021-25329","published":"2021-03-01T12:00:20.000Z","updated":"2026-10-08T21:03:14.632Z","title":"Incomplete fix for CVE-2020-9484","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.09491,"kevAdded":null},{"id":"CVE-2021-25122","published":"2021-03-01T12:00:20.000Z","updated":"2026-10-08T21:13:48.044Z","title":"Apache Tomcat h2c request mix-up","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.18114,"kevAdded":null},{"id":"CVE-2020-11988","published":"2021-02-24T17:05:39.000Z","updated":"2024-08-04T11:48:57.553Z","title":"Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a…","severity":"HIGH","score":8.2,"vendor":null,"product":"Apache XmlGraphics Commons","kev":false,"epss":0.0665,"kevAdded":null},{"id":"CVE-2020-11987","published":"2021-02-24T00:00:00.000Z","updated":"2026-10-08T21:14:05.819Z","title":"Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted…","severity":"HIGH","score":8.2,"vendor":null,"product":"Apache Batik","kev":false,"epss":0.13635,"kevAdded":null},{"id":"CVE-2021-26544","published":"2021-02-20T09:00:15.000Z","updated":"2025-02-13T16:27:53.277Z","title":"Apache Livy (Incubating) is vulnerable to cross site scripting","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Livy (Incubating)","kev":false,"epss":0.02816,"kevAdded":null},{"id":"CVE-2021-26296","published":"2021-02-19T08:30:14.000Z","updated":"2025-02-13T16:27:52.470Z","title":"Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MyFaces Core","kev":false,"epss":0.02889,"kevAdded":null},{"id":"CVE-2021-26697","published":"2021-02-17T14:15:15.000Z","updated":"2025-02-13T16:27:54.957Z","title":"Apache Airflow: Lineage API endpoint for Experimental API missed authentication check","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.04555,"kevAdded":null},{"id":"CVE-2021-26559","published":"2021-02-17T14:15:14.000Z","updated":"2025-02-13T16:27:54.002Z","title":"CWE-284 Improper Access Control on Configurations Endpoint for the Stable API","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02805,"kevAdded":null},{"id":"CVE-2020-13949","published":"2021-02-12T19:39:09.000Z","updated":"2024-08-04T12:32:14.429Z","title":"In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Thrift","kev":false,"epss":0.06779,"kevAdded":null},{"id":"CVE-2020-13947","published":"2021-02-08T21:25:27.000Z","updated":"2024-08-04T12:32:14.331Z","title":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache ActiveMQ","kev":false,"epss":0.79179,"kevAdded":null},{"id":"CVE-2020-17523","published":"2021-02-03T16:55:18.000Z","updated":"2024-08-04T14:00:48.826Z","title":"Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Shiro","kev":false,"epss":0.85911,"kevAdded":null},{"id":"CVE-2020-17516","published":"2021-02-03T16:40:04.000Z","updated":"2024-08-04T14:00:48.346Z","title":"Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting,…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Cassandra","kev":false,"epss":0.01955,"kevAdded":null},{"id":"CVE-2021-25646","published":"2021-01-29T19:15:12.000Z","updated":"2025-02-13T16:27:49.264Z","title":"Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Druid","kev":false,"epss":0.99062,"kevAdded":null},{"id":"CVE-2021-26118","published":"2021-01-27T18:55:13.000Z","updated":"2025-02-13T16:27:51.360Z","title":"Flaw in ActiveMQ Artemis OpenWire support","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ Artemis","kev":false,"epss":0.03859,"kevAdded":null},{"id":"CVE-2021-26117","published":"2021-01-27T00:00:00.000Z","updated":"2024-08-03T20:19:20.050Z","title":"ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.1133,"kevAdded":null},{"id":"CVE-2020-9492","published":"2021-01-26T12:55:29.000Z","updated":"2024-08-04T10:26:16.405Z","title":"In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache Hadoop","kev":false,"epss":0.04493,"kevAdded":null},{"id":"CVE-2020-17522","published":"2021-01-26T12:42:07.000Z","updated":"2024-08-04T14:00:48.748Z","title":"When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that…","severity":"MEDIUM","score":5.8,"vendor":null,"product":"Apache Traffic Control","kev":false,"epss":0.03976,"kevAdded":null},{"id":"CVE-2021-23901","published":"2021-01-25T09:25:14.000Z","updated":"2025-02-13T16:27:46.383Z","title":"An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Nutch","kev":false,"epss":0.04412,"kevAdded":null},{"id":"CVE-2020-17532","published":"2021-01-25T09:25:14.000Z","updated":"2025-02-13T16:27:38.219Z","title":"Apache ServiceComb Yaml remote deserialization vulnerability","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache ServiceComb-Java-Chassis","kev":false,"epss":0.03381,"kevAdded":null},{"id":"CVE-2020-11997","published":"2021-01-19T21:12:29.000Z","updated":"2024-08-04T11:48:57.093Z","title":"Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the…","severity":"MEDIUM","score":4.3,"vendor":null,"product":"Apache Guacamole","kev":false,"epss":0.0126,"kevAdded":null},{"id":"CVE-2021-24122","published":"2021-01-14T14:45:18.000Z","updated":"2026-10-08T21:03:21.063Z","title":"Apache Tomcat information disclosure","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.22852,"kevAdded":null},{"id":"CVE-2021-23926","published":"2021-01-14T14:45:18.000Z","updated":"2025-02-13T16:27:47.031Z","title":"XMLBeans XML Entity Expansion","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache XMLBeans","kev":false,"epss":0.0629,"kevAdded":null},{"id":"CVE-2020-17534","published":"2021-01-11T15:33:28.000Z","updated":"2024-08-04T14:00:49.085Z","title":"There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API…","severity":"HIGH","score":7,"vendor":null,"product":"Apache NetBeans HTML/Java API","kev":false,"epss":0.00409,"kevAdded":null},{"id":"CVE-2020-17509","published":"2021-01-11T09:40:20.000Z","updated":"2024-08-04T14:00:48.143Z","title":"ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.01814,"kevAdded":null},{"id":"CVE-2020-17508","published":"2021-01-11T09:40:20.000Z","updated":"2024-08-04T14:00:48.638Z","title":"The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.02045,"kevAdded":null},{"id":"CVE-2020-13922","published":"2021-01-11T09:40:19.000Z","updated":"2025-02-13T16:27:28.158Z","title":"Apache DolphinScheduler (incubating) Permission vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","kev":false,"epss":0.0175,"kevAdded":null},{"id":"CVE-2020-11995","published":"2021-01-11T09:40:19.000Z","updated":"2025-02-13T16:27:27.063Z","title":"Apache Dubbo default deserialization protocol Hessian2 cause CRE","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Dubbo","kev":false,"epss":0.05926,"kevAdded":null},{"id":"CVE-2020-17519","published":"2021-01-05T11:40:14.000Z","updated":"2025-10-21T23:35:30.697Z","title":"Apache Flink directory traversal attack: reading remote files through the REST API","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Flink","kev":true,"epss":0.98001,"kevAdded":"2024-05-23"},{"id":"CVE-2020-17518","published":"2021-01-05T11:40:13.000Z","updated":"2025-02-13T16:27:34.016Z","title":"Apache Flink directory traversal attack: remote file writing through the REST API","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Flink","kev":false,"epss":0.49104,"kevAdded":null},{"id":"CVE-2020-17533","published":"2020-12-29T11:30:13.000Z","updated":"2024-08-04T14:00:48.650Z","title":"Apache Accumulo Improper Handling of Insufficient Permissions","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Accumulo","kev":false,"epss":0.03699,"kevAdded":null},{"id":"CVE-2020-17526","published":"2020-12-21T16:45:13.000Z","updated":"2025-02-13T16:27:35.877Z","title":"Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log…","severity":"HIGH","score":7.7,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.23864,"kevAdded":null},{"id":"CVE-2020-17520","published":"2020-12-18T20:48:08.000Z","updated":"2024-08-04T14:00:48.984Z","title":"In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by constructing special…","severity":"MEDIUM","score":6.5,"vendor":null,"product":"Pulsar Manager","kev":false,"epss":0.01353,"kevAdded":null},{"id":"CVE-2020-11974","published":"2020-12-18T00:00:00.000Z","updated":"2024-08-04T11:48:57.494Z","title":"In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache DolphinScheduler(Incubating)","kev":false,"epss":0.08124,"kevAdded":null},{"id":"CVE-2020-13931","published":"2020-12-17T23:42:39.000Z","updated":"2024-08-04T12:32:14.285Z","title":"If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache TomEE","kev":false,"epss":0.03699,"kevAdded":null},{"id":"CVE-2020-17513","published":"2020-12-14T09:40:15.000Z","updated":"2025-02-13T16:27:32.817Z","title":"In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.04377,"kevAdded":null},{"id":"CVE-2020-17511","published":"2020-12-14T09:40:15.000Z","updated":"2025-02-13T16:27:32.260Z","title":"In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase.…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02618,"kevAdded":null},{"id":"CVE-2020-17515","published":"2020-12-11T13:40:12.000Z","updated":"2025-02-13T16:27:33.389Z","title":"The \"origin\" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.16214,"kevAdded":null},{"id":"CVE-2020-17530","published":"2020-12-11T01:11:04.000Z","updated":"2025-10-21T23:35:31.563Z","title":"Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":true,"epss":0.96251,"kevAdded":"2021-11-03"},{"id":"CVE-2020-17529","published":"2020-12-09T16:35:14.000Z","updated":"2025-02-13T16:27:37.563Z","title":"Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NuttX (incubating)","kev":false,"epss":0.0289,"kevAdded":null},{"id":"CVE-2020-17528","published":"2020-12-09T16:35:13.000Z","updated":"2025-02-13T16:27:37.002Z","title":"Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache NuttX (incubating)","kev":false,"epss":0.03172,"kevAdded":null},{"id":"CVE-2020-17531","published":"2020-12-08T00:00:00.000Z","updated":"2024-08-04T14:00:48.808Z","title":"Deserialization flaw in EOL Tapestry 4.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tapestry","kev":false,"epss":0.09996,"kevAdded":null},{"id":"CVE-2020-17521","published":"2020-12-07T19:22:37.000Z","updated":"2026-10-08T21:13:54.562Z","title":"Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Groovy","kev":false,"epss":0.01027,"kevAdded":null},{"id":"CVE-2020-13945","published":"2020-12-07T19:04:52.000Z","updated":"2024-08-04T12:32:14.572Z","title":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache APISIX","kev":false,"epss":0.73585,"kevAdded":null},{"id":"CVE-2020-17527","published":"2020-12-03T18:30:14.000Z","updated":"2026-10-08T21:13:51.170Z","title":"Apache Tomcat: Request header mix-up between HTTP/2 streams","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.24622,"kevAdded":null},{"id":"CVE-2020-13956","published":"2020-12-02T16:20:12.000Z","updated":"2026-10-08T18:44:13.434Z","title":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache HttpClient","kev":false,"epss":0.09032,"kevAdded":null},{"id":"CVE-2020-11990","published":"2020-12-01T16:46:08.000Z","updated":"2024-08-04T11:48:57.611Z","title":"We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead…","severity":"LOW","score":3.3,"vendor":null,"product":"Apache Cordova ( cordova-plugin-camera )","kev":false,"epss":0.00741,"kevAdded":null},{"id":"CVE-2020-13942","published":"2020-11-24T18:00:16.000Z","updated":"2025-02-13T16:27:30.019Z","title":"Remote Code Execution in Apache Unomi","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Unomi","kev":false,"epss":0.68516,"kevAdded":null},{"id":"CVE-2019-12412","published":"2020-11-18T23:16:50.000Z","updated":"2024-08-04T23:17:39.994Z","title":"A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could send a request causing…","severity":"HIGH","score":7.5,"vendor":null,"product":"libapreq2","kev":false,"epss":0.04106,"kevAdded":null},{"id":"CVE-2020-13958","published":"2020-11-17T15:17:57.000Z","updated":"2024-08-04T12:32:14.471Z","title":"A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target…","severity":"HIGH","score":7.8,"vendor":null,"product":"Apache OpenOffice","kev":false,"epss":0.02898,"kevAdded":null},{"id":"CVE-2020-13954","published":"2020-11-12T12:45:14.000Z","updated":"2025-02-13T16:27:30.592Z","title":"Apache CXF Reflected XSS in the services listing page via the styleSheetPath","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.40873,"kevAdded":null},{"id":"CVE-2019-17566","published":"2020-11-12T00:00:00.000Z","updated":"2024-08-05T01:40:15.834Z","title":"Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the \"xlink:href\" attributes. By using a specially-crafted…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Batik","kev":false,"epss":0.10867,"kevAdded":null},{"id":"CVE-2020-13927","published":"2020-11-10T00:00:00.000Z","updated":"2025-10-21T23:35:32.975Z","title":"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Airflow","kev":true,"epss":0.99778,"kevAdded":"2022-01-18"},{"id":"CVE-2020-17510","published":"2020-11-05T20:17:36.000Z","updated":"2024-08-04T14:00:48.649Z","title":"Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Shiro","kev":false,"epss":0.08029,"kevAdded":null},{"id":"CVE-2018-11764","published":"2020-10-21T18:13:56.000Z","updated":"2024-08-05T08:17:09.093Z","title":"Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache Hadoop","kev":false,"epss":0.02394,"kevAdded":null},{"id":"CVE-2020-13937","published":"2020-10-19T20:33:18.000Z","updated":"2024-08-04T12:32:14.371Z","title":"Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha,…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache Kylin","kev":false,"epss":0.78331,"kevAdded":null},{"id":"CVE-2020-13957","published":"2020-10-13T18:28:52.000Z","updated":"2024-08-04T12:32:14.343Z","title":"Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Solr","kev":false,"epss":0.79342,"kevAdded":null},{"id":"CVE-2018-20243","published":"2020-10-13T18:23:49.000Z","updated":"2024-08-05T11:58:18.736Z","title":"The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Fineract","kev":false,"epss":0.02673,"kevAdded":null},{"id":"CVE-2020-13943","published":"2020-10-12T13:46:47.000Z","updated":"2026-10-08T21:13:52.499Z","title":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent…","severity":"MEDIUM","score":4.3,"vendor":null,"product":"Apache Tomcat","kev":false,"epss":0.52639,"kevAdded":null},{"id":"CVE-2020-13955","published":"2020-10-09T12:33:50.000Z","updated":"2024-08-04T12:32:14.444Z","title":"HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks.…","severity":"MEDIUM","score":5.9,"vendor":null,"product":"Apache Calcite","kev":false,"epss":0.02149,"kevAdded":null},{"id":"CVE-2020-9491","published":"2020-10-01T19:57:34.000Z","updated":"2024-08-04T10:26:16.409Z","title":"In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.02871,"kevAdded":null},{"id":"CVE-2020-13940","published":"2020-10-01T19:55:16.000Z","updated":"2024-08-04T12:32:14.454Z","title":"In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators…","severity":"MEDIUM","score":5.5,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.01911,"kevAdded":null},{"id":"CVE-2020-9487","published":"2020-10-01T19:53:11.000Z","updated":"2024-08-04T10:26:16.254Z","title":"In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.0305,"kevAdded":null},{"id":"CVE-2020-9486","published":"2020-10-01T19:50:53.000Z","updated":"2024-08-04T10:26:16.358Z","title":"In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered,…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.03558,"kevAdded":null},{"id":"CVE-2020-11979","published":"2020-10-01T19:24:57.000Z","updated":"2026-10-08T21:24:17.454Z","title":"As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Ant","kev":false,"epss":0.07757,"kevAdded":null},{"id":"CVE-2020-13952","published":"2020-09-30T20:48:57.000Z","updated":"2024-08-04T12:32:14.364Z","title":"In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could…","severity":"HIGH","score":8.1,"vendor":null,"product":"Apache Superset","kev":false,"epss":0.02018,"kevAdded":null},{"id":"CVE-2020-13951","published":"2020-09-30T17:22:51.000Z","updated":"2024-08-04T12:32:14.315Z","title":"Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache OpenMeetings","kev":false,"epss":0.68578,"kevAdded":null},{"id":"CVE-2018-11765","published":"2020-09-30T17:02:20.000Z","updated":"2024-08-05T08:17:09.112Z","title":"In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Hadoop","kev":false,"epss":0.05207,"kevAdded":null},{"id":"CVE-2020-13953","published":"2020-09-30T16:51:59.000Z","updated":"2024-08-04T12:32:14.261Z","title":"In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache Tapestry","kev":false,"epss":0.02651,"kevAdded":null},{"id":"CVE-2020-13944","published":"2020-09-17T14:01:40.000Z","updated":"2024-08-04T12:32:14.289Z","title":"In Apache Airflow < 1.10.12, the \"origin\" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache Airflow","kev":false,"epss":0.25076,"kevAdded":null},{"id":"CVE-2020-13948","published":"2020-09-17T12:31:11.000Z","updated":"2024-08-04T12:32:14.364Z","title":"While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache Superset","kev":false,"epss":0.03102,"kevAdded":null},{"id":"CVE-2020-13928","published":"2020-09-16T17:38:38.000Z","updated":"2024-08-04T12:32:14.230Z","title":"Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache Atlas","kev":false,"epss":0.02587,"kevAdded":null},{"id":"CVE-2020-11977","published":"2020-09-15T19:02:51.000Z","updated":"2024-08-04T11:48:57.570Z","title":"In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service…","severity":"HIGH","score":7.2,"vendor":null,"product":"Apache Syncope","kev":false,"epss":0.02862,"kevAdded":null},{"id":"CVE-2019-0233","published":"2020-09-14T16:50:11.000Z","updated":"2024-08-04T17:44:15.954Z","title":"An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Struts","kev":false,"epss":0.66146,"kevAdded":null},{"id":"CVE-2019-0230","published":"2020-09-14T16:41:27.000Z","updated":"2024-08-04T17:44:15.965Z","title":"Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Struts","kev":false,"epss":0.96946,"kevAdded":null},{"id":"CVE-2020-11991","published":"2020-09-11T13:28:20.000Z","updated":"2024-08-04T11:48:57.582Z","title":"When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be used to access any…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Cocoon","kev":false,"epss":0.72456,"kevAdded":null},{"id":"CVE-2020-11998","published":"2020-09-10T18:10:22.000Z","updated":"2024-08-04T11:48:57.796Z","title":"A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache ActiveMQ","kev":false,"epss":0.48885,"kevAdded":null},{"id":"CVE-2020-13920","published":"2020-09-10T00:00:00.000Z","updated":"2024-08-04T12:32:14.288Z","title":"Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the \"jmxrmi\" entry. It is possible to connect to…","severity":"MEDIUM","score":5.9,"vendor":null,"product":"Apache ActiveMQ","kev":false,"epss":0.04544,"kevAdded":null},{"id":"CVE-2020-11986","published":"2020-09-09T15:28:59.000Z","updated":"2024-08-04T11:48:57.611Z","title":"To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache NetBeans","kev":false,"epss":0.09931,"kevAdded":null},{"id":"CVE-2020-13946","published":"2020-09-01T20:49:32.000Z","updated":"2024-08-04T12:32:14.251Z","title":"In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache…","severity":"MEDIUM","score":5.9,"vendor":null,"product":"Apache Cassandra","kev":false,"epss":0.02951,"kevAdded":null},{"id":"CVE-2020-13933","published":"2020-08-17T20:19:53.000Z","updated":"2024-08-04T12:32:14.332Z","title":"Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Shiro","kev":false,"epss":0.44411,"kevAdded":null},{"id":"CVE-2020-13941","published":"2020-08-17T12:16:37.000Z","updated":"2024-08-04T12:32:14.273Z","title":"Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache Solr","kev":false,"epss":0.0526,"kevAdded":null},{"id":"CVE-2020-11976","published":"2020-08-11T18:15:51.000Z","updated":"2024-08-04T11:48:57.562Z","title":"By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Wicket","kev":false,"epss":0.03759,"kevAdded":null},{"id":"CVE-2020-11985","published":"2020-08-07T15:36:31.000Z","updated":"2024-08-04T11:48:58.232Z","title":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.0705,"kevAdded":null},{"id":"CVE-2020-11993","published":"2020-08-07T15:32:55.000Z","updated":"2024-08-04T11:48:57.265Z","title":"Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.56448,"kevAdded":null},{"id":"CVE-2020-11984","published":"2020-08-07T15:27:15.000Z","updated":"2024-08-04T11:48:57.555Z","title":"Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.90039,"kevAdded":null},{"id":"CVE-2020-9490","published":"2020-08-07T15:24:49.000Z","updated":"2024-08-04T10:26:16.299Z","title":"Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.88844,"kevAdded":null},{"id":"CVE-2020-13921","published":"2020-08-05T13:25:14.000Z","updated":"2024-08-04T12:32:14.435Z","title":"**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache SkyWalking","kev":false,"epss":0.33478,"kevAdded":null},{"id":"CVE-2020-13932","published":"2020-07-20T21:08:34.000Z","updated":"2024-08-04T12:32:14.247Z","title":"In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability.…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache ActiveMQ Artemis","kev":false,"epss":0.04347,"kevAdded":null},{"id":"CVE-2020-9485","published":"2020-07-16T23:21:35.000Z","updated":"2024-08-04T10:26:16.269Z","title":"An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the \"classic\" UI.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0276,"kevAdded":null},{"id":"CVE-2020-11983","published":"2020-07-16T23:21:30.000Z","updated":"2024-08-04T11:48:57.534Z","title":"An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01766,"kevAdded":null},{"id":"CVE-2020-11982","published":"2020-07-16T23:21:25.000Z","updated":"2024-08-04T11:48:57.514Z","title":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly,…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.07225,"kevAdded":null},{"id":"CVE-2020-11981","published":"2020-07-16T23:21:18.000Z","updated":"2024-08-04T11:48:57.081Z","title":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ)…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.36787,"kevAdded":null},{"id":"CVE-2020-11978","published":"2020-07-16T00:00:00.000Z","updated":"2025-10-21T23:35:39.214Z","title":"An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":true,"epss":0.99189,"kevAdded":"2022-01-18"},{"id":"CVE-2020-9496","published":"2020-07-15T15:39:31.000Z","updated":"2024-08-04T10:34:37.912Z","title":"XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache OFBiz","kev":false,"epss":0.98926,"kevAdded":null},{"id":"CVE-2020-13923","published":"2020-07-15T15:38:13.000Z","updated":"2024-08-04T12:32:14.324Z","title":"IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache OFBiz","kev":false,"epss":0.05028,"kevAdded":null},{"id":"CVE-2020-13935","published":"2020-07-14T15:00:21.000Z","updated":"2026-10-08T21:03:33.405Z","title":"The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Tomcat","kev":false,"epss":0.86608,"kevAdded":null},{"id":"CVE-2020-13934","published":"2020-07-14T14:59:11.000Z","updated":"2026-10-08T21:13:57.516Z","title":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Tomcat","kev":false,"epss":0.64124,"kevAdded":null},{"id":"CVE-2020-1948","published":"2020-07-14T13:11:31.000Z","updated":"2024-08-04T06:53:59.966Z","title":"This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Dubbo","kev":false,"epss":0.16441,"kevAdded":null},{"id":"CVE-2020-13926","published":"2020-07-14T12:50:48.000Z","updated":"2024-08-04T12:32:14.237Z","title":"Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Kylin","kev":false,"epss":0.0195,"kevAdded":null},{"id":"CVE-2020-13925","published":"2020-07-14T12:47:46.000Z","updated":"2024-08-04T12:32:14.207Z","title":"Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Kylin","kev":false,"epss":0.20013,"kevAdded":null},{"id":"CVE-2020-11994","published":"2020-07-08T15:13:02.000Z","updated":"2024-08-04T11:48:57.522Z","title":"Server-Side Template Injection and arbitrary file disclosure on Camel templating components","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Camel","kev":false,"epss":0.04491,"kevAdded":null},{"id":"CVE-2020-9498","published":"2020-07-02T12:32:44.000Z","updated":"2024-08-04T10:34:39.028Z","title":"Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious…","severity":"MEDIUM","score":6.7,"vendor":null,"product":"Apache Guacamole","kev":false,"epss":0.0074,"kevAdded":null},{"id":"CVE-2020-9497","published":"2020-07-02T12:30:33.000Z","updated":"2024-08-04T10:34:38.227Z","title":"Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If a userconnects to a malicious or…","severity":"MEDIUM","score":4.4,"vendor":null,"product":"Apache Guacamole","kev":false,"epss":0.00792,"kevAdded":null},{"id":"CVE-2020-9483","published":"2020-06-30T14:28:35.000Z","updated":"2024-08-04T10:26:16.219Z","title":"**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache SkyWalking","kev":false,"epss":0.34855,"kevAdded":null},{"id":"CVE-2020-11996","published":"2020-06-26T16:27:20.000Z","updated":"2026-10-08T21:13:56.997Z","title":"A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Tomcat","kev":false,"epss":0.26699,"kevAdded":null},{"id":"CVE-2020-9494","published":"2020-06-24T15:25:57.000Z","updated":"2024-08-04T10:34:37.925Z","title":"Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.0358,"kevAdded":null},{"id":"CVE-2020-9480","published":"2020-06-23T21:50:51.000Z","updated":"2024-08-04T10:26:16.324Z","title":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret.…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.2937,"kevAdded":null},{"id":"CVE-2020-11989","published":"2020-06-22T18:06:37.000Z","updated":"2024-08-04T11:48:57.710Z","title":"Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Shiro","kev":false,"epss":0.24436,"kevAdded":null},{"id":"CVE-2020-9495","published":"2020-06-19T18:59:20.000Z","updated":"2024-08-04T10:34:38.175Z","title":"Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache Archiva","kev":false,"epss":0.08069,"kevAdded":null},{"id":"CVE-2020-11969","published":"2020-06-15T19:03:49.000Z","updated":"2024-08-04T11:48:56.988Z","title":"If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache TomEE","kev":false,"epss":0.04218,"kevAdded":null},{"id":"CVE-2020-11980","published":"2020-06-12T21:55:34.000Z","updated":"2024-08-04T11:48:57.229Z","title":"In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an \"admin\" can actually invoke on an MBean.…","severity":"MEDIUM","score":6.3,"vendor":null,"product":"Apache Karaf","kev":false,"epss":0.01876,"kevAdded":null},{"id":"CVE-2020-11975","published":"2020-06-05T14:10:57.000Z","updated":"2024-08-04T11:48:57.089Z","title":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Unomi","kev":false,"epss":0.3061,"kevAdded":null},{"id":"CVE-2020-1963","published":"2020-06-03T12:53:40.000Z","updated":"2024-08-04T06:54:00.364Z","title":"Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.","severity":"CRITICAL","score":9.1,"vendor":null,"product":"Apache Ignite","kev":false,"epss":0.04983,"kevAdded":null},{"id":"CVE-2020-1956","published":"2020-05-22T13:27:43.000Z","updated":"2025-10-21T23:35:43.316Z","title":"Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…","severity":"HIGH","score":8.8,"vendor":"Apache","product":"Kylin","kev":true,"epss":0.97389,"kevAdded":"2022-03-25"},{"id":"CVE-2020-9484","published":"2020-05-20T18:26:41.000Z","updated":"2026-10-08T21:03:14.884Z","title":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…","severity":"HIGH","score":7,"vendor":null,"product":"Apache Tomcat","kev":false,"epss":0.5552,"kevAdded":null},{"id":"CVE-2020-1955","published":"2020-05-20T13:53:44.000Z","updated":"2024-08-04T06:54:00.400Z","title":"CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache CouchDB","kev":false,"epss":0.01846,"kevAdded":null},{"id":"CVE-2020-1941","published":"2020-05-14T16:29:26.000Z","updated":"2024-08-04T06:54:00.336Z","title":"In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache ActiveMQ","kev":false,"epss":0.0715,"kevAdded":null},{"id":"CVE-2020-11972","published":"2020-05-14T16:26:03.000Z","updated":"2024-08-04T11:48:57.301Z","title":"Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Camel","kev":false,"epss":0.05652,"kevAdded":null},{"id":"CVE-2020-11973","published":"2020-05-14T16:22:23.000Z","updated":"2024-08-04T11:48:56.989Z","title":"Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Camel","kev":false,"epss":0.06756,"kevAdded":null},{"id":"CVE-2020-11971","published":"2020-05-14T16:18:41.000Z","updated":"2024-08-04T11:48:56.399Z","title":"Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Camel","kev":false,"epss":0.13959,"kevAdded":null},{"id":"CVE-2019-17562","published":"2020-05-14T16:14:55.000Z","updated":"2024-08-05T01:40:15.938Z","title":"A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache CloudStack","kev":false,"epss":0.02992,"kevAdded":null},{"id":"CVE-2019-17572","published":"2020-05-14T16:10:48.000Z","updated":"2024-08-05T01:40:15.813Z","title":"In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache RocketMQ","kev":false,"epss":0.02985,"kevAdded":null},{"id":"CVE-2020-1960","published":"2020-05-14T16:02:50.000Z","updated":"2024-08-04T06:54:00.339Z","title":"A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to…","severity":"MEDIUM","score":4.7,"vendor":null,"product":"Apache Flink","kev":false,"epss":0.00863,"kevAdded":null},{"id":"CVE-2020-1945","published":"2020-05-14T15:57:34.000Z","updated":"2024-08-04T06:54:00.377Z","title":"Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and…","severity":"MEDIUM","score":6.3,"vendor":null,"product":"Apache Ant","kev":false,"epss":0.01769,"kevAdded":null},{"id":"CVE-2020-1939","published":"2020-05-12T14:57:55.000Z","updated":"2024-08-04T06:54:00.344Z","title":"The Apache NuttX (Incubating) project provides an optional separate \"apps\" repository which contains various optional components and example programs. One of…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache NuttX (incubating)","kev":false,"epss":0.02559,"kevAdded":null},{"id":"CVE-2018-1285","published":"2020-05-11T16:41:28.000Z","updated":"2024-08-05T03:59:37.654Z","title":"Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache log4net","kev":false,"epss":0.17823,"kevAdded":null},{"id":"CVE-2020-1961","published":"2020-05-04T12:28:53.000Z","updated":"2024-08-04T06:53:59.969Z","title":"Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Syncope","kev":false,"epss":0.048,"kevAdded":null},{"id":"CVE-2019-17557","published":"2020-05-04T12:27:31.000Z","updated":"2024-08-05T01:40:15.982Z","title":"It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the…","severity":"MEDIUM","score":5.4,"vendor":null,"product":"Apache Syncope","kev":false,"epss":0.0123,"kevAdded":null},{"id":"CVE-2020-1959","published":"2020-05-04T12:25:18.000Z","updated":"2024-08-04T06:54:00.293Z","title":"A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Syncope","kev":false,"epss":0.04982,"kevAdded":null},{"id":"CVE-2019-0235","published":"2020-04-30T19:22:20.000Z","updated":"2024-08-04T17:44:15.925Z","title":"Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.","severity":"HIGH","score":8.8,"vendor":"Apache","product":"Apache OFBiz","kev":false,"epss":0.32747,"kevAdded":null},{"id":"CVE-2019-12425","published":"2020-04-30T19:20:11.000Z","updated":"2024-08-04T23:17:40.005Z","title":"Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache OFBiz","kev":false,"epss":0.04781,"kevAdded":null},{"id":"CVE-2020-9482","published":"2020-04-28T18:12:58.000Z","updated":"2024-08-04T10:26:16.177Z","title":"If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication…","severity":"MEDIUM","score":6.5,"vendor":"Apache","product":"Apache NiFi Registry","kev":false,"epss":0.02672,"kevAdded":null},{"id":"CVE-2020-9481","published":"2020-04-27T21:11:54.000Z","updated":"2024-08-04T10:26:16.220Z","title":"Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.","severity":"HIGH","score":7.5,"vendor":"Apache","product":"ATS","kev":false,"epss":0.02387,"kevAdded":null},{"id":"CVE-2020-1952","published":"2020-04-27T16:16:12.000Z","updated":"2024-08-04T06:54:00.401Z","title":"An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"IoTDB","kev":false,"epss":0.02676,"kevAdded":null},{"id":"CVE-2020-9488","published":"2020-04-27T15:36:10.000Z","updated":"2026-05-29T16:07:52.931Z","title":"Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a…","severity":"LOW","score":3.7,"vendor":"Apache","product":"Apache Log4j","kev":false,"epss":0.08216,"kevAdded":null},{"id":"CVE-2020-9489","published":"2020-04-27T13:25:27.000Z","updated":"2024-08-04T10:26:16.391Z","title":"A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or…","severity":"MEDIUM","score":5.5,"vendor":"The Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02709,"kevAdded":null},{"id":"CVE-2020-1964","published":"2020-04-16T16:21:05.000Z","updated":"2024-08-04T06:54:00.371Z","title":"It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Heron","kev":false,"epss":0.04815,"kevAdded":null},{"id":"CVE-2020-1927","published":"2020-04-01T23:08:43.000Z","updated":"2024-08-04T06:53:59.905Z","title":"In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Apache HTTP Server","kev":false,"epss":0.56691,"kevAdded":null},{"id":"CVE-2020-1958","published":"2020-04-01T21:48:33.000Z","updated":"2024-08-04T06:54:00.299Z","title":"When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the…","severity":"MEDIUM","score":6.5,"vendor":"Apache","product":"Apache Druid","kev":false,"epss":0.04565,"kevAdded":null},{"id":"CVE-2019-17564","published":"2020-04-01T21:17:59.000Z","updated":"2024-08-05T01:40:15.977Z","title":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache Dubbo","kev":false,"epss":0.36513,"kevAdded":null},{"id":"CVE-2018-11802","published":"2020-04-01T21:11:38.000Z","updated":"2024-08-05T08:17:09.126Z","title":"In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node…","severity":"MEDIUM","score":4.3,"vendor":"Apache","product":"Apache Solr","kev":false,"epss":0.0202,"kevAdded":null},{"id":"CVE-2020-1954","published":"2020-04-01T20:07:29.000Z","updated":"2024-08-04T06:54:00.267Z","title":"Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘…","severity":"MEDIUM","score":5.3,"vendor":"Apache","product":"Apache CXF","kev":false,"epss":0.06147,"kevAdded":null},{"id":"CVE-2020-1934","published":"2020-04-01T19:22:23.000Z","updated":"2024-08-04T06:54:00.049Z","title":"In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.","severity":"MEDIUM","score":5.3,"vendor":"Apache","product":"Apache HTTP Server","kev":false,"epss":0.51951,"kevAdded":null},{"id":"CVE-2020-1949","published":"2020-04-01T18:25:32.000Z","updated":"2024-08-04T06:53:59.928Z","title":"Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache Sling","kev":false,"epss":0.01965,"kevAdded":null},{"id":"CVE-2020-1943","published":"2020-04-01T18:18:48.000Z","updated":"2024-08-04T06:53:59.927Z","title":"Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Apache OFBiz","kev":false,"epss":0.97309,"kevAdded":null},{"id":"CVE-2019-17561","published":"2020-03-30T18:44:42.000Z","updated":"2024-08-05T01:40:15.924Z","title":"The \"Apache NetBeans\" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code.…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache NetBeans","kev":false,"epss":0.01675,"kevAdded":null},{"id":"CVE-2019-17560","published":"2020-03-30T18:39:41.000Z","updated":"2024-08-05T01:40:15.835Z","title":"The \"Apache NetBeans\" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept…","severity":"CRITICAL","score":9.1,"vendor":null,"product":"Apache NetBeans","kev":false,"epss":0.02323,"kevAdded":null},{"id":"CVE-2020-1957","published":"2020-03-25T15:24:27.000Z","updated":"2024-08-04T06:54:00.565Z","title":"Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Shiro","kev":false,"epss":0.23326,"kevAdded":null},{"id":"CVE-2020-1944","published":"2020-03-23T21:46:47.000Z","updated":"2024-08-04T06:54:00.400Z","title":"There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.02734,"kevAdded":null},{"id":"CVE-2019-17559","published":"2020-03-23T21:43:46.000Z","updated":"2024-08-05T01:40:15.850Z","title":"There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.03166,"kevAdded":null},{"id":"CVE-2019-17565","published":"2020-03-23T21:13:05.000Z","updated":"2024-08-05T01:40:15.852Z","title":"There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.03166,"kevAdded":null},{"id":"CVE-2020-1951","published":"2020-03-23T13:26:37.000Z","updated":"2024-08-04T06:54:00.380Z","title":"A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.","severity":"MEDIUM","score":5.5,"vendor":null,"product":"Apache Tika","kev":false,"epss":0.02892,"kevAdded":null},{"id":"CVE-2020-1950","published":"2020-03-23T13:21:52.000Z","updated":"2024-08-04T06:54:00.402Z","title":"A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.","severity":"MEDIUM","score":5.5,"vendor":"Apache","product":"Apache Tika","kev":false,"epss":0.02986,"kevAdded":null},{"id":"CVE-2019-12416","published":"2020-03-19T14:48:52.000Z","updated":"2024-08-04T23:17:40.117Z","title":"we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache DeltaSpike","kev":false,"epss":0.02714,"kevAdded":null},{"id":"CVE-2019-10091","published":"2020-03-16T13:05:51.000Z","updated":"2024-08-04T22:10:09.442Z","title":"When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate…","severity":"HIGH","score":7.4,"vendor":null,"product":"Apache Geode","kev":false,"epss":0.01417,"kevAdded":null},{"id":"CVE-2020-1953","published":"2020-03-13T14:58:49.000Z","updated":"2024-08-04T06:53:59.884Z","title":"Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special…","severity":"CRITICAL","score":10,"vendor":"Apache","product":"Apache Commons Configuration","kev":false,"epss":0.06323,"kevAdded":null},{"id":"CVE-2020-1947","published":"2020-03-11T20:40:53.000Z","updated":"2024-08-04T06:54:00.370Z","title":"In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache ShardingSphere(incubator)","kev":false,"epss":0.33918,"kevAdded":null},{"id":"CVE-2020-1938","published":"2020-02-24T21:19:18.000Z","updated":"2025-10-21T23:35:50.835Z","title":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache Tomcat","kev":true,"epss":0.9927,"kevAdded":"2022-03-03"},{"id":"CVE-2020-1935","published":"2020-02-24T21:11:38.000Z","updated":"2026-10-08T21:03:23.185Z","title":"In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some…","severity":"MEDIUM","score":4.8,"vendor":"Apache","product":"Apache Tomcat","kev":false,"epss":0.09386,"kevAdded":null},{"id":"CVE-2019-17569","published":"2020-02-24T21:04:40.000Z","updated":"2024-08-05T01:40:15.855Z","title":"The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that…","severity":"MEDIUM","score":4.8,"vendor":"Apache","product":"Apache Tomcat","kev":false,"epss":0.08872,"kevAdded":null},{"id":"CVE-2020-1937","published":"2020-02-24T20:57:52.000Z","updated":"2024-08-04T06:53:59.800Z","title":"Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.","severity":"HIGH","score":8.8,"vendor":"Apache","product":"Apache Kylin","kev":false,"epss":0.0307,"kevAdded":null},{"id":"CVE-2020-1942","published":"2020-02-11T20:57:26.000Z","updated":"2024-08-04T06:54:00.412Z","title":"In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.03124,"kevAdded":null},{"id":"CVE-2019-12426","published":"2020-02-06T16:47:14.000Z","updated":"2024-08-04T23:17:40.123Z","title":"an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06","severity":"MEDIUM","score":5.3,"vendor":"Apache","product":"Apache OFBiz","kev":false,"epss":0.04889,"kevAdded":null},{"id":"CVE-2020-1930","published":"2020-01-30T17:42:38.000Z","updated":"2024-08-04T06:54:00.374Z","title":"A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache SpamAssassin","kev":false,"epss":0.07053,"kevAdded":null},{"id":"CVE-2020-1931","published":"2020-01-30T17:38:42.000Z","updated":"2024-08-04T06:53:59.924Z","title":"A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache SpamAssassin","kev":false,"epss":0.06464,"kevAdded":null},{"id":"CVE-2020-1940","published":"2020-01-28T16:51:10.000Z","updated":"2024-08-04T06:53:59.869Z","title":"The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Jackrabbit Oak","kev":false,"epss":0.04511,"kevAdded":null},{"id":"CVE-2020-1932","published":"2020-01-28T00:38:15.000Z","updated":"2024-08-04T06:54:00.326Z","title":"An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Superset","kev":false,"epss":0.01351,"kevAdded":null},{"id":"CVE-2020-1933","published":"2020-01-28T00:33:32.000Z","updated":"2024-08-04T06:54:00.368Z","title":"A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.02813,"kevAdded":null},{"id":"CVE-2020-1928","published":"2020-01-28T00:28:08.000Z","updated":"2024-08-04T06:54:00.379Z","title":"An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03959,"kevAdded":null},{"id":"CVE-2019-17570","published":"2020-01-23T00:00:00.000Z","updated":"2024-08-05T01:40:15.866Z","title":"An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache XML-RPC","kev":false,"epss":0.49285,"kevAdded":null},{"id":"CVE-2019-17573","published":"2020-01-16T17:50:42.000Z","updated":"2024-08-05T01:47:12.612Z","title":"By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"CXF","kev":false,"epss":0.07055,"kevAdded":null},{"id":"CVE-2019-12423","published":"2020-01-16T17:42:14.000Z","updated":"2024-08-04T23:17:40.033Z","title":"Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"CXF","kev":false,"epss":0.0606,"kevAdded":null},{"id":"CVE-2020-1929","published":"2020-01-15T18:56:55.000Z","updated":"2024-08-04T06:54:00.337Z","title":"The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Beam","kev":false,"epss":0.01025,"kevAdded":null},{"id":"CVE-2019-12398","published":"2020-01-14T16:28:35.000Z","updated":"2024-08-04T23:17:40.125Z","title":"In Apache Airflow before 1.10.5 when running with the \"classic\" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to…","severity":"MEDIUM","score":4.8,"vendor":"Apache","product":"Airflow","kev":false,"epss":0.02824,"kevAdded":null},{"id":"CVE-2019-12399","published":"2020-01-14T14:28:57.000Z","updated":"2024-08-04T23:17:40.107Z","title":"When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Kafka","kev":false,"epss":0.03915,"kevAdded":null},{"id":"CVE-2019-0219","published":"2020-01-14T14:18:22.000Z","updated":"2024-08-04T17:44:15.399Z","title":"A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Cordova","kev":false,"epss":0.0783,"kevAdded":null},{"id":"CVE-2020-1925","published":"2020-01-09T18:41:08.000Z","updated":"2024-08-04T06:54:00.059Z","title":"Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Olingo","kev":false,"epss":0.0283,"kevAdded":null},{"id":"CVE-2019-17558","published":"2019-12-30T16:36:08.000Z","updated":"2025-10-21T23:35:54.150Z","title":"Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Solr","kev":true,"epss":0.98567,"kevAdded":"2021-11-03"},{"id":"CVE-2019-12418","published":"2019-12-23T17:12:43.000Z","updated":"2026-10-08T21:03:24.914Z","title":"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access…","severity":"HIGH","score":7,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2019-17563","published":"2019-12-23T16:39:01.000Z","updated":"2026-10-08T21:03:21.902Z","title":"When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.10687,"kevAdded":null},{"id":"CVE-2019-17571","published":"2019-12-20T16:01:21.000Z","updated":"2026-05-28T18:30:17.910Z","title":"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Log4j","kev":false,"epss":0.6998,"kevAdded":null},{"id":"CVE-2018-1311","published":"2019-12-18T00:00:00.000Z","updated":"2025-11-04T18:14:14.531Z","title":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Xerces-C","kev":false,"epss":0.09503,"kevAdded":null},{"id":"CVE-2019-12413","published":"2019-12-16T21:53:26.000Z","updated":"2024-08-04T23:17:40.060Z","title":"In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache Incubator Superset","kev":false,"epss":0.02803,"kevAdded":null},{"id":"CVE-2019-12414","published":"2019-12-16T21:52:57.000Z","updated":"2024-08-04T23:17:40.135Z","title":"In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache Incubator Superset","kev":false,"epss":0.02787,"kevAdded":null},{"id":"CVE-2019-12420","published":"2019-12-12T22:16:05.000Z","updated":"2024-08-04T23:17:40.097Z","title":"In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache SpamAssassin","kev":false,"epss":0.07234,"kevAdded":null},{"id":"CVE-2018-11805","published":"2019-12-12T22:11:05.000Z","updated":"2024-08-05T08:17:09.279Z","title":"In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be…","severity":"MEDIUM","score":6.7,"vendor":"Apache","product":"Apache SpamAssassin","kev":false,"epss":0.00907,"kevAdded":null},{"id":"CVE-2019-17555","published":"2019-12-04T17:06:18.000Z","updated":"2024-08-05T01:40:15.978Z","title":"The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Olingo","kev":false,"epss":0.02067,"kevAdded":null},{"id":"CVE-2019-17556","published":"2019-12-04T16:59:49.000Z","updated":"2024-08-05T01:40:15.833Z","title":"Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Olingo","kev":false,"epss":0.03621,"kevAdded":null},{"id":"CVE-2019-17554","published":"2019-12-04T16:54:22.000Z","updated":"2024-08-05T01:40:15.799Z","title":"The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with…","severity":"MEDIUM","score":5.5,"vendor":"Apache","product":"Olingo","kev":false,"epss":0.12245,"kevAdded":null},{"id":"CVE-2019-10083","published":"2019-11-19T21:34:11.000Z","updated":"2024-08-04T22:10:09.444Z","title":"When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not…","severity":"MEDIUM","score":5.3,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.02751,"kevAdded":null},{"id":"CVE-2019-12421","published":"2019-11-19T21:33:12.000Z","updated":"2024-08-04T23:17:40.174Z","title":"When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.01846,"kevAdded":null},{"id":"CVE-2019-10080","published":"2019-11-19T21:32:11.000Z","updated":"2024-08-04T22:10:09.485Z","title":"The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has…","severity":"MEDIUM","score":6.5,"vendor":null,"product":"Apache NiFi","kev":false,"epss":0.02258,"kevAdded":null},{"id":"CVE-2019-12422","published":"2019-11-18T22:04:21.000Z","updated":"2024-08-04T23:17:39.997Z","title":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Shiro","kev":false,"epss":0.09101,"kevAdded":null},{"id":"CVE-2019-12409","published":"2019-11-18T20:50:59.000Z","updated":"2024-08-04T23:17:39.994Z","title":"The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Solr","kev":false,"epss":0.21614,"kevAdded":null},{"id":"CVE-2019-10070","published":"2019-11-18T20:05:31.000Z","updated":"2024-08-04T22:10:09.252Z","title":"Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Atlas","kev":false,"epss":0.01801,"kevAdded":null},{"id":"CVE-2019-12408","published":"2019-11-08T18:20:16.000Z","updated":"2024-08-04T23:17:40.239Z","title":"It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Arrow","kev":false,"epss":0.03251,"kevAdded":null},{"id":"CVE-2019-12410","published":"2019-11-08T18:04:52.000Z","updated":"2024-08-04T23:17:40.008Z","title":"While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Arrow","kev":false,"epss":0.04608,"kevAdded":null},{"id":"CVE-2019-12419","published":"2019-11-06T20:18:54.000Z","updated":"2024-08-04T23:17:40.005Z","title":"Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache CXF","kev":false,"epss":0.13836,"kevAdded":null},{"id":"CVE-2019-12406","published":"2019-11-06T20:07:27.000Z","updated":"2024-08-04T23:17:40.123Z","title":"Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial…","severity":"MEDIUM","score":6.5,"vendor":null,"product":"Apache CXF","kev":false,"epss":0.06257,"kevAdded":null},{"id":"CVE-2019-10084","published":"2019-11-05T19:30:14.000Z","updated":"2024-08-04T22:10:09.376Z","title":"In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Impala","kev":false,"epss":0.00994,"kevAdded":null},{"id":"CVE-2019-12417","published":"2019-10-30T21:04:32.000Z","updated":"2024-08-04T23:17:40.098Z","title":"A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also…","severity":"MEDIUM","score":4.8,"vendor":null,"product":"Apache Airflow","kev":false,"epss":0.01277,"kevAdded":null},{"id":"CVE-2019-0205","published":"2019-10-28T22:32:27.000Z","updated":"2024-08-04T17:44:15.368Z","title":"In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Thrift","kev":false,"epss":0.09156,"kevAdded":null},{"id":"CVE-2019-0210","published":"2019-10-28T22:22:38.000Z","updated":"2024-08-04T17:44:14.873Z","title":"In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Thrift","kev":false,"epss":0.06531,"kevAdded":null},{"id":"CVE-2019-12415","published":"2019-10-23T19:27:20.000Z","updated":"2024-08-04T23:17:40.071Z","title":"In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an…","severity":"MEDIUM","score":5.5,"vendor":null,"product":"Apache POI","kev":false,"epss":0.00998,"kevAdded":null},{"id":"CVE-2019-10079","published":"2019-10-22T15:42:35.000Z","updated":"2024-08-04T22:10:09.532Z","title":"Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Traffic Server","kev":false,"epss":0.04561,"kevAdded":null},{"id":"CVE-2018-11768","published":"2019-10-04T13:56:56.000Z","updated":"2024-08-05T08:17:09.225Z","title":"In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Hadoop","kev":false,"epss":0.06607,"kevAdded":null},{"id":"CVE-2019-0231","published":"2019-10-01T19:39:53.189Z","updated":"2025-02-13T16:27:19.692Z","title":"Apache MINA SSLFilter security Issue","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache MINA","kev":false,"epss":0.02125,"kevAdded":null},{"id":"CVE-2019-0203","published":"2019-09-26T15:59:02.000Z","updated":"2024-08-04T17:44:14.729Z","title":"In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Subversion","kev":false,"epss":0.0344,"kevAdded":null},{"id":"CVE-2018-11782","published":"2019-09-26T15:55:30.000Z","updated":"2024-08-05T08:17:09.221Z","title":"In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request…","severity":"MEDIUM","score":6.5,"vendor":null,"product":"Apache Subversion","kev":false,"epss":0.02422,"kevAdded":null},{"id":"CVE-2019-10082","published":"2019-09-26T14:40:39.000Z","updated":"2024-08-04T22:10:09.458Z","title":"In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection…","severity":"CRITICAL","score":9.1,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.16549,"kevAdded":null},{"id":"CVE-2019-10097","published":"2019-09-26T14:21:24.000Z","updated":"2024-08-04T22:10:09.873Z","title":"In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the \"PROXY\" protocol, a specially…","severity":"HIGH","score":7.2,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.52873,"kevAdded":null},{"id":"CVE-2019-10092","published":"2019-09-26T14:07:46.000Z","updated":"2024-08-04T22:10:09.500Z","title":"In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.81466,"kevAdded":null},{"id":"CVE-2019-10098","published":"2019-09-25T16:39:23.000Z","updated":"2024-08-04T22:10:09.765Z","title":"In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.73981,"kevAdded":null},{"id":"CVE-2019-12407","published":"2019-09-23T15:40:59.000Z","updated":"2024-08-04T23:17:40.131Z","title":"On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache JSPWiki","kev":false,"epss":0.02913,"kevAdded":null},{"id":"CVE-2019-10090","published":"2019-09-23T15:26:14.000Z","updated":"2024-08-04T22:10:09.441Z","title":"On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache JSPWiki","kev":false,"epss":0.02885,"kevAdded":null},{"id":"CVE-2019-12404","published":"2019-09-23T14:54:35.000Z","updated":"2024-08-04T23:17:40.002Z","title":"On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache JSPWiki","kev":false,"epss":0.02913,"kevAdded":null},{"id":"CVE-2019-10089","published":"2019-09-23T14:51:02.000Z","updated":"2024-08-04T22:10:09.549Z","title":"On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache JSPWiki","kev":false,"epss":0.02885,"kevAdded":null},{"id":"CVE-2019-10087","published":"2019-09-23T14:47:13.000Z","updated":"2024-08-04T22:10:09.414Z","title":"On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache JSPWiki","kev":false,"epss":0.02913,"kevAdded":null},{"id":"CVE-2019-10071","published":"2019-09-16T17:46:19.000Z","updated":"2024-08-04T22:10:09.295Z","title":"The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache Tapestry","kev":false,"epss":0.08752,"kevAdded":null},{"id":"CVE-2019-0207","published":"2019-09-16T16:36:14.000Z","updated":"2024-08-04T17:44:15.383Z","title":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\\`,…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Tapestry","kev":false,"epss":0.03094,"kevAdded":null},{"id":"CVE-2019-0195","published":"2019-09-16T15:37:37.000Z","updated":"2024-08-04T17:44:15.351Z","title":"Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Tapestry","kev":false,"epss":0.1402,"kevAdded":null},{"id":"CVE-2019-10074","published":"2019-09-11T20:38:56.000Z","updated":"2024-08-04T22:10:09.294Z","title":"An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"OFBiz","kev":false,"epss":0.03394,"kevAdded":null},{"id":"CVE-2019-10073","published":"2019-09-11T20:34:02.000Z","updated":"2024-08-04T22:10:09.190Z","title":"The \"Blog\", \"Forum\", \"Contact Us\" screens of the template \"ecommerce\" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"OFBiz","kev":false,"epss":0.05227,"kevAdded":null},{"id":"CVE-2019-0189","published":"2019-09-11T20:29:24.000Z","updated":"2024-08-04T17:44:14.861Z","title":"The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the \"webtools/control/httpService\" URL, and uses Java…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"OFBiz","kev":false,"epss":0.2371,"kevAdded":null},{"id":"CVE-2018-17200","published":"2019-09-11T20:22:44.000Z","updated":"2024-08-05T10:47:04.053Z","title":"The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"OFBiz","kev":false,"epss":0.05027,"kevAdded":null},{"id":"CVE-2019-12401","published":"2019-09-10T14:06:54.000Z","updated":"2024-08-04T23:17:40.122Z","title":"Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Solr","kev":false,"epss":0.08547,"kevAdded":null},{"id":"CVE-2019-12405","published":"2019-09-09T16:36:25.000Z","updated":"2024-08-04T23:17:40.016Z","title":"Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Traffic Control","kev":false,"epss":0.03455,"kevAdded":null},{"id":"CVE-2019-12402","published":"2019-08-29T00:00:00.000Z","updated":"2024-08-04T23:17:39.992Z","title":"The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.16157,"kevAdded":null},{"id":"CVE-2019-12400","published":"2019-08-23T20:30:33.000Z","updated":"2024-08-04T23:17:40.035Z","title":"In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of…","severity":"MEDIUM","score":5.5,"vendor":"Apache","product":"Apache Santuario - XML Security for Java","kev":false,"epss":0.00776,"kevAdded":null},{"id":"CVE-2019-10086","published":"2019-08-20T20:10:15.000Z","updated":"2026-10-08T21:13:54.957Z","title":"In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader…","severity":"HIGH","score":7.3,"vendor":"Apache","product":"Apache Commons Beanutils","kev":false,"epss":0.29082,"kevAdded":null},{"id":"CVE-2019-10081","published":"2019-08-15T21:02:49.000Z","updated":"2024-08-04T22:10:09.413Z","title":"HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with \"H2PushResource\", could lead to an overwrite of memory in the pushing request's…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache HTTP Server","kev":false,"epss":0.14563,"kevAdded":null},{"id":"CVE-2019-12397","published":"2019-08-08T17:06:43.000Z","updated":"2024-08-04T23:17:40.107Z","title":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.02965,"kevAdded":null},{"id":"CVE-2019-10099","published":"2019-08-07T16:18:46.000Z","updated":"2024-08-04T22:10:09.549Z","title":"Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Spark","kev":false,"epss":0.01302,"kevAdded":null},{"id":"CVE-2019-10088","published":"2019-08-02T18:53:19.000Z","updated":"2024-08-04T22:10:09.443Z","title":"A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.","severity":"HIGH","score":8.8,"vendor":"Apache","product":"Apache Tika","kev":false,"epss":0.0484,"kevAdded":null},{"id":"CVE-2019-10094","published":"2019-08-02T18:37:52.000Z","updated":"2024-08-04T22:10:09.434Z","title":"A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's…","severity":"HIGH","score":7.8,"vendor":"Apache","product":"Apache Tika","kev":false,"epss":0.02457,"kevAdded":null},{"id":"CVE-2019-10093","published":"2019-08-02T18:32:41.000Z","updated":"2024-08-04T22:10:09.762Z","title":"In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache…","severity":"MEDIUM","score":6.5,"vendor":"Apache","product":"Apache Tika","kev":false,"epss":0.03699,"kevAdded":null},{"id":"CVE-2019-0193","published":"2019-08-01T13:48:40.000Z","updated":"2025-10-21T23:45:32.477Z","title":"In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH…","severity":"HIGH","score":7.2,"vendor":"Apache","product":"Apache Solr","kev":true,"epss":0.83547,"kevAdded":"2021-12-10"},{"id":"CVE-2018-11772","published":"2019-07-29T18:32:36.000Z","updated":"2024-08-05T08:17:09.112Z","title":"Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree.…","severity":"HIGH","score":7.2,"vendor":"Apache","product":"VCL","kev":false,"epss":0.01356,"kevAdded":null},{"id":"CVE-2018-11774","published":"2019-07-29T18:17:50.000Z","updated":"2024-08-05T08:17:09.236Z","title":"Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL…","severity":"HIGH","score":7.2,"vendor":"Apache","product":"VCL","kev":false,"epss":0.01356,"kevAdded":null},{"id":"CVE-2018-11773","published":"2019-07-29T18:11:55.000Z","updated":"2024-08-05T08:17:09.198Z","title":"Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"VCL","kev":false,"epss":0.02103,"kevAdded":null},{"id":"CVE-2018-11779","published":"2019-07-25T23:23:01.000Z","updated":"2024-08-05T08:17:09.126Z","title":"In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Storm","kev":false,"epss":0.03477,"kevAdded":null},{"id":"CVE-2019-0202","published":"2019-07-25T23:17:23.000Z","updated":"2024-08-04T17:44:14.845Z","title":"The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Storm","kev":false,"epss":0.02043,"kevAdded":null},{"id":"CVE-2019-0234","published":"2019-07-15T21:13:14.000Z","updated":"2024-08-04T17:44:15.970Z","title":"A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Apache Roller","kev":false,"epss":0.03445,"kevAdded":null},{"id":"CVE-2018-17196","published":"2019-07-11T20:37:56.000Z","updated":"2024-08-05T10:39:59.702Z","title":"In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation.…","severity":"HIGH","score":8.8,"vendor":"Apache","product":"Kafka","kev":false,"epss":0.05379,"kevAdded":null},{"id":"CVE-2019-10072","published":"2019-06-21T17:56:42.000Z","updated":"2026-11-02T17:31:07.478Z","title":"The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Tomcat","kev":false,"epss":0.72988,"kevAdded":null},{"id":"CVE-2017-15694","published":"2019-06-21T15:15:14.000Z","updated":"2024-08-05T20:04:48.422Z","title":"When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal…","severity":"MEDIUM","score":6.5,"vendor":null,"product":"Apache Geode","kev":false,"epss":0.02152,"kevAdded":null},{"id":"CVE-2019-10085","published":"2019-06-18T23:07:22.000Z","updated":"2024-08-04T22:10:09.434Z","title":"In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a…","severity":"MEDIUM","score":6.1,"vendor":null,"product":"Apache Allura","kev":false,"epss":0.0514,"kevAdded":null},{"id":"CVE-2019-0197","published":"2019-06-11T21:35:52.000Z","updated":"2024-08-04T17:44:14.751Z","title":"A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an…","severity":"MEDIUM","score":4.2,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.08588,"kevAdded":null},{"id":"CVE-2019-0196","published":"2019-06-11T21:02:48.000Z","updated":"2024-08-04T17:44:14.775Z","title":"A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.19964,"kevAdded":null},{"id":"CVE-2019-0220","published":"2019-06-11T20:49:50.000Z","updated":"2024-08-04T17:44:15.395Z","title":"A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'),…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.18006,"kevAdded":null},{"id":"CVE-2018-11801","published":"2019-06-11T16:43:28.000Z","updated":"2024-08-05T08:17:09.271Z","title":"SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table.","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache Fineract","kev":false,"epss":0.05217,"kevAdded":null},{"id":"CVE-2018-11800","published":"2019-06-11T16:42:05.000Z","updated":"2024-08-05T08:17:09.177Z","title":"SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related…","severity":"CRITICAL","score":9.8,"vendor":"Apache","product":"Apache Fineract","kev":false,"epss":0.05217,"kevAdded":null},{"id":"CVE-2018-8029","published":"2019-05-30T15:15:42.000Z","updated":"2024-08-05T06:46:12.161Z","title":"In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache Hadoop","kev":false,"epss":0.03909,"kevAdded":null},{"id":"CVE-2019-0221","published":"2019-05-28T21:01:28.000Z","updated":"2026-11-02T17:29:08.489Z","title":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is,…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Apache Tomcat","kev":false,"epss":0.59194,"kevAdded":null},{"id":"CVE-2019-0188","published":"2019-05-28T18:10:08.000Z","updated":"2024-08-04T17:44:14.864Z","title":"Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Camel","kev":false,"epss":0.09782,"kevAdded":null},{"id":"CVE-2018-17198","published":"2019-05-28T17:08:11.000Z","updated":"2024-08-05T10:47:03.755Z","title":"Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Roller","kev":false,"epss":0.04124,"kevAdded":null},{"id":"CVE-2019-0201","published":"2019-05-23T13:42:47.000Z","updated":"2024-08-04T17:44:14.871Z","title":"An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.09712,"kevAdded":null},{"id":"CVE-2019-10078","published":"2019-05-20T20:50:54.000Z","updated":"2024-08-04T22:10:09.382Z","title":"A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.04937,"kevAdded":null},{"id":"CVE-2019-10077","published":"2019-05-20T20:46:15.000Z","updated":"2024-08-04T22:10:09.440Z","title":"A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.0468,"kevAdded":null},{"id":"CVE-2019-10076","published":"2019-05-20T20:31:41.000Z","updated":"2024-08-04T22:10:09.207Z","title":"A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.04725,"kevAdded":null},{"id":"CVE-2019-0226","published":"2019-05-09T13:31:47.000Z","updated":"2024-08-04T17:44:15.370Z","title":"Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The…","severity":"MEDIUM","score":4.9,"vendor":"Apache","product":"Karaf","kev":false,"epss":0.01802,"kevAdded":null},{"id":"CVE-2018-17202","published":"2019-05-06T17:14:00.000Z","updated":"2024-08-05T10:47:03.771Z","title":"Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Commons Imaging","kev":false,"epss":0.01931,"kevAdded":null},{"id":"CVE-2018-17201","published":"2019-05-06T17:07:11.000Z","updated":"2024-08-05T10:47:03.903Z","title":"Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Commons Imaging","kev":false,"epss":0.01931,"kevAdded":null},{"id":"CVE-2018-8035","published":"2019-05-01T20:16:55.000Z","updated":"2024-08-05T06:46:12.231Z","title":"This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Apache UIMA DUCC","kev":false,"epss":0.04885,"kevAdded":null},{"id":"CVE-2019-0227","published":"2019-05-01T20:03:49.000Z","updated":"2024-08-04T17:44:15.943Z","title":"A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Axis 1.4","kev":false,"epss":0.9194,"kevAdded":null},{"id":"CVE-2019-0214","published":"2019-04-30T21:48:54.000Z","updated":"2024-08-04T17:44:14.813Z","title":"In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing…","severity":"MEDIUM","score":6.5,"vendor":"Apache","product":"Apache Archiva","kev":false,"epss":0.04783,"kevAdded":null},{"id":"CVE-2019-0213","published":"2019-04-30T21:35:47.000Z","updated":"2024-08-04T17:44:14.810Z","title":"In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is…","severity":"MEDIUM","score":6.5,"vendor":"Apache","product":"Apache Archiva","kev":false,"epss":0.04843,"kevAdded":null},{"id":"CVE-2019-0194","published":"2019-04-30T21:30:42.000Z","updated":"2024-08-04T17:44:14.728Z","title":"Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier)…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache Camel","kev":false,"epss":0.08482,"kevAdded":null},{"id":"CVE-2019-0186","published":"2019-04-26T15:56:48.000Z","updated":"2024-08-04T17:44:14.644Z","title":"The input fields of the Apache Pluto \"Chat Room\" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Pluto","kev":false,"epss":0.20649,"kevAdded":null},{"id":"CVE-2019-0223","published":"2019-04-23T15:57:07.000Z","updated":"2024-08-04T17:44:15.919Z","title":"While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language…","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton","kev":false,"epss":0.06228,"kevAdded":null},{"id":"CVE-2018-1328","published":"2019-04-23T14:45:24.000Z","updated":"2024-08-05T03:59:38.883Z","title":"Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by \"Josna Joseph\".","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.06015,"kevAdded":null},{"id":"CVE-2018-1317","published":"2019-04-23T14:45:20.000Z","updated":"2024-08-05T03:59:38.240Z","title":"In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.0458,"kevAdded":null},{"id":"CVE-2017-12619","published":"2019-04-23T14:45:16.000Z","updated":"2024-08-05T18:43:56.428Z","title":"Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by \"stone lone\".","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Zeppelin","kev":false,"epss":0.04946,"kevAdded":null},{"id":"CVE-2019-0218","published":"2019-04-22T21:16:56.000Z","updated":"2024-08-04T17:44:14.890Z","title":"A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.","severity":"MEDIUM","score":6.1,"vendor":"The Apache Software Foundation","product":"Apache Pony Mail (incubating)","kev":false,"epss":0.05079,"kevAdded":null},{"id":"CVE-2019-0228","published":"2019-04-17T14:07:34.000Z","updated":"2024-08-04T17:44:15.952Z","title":"Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache PDFBox","kev":false,"epss":0.09451,"kevAdded":null},{"id":"CVE-2019-0232","published":"2019-04-15T14:23:52.000Z","updated":"2026-11-02T17:30:27.434Z","title":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is…","severity":"HIGH","score":8.1,"vendor":"Apache","product":"Tomcat","kev":false,"epss":0.99923,"kevAdded":null},{"id":"CVE-2019-0216","published":"2019-04-10T19:52:12.000Z","updated":"2024-08-04T17:44:14.865Z","title":"A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.","severity":"MEDIUM","score":4.8,"vendor":null,"product":"Apache Airflow","kev":false,"epss":0.02656,"kevAdded":null},{"id":"CVE-2019-0229","published":"2019-04-10T19:51:13.000Z","updated":"2024-08-04T17:44:15.942Z","title":"A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery…","severity":"HIGH","score":8.8,"vendor":null,"product":"Apache Airflow","kev":false,"epss":0.01563,"kevAdded":null},{"id":"CVE-2019-0199","published":"2019-04-10T14:21:50.000Z","updated":"2024-08-04T17:44:15.322Z","title":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Tomcat","kev":false,"epss":0.72855,"kevAdded":null},{"id":"CVE-2019-0211","published":"2019-04-08T21:31:09.000Z","updated":"2025-10-21T23:45:40.583Z","title":"In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including…","severity":"HIGH","score":7.8,"vendor":"Apache","product":"Apache HTTP Server","kev":true,"epss":0.65005,"kevAdded":"2021-11-03"},{"id":"CVE-2019-0217","published":"2019-04-08T20:11:20.000Z","updated":"2024-08-04T17:44:15.383Z","title":"In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache HTTP Server","kev":false,"epss":0.17434,"kevAdded":null},{"id":"CVE-2019-0215","published":"2019-04-08T19:25:45.000Z","updated":"2024-08-04T17:44:15.365Z","title":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache HTTP Server","kev":false,"epss":0.10689,"kevAdded":null},{"id":"CVE-2019-0212","published":"2019-03-28T21:24:07.000Z","updated":"2024-08-04T17:44:14.866Z","title":"In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server.…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache HBase","kev":false,"epss":0.03782,"kevAdded":null},{"id":"CVE-2019-0222","published":"2019-03-28T21:16:12.000Z","updated":"2024-08-04T17:44:15.392Z","title":"In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache ActiveMQ","kev":false,"epss":0.12033,"kevAdded":null},{"id":"CVE-2019-0225","published":"2019-03-28T21:07:57.000Z","updated":"2024-08-04T17:44:15.389Z","title":"A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by…","severity":"HIGH","score":7.5,"vendor":"Apache","product":"Apache JSPWiki","kev":false,"epss":0.09992,"kevAdded":null},{"id":"CVE-2019-0224","published":"2019-03-28T21:00:53.000Z","updated":"2024-08-04T17:44:15.405Z","title":"In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server…","severity":"MEDIUM","score":6.1,"vendor":"Apache","product":"Apache JSPWiki","kev":false,"epss":0.0515,"kevAdded":null},{"id":"CVE-2019-0204","published":"2019-03-25T21:43:04.000Z","updated":"2024-08-04T17:44:14.728Z","title":"A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in…","severity":"HIGH","score":7.8,"vendor":"Apache","product":"Apache Mesos","kev":false,"epss":0.02712,"kevAdded":null},{"id":"CVE-2019-0191","published":"2019-03-20T17:05:18.000Z","updated":"2024-08-04T17:44:14.755Z","title":"Apache Karaf kar deployer reads .kar archives and extracts the paths from the \"repository/\" and \"resources/\" entries in the zip file. It then writes out the…","severity":"MEDIUM","score":6.5,"vendor":"Apache","product":"Apache Karaf","kev":false,"epss":0.04858,"kevAdded":null},{"id":"CVE-2018-11789","published":"2019-03-18T14:15:31.000Z","updated":"2024-08-05T08:17:09.232Z","title":"When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be…","severity":"HIGH","score":7.5,"vendor":null,"product":"Apache Incubator Heron","kev":false,"epss":0.0692,"kevAdded":null},{"id":"CVE-2018-11767","published":"2019-03-18T13:41:17.000Z","updated":"2024-08-05T08:17:08.999Z","title":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default…","severity":"HIGH","score":7.4,"vendor":null,"product":"Apache Hadoop","kev":false,"epss":0.03726,"kevAdded":null},{"id":"CVE-2017-3164","published":"2019-03-08T21:00:00.000Z","updated":"2024-09-16T19:52:10.132Z","title":"Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the \"shards\" parameter does not have a corresponding whitelist mechanism,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.19442,"kevAdded":null},{"id":"CVE-2019-0192","published":"2019-03-07T21:00:00.000Z","updated":"2024-09-16T16:53:42.278Z","title":"In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.78227,"kevAdded":null},{"id":"CVE-2018-11783","published":"2019-03-07T18:00:00.000Z","updated":"2024-09-16T22:15:51.127Z","title":"sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01869,"kevAdded":null},{"id":"CVE-2019-0200","published":"2019-03-06T18:00:00.000Z","updated":"2024-09-16T20:58:31.100Z","title":"A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.03815,"kevAdded":null},{"id":"CVE-2019-0187","published":"2019-03-06T17:00:00.000Z","updated":"2024-09-16T17:53:55.501Z","title":"Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache JMeter","kev":false,"epss":0.02636,"kevAdded":null},{"id":"CVE-2018-11793","published":"2019-03-05T21:00:00.000Z","updated":"2024-09-16T16:27:53.700Z","title":"When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Mesos","kev":false,"epss":0.0497,"kevAdded":null},{"id":"CVE-2018-20244","published":"2019-02-27T18:00:00.000Z","updated":"2024-09-16T22:24:36.287Z","title":"In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01956,"kevAdded":null},{"id":"CVE-2018-20242","published":"2019-02-11T21:00:00.000Z","updated":"2024-09-17T01:47:05.525Z","title":"A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache JSPWiki","kev":false,"epss":0.05364,"kevAdded":null},{"id":"CVE-2018-1340","published":"2019-02-07T22:00:00.000Z","updated":"2024-09-16T19:20:49.021Z","title":"Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the \"secure\" flag, which could allow an…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.02043,"kevAdded":null},{"id":"CVE-2018-1296","published":"2019-02-07T22:00:00.000Z","updated":"2024-09-16T19:47:24.798Z","title":"In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.03326,"kevAdded":null},{"id":"CVE-2018-11803","published":"2019-02-05T17:00:00.000Z","updated":"2024-09-17T01:56:52.279Z","title":"Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.58452,"kevAdded":null},{"id":"CVE-2018-11760","published":"2019-02-04T17:00:00.000Z","updated":"2024-09-16T19:19:24.731Z","title":"When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.00605,"kevAdded":null},{"id":"CVE-2018-11790","published":"2019-01-31T16:00:00.000Z","updated":"2024-09-16T19:30:22.439Z","title":"When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01025,"kevAdded":null},{"id":"CVE-2019-0190","published":"2019-01-30T22:00:00.000Z","updated":"2024-09-16T23:41:59.848Z","title":"A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.59055,"kevAdded":null},{"id":"CVE-2018-17199","published":"2019-01-30T22:00:00.000Z","updated":"2024-09-16T19:35:15.397Z","title":"In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.20156,"kevAdded":null},{"id":"CVE-2018-17189","published":"2019-01-30T22:00:00.000Z","updated":"2024-09-17T01:21:57.609Z","title":"In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.20071,"kevAdded":null},{"id":"CVE-2018-20245","published":"2019-01-23T17:00:00.000Z","updated":"2024-09-16T19:40:46.503Z","title":"The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.01016,"kevAdded":null},{"id":"CVE-2017-17836","published":"2019-01-23T17:00:00.000Z","updated":"2024-09-17T02:27:27.150Z","title":"In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.03193,"kevAdded":null},{"id":"CVE-2017-17835","published":"2019-01-23T17:00:00.000Z","updated":"2024-09-16T17:08:32.151Z","title":"In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02042,"kevAdded":null},{"id":"CVE-2017-15720","published":"2019-01-23T17:00:00.000Z","updated":"2024-09-16T22:45:21.283Z","title":"In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.02532,"kevAdded":null},{"id":"CVE-2018-11798","published":"2019-01-07T18:00:00.000Z","updated":"2024-08-05T08:17:09.238Z","title":"The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.04709,"kevAdded":null},{"id":"CVE-2018-1320","published":"2019-01-07T18:00:00.000Z","updated":"2024-08-05T03:59:37.833Z","title":"Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.08188,"kevAdded":null},{"id":"CVE-2018-11788","published":"2019-01-07T16:00:00.000Z","updated":"2024-08-05T08:17:09.240Z","title":"Apache Karaf provides a features deployer, which allows users to \"hot deploy\" a features XML by dropping the file directly in the deploy folder. The features…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.07349,"kevAdded":null},{"id":"CVE-2018-17188","published":"2019-01-02T14:00:00.000Z","updated":"2024-08-05T10:39:59.575Z","title":"Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where…","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.03613,"kevAdded":null},{"id":"CVE-2018-17191","published":"2018-12-31T14:00:00.000Z","updated":"2024-08-05T10:39:59.576Z","title":"Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NetBeans","kev":false,"epss":0.07755,"kevAdded":null},{"id":"CVE-2018-17197","published":"2018-12-24T14:00:00.000Z","updated":"2024-08-05T10:39:59.588Z","title":"A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.06146,"kevAdded":null},{"id":"CVE-2018-11799","published":"2018-12-19T20:00:00.000Z","updated":"2024-08-05T08:17:09.230Z","title":"Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Oozie","kev":false,"epss":0.01484,"kevAdded":null},{"id":"CVE-2018-17195","published":"2018-12-19T14:00:00.000Z","updated":"2024-08-05T10:39:59.593Z","title":"The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00713,"kevAdded":null},{"id":"CVE-2018-17194","published":"2018-12-19T14:00:00.000Z","updated":"2024-08-05T10:39:59.603Z","title":"When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0297,"kevAdded":null},{"id":"CVE-2018-17193","published":"2018-12-19T14:00:00.000Z","updated":"2024-08-05T10:39:59.641Z","title":"The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack.…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.02758,"kevAdded":null},{"id":"CVE-2018-17192","published":"2018-12-19T14:00:00.000Z","updated":"2024-08-05T10:39:59.558Z","title":"The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0268,"kevAdded":null},{"id":"CVE-2018-8033","published":"2018-12-13T14:00:00.000Z","updated":"2024-08-05T06:46:11.540Z","title":"In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.25743,"kevAdded":null},{"id":"CVE-2018-11766","published":"2018-11-27T14:00:00.000Z","updated":"2024-08-05T08:17:09.256Z","title":"In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.03244,"kevAdded":null},{"id":"CVE-2018-17190","published":"2018-11-19T14:00:00.000Z","updated":"2024-08-05T10:39:59.689Z","title":"In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.08792,"kevAdded":null},{"id":"CVE-2018-8009","published":"2018-11-13T21:00:00.000Z","updated":"2024-08-05T06:46:11.567Z","title":"Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.06734,"kevAdded":null},{"id":"CVE-2018-17187","published":"2018-11-13T15:00:00.000Z","updated":"2024-08-05T10:39:59.671Z","title":"The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification…","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Qpid Proton-J","kev":false,"epss":0.02539,"kevAdded":null},{"id":"CVE-2018-11777","published":"2018-11-08T14:00:00.000Z","updated":"2024-08-05T08:17:09.136Z","title":"In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.02303,"kevAdded":null},{"id":"CVE-2018-1314","published":"2018-11-08T14:00:00.000Z","updated":"2024-08-05T03:59:39.039Z","title":"In Apache Hive 2.3.3, 3.1.0 and earlier, Hive \"EXPLAIN\" operation does not check for necessary authorization of involved entities in a query. An unauthorized…","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01988,"kevAdded":null},{"id":"CVE-2018-8021","published":"2018-11-07T14:00:00.000Z","updated":"2024-08-05T06:46:11.477Z","title":"Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note…","severity":"CRITICAL","score":9.8,"vendor":"unspecified","product":"Superset","kev":false,"epss":0.5341,"kevAdded":null},{"id":"CVE-2018-17186","published":"2018-11-06T21:00:00.000Z","updated":"2024-09-17T00:31:30.652Z","title":"An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and…","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.02477,"kevAdded":null},{"id":"CVE-2018-17184","published":"2018-11-06T19:00:00.000Z","updated":"2024-09-17T02:52:18.945Z","title":"A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names,…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.01204,"kevAdded":null},{"id":"CVE-2018-11759","published":"2018-10-31T20:00:00.000Z","updated":"2024-08-05T08:17:08.977Z","title":"The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat Connectors","kev":false,"epss":0.90647,"kevAdded":null},{"id":"CVE-2018-11792","published":"2018-10-24T20:00:00.000Z","updated":"2024-09-16T19:52:28.202Z","title":"In Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may pose a potential security risk, such as having ALTER on a…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.02456,"kevAdded":null},{"id":"CVE-2018-11785","published":"2018-10-24T20:00:00.000Z","updated":"2024-09-16T20:06:46.672Z","title":"Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into a running query,…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2018-11804","published":"2018-10-24T00:00:00.000Z","updated":"2024-08-05T08:17:09.224Z","title":"Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.05696,"kevAdded":null},{"id":"CVE-2018-8006","published":"2018-10-10T14:00:00.000Z","updated":"2024-09-16T18:24:11.216Z","title":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.55695,"kevAdded":null},{"id":"CVE-2018-11796","published":"2018-10-09T22:00:00.000Z","updated":"2024-09-16T18:19:51.122Z","title":"In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.07537,"kevAdded":null},{"id":"CVE-2018-11797","published":"2018-10-05T20:00:00.000Z","updated":"2024-09-16T16:33:51.092Z","title":"In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache PDFBox","kev":false,"epss":0.03505,"kevAdded":null},{"id":"CVE-2018-11778","published":"2018-10-05T19:00:00.000Z","updated":"2024-09-17T03:18:51.761Z","title":"UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.04011,"kevAdded":null},{"id":"CVE-2017-5658","published":"2018-10-04T14:00:00.000Z","updated":"2024-09-16T20:42:58.859Z","title":"The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Pony Mail","kev":false,"epss":0.01822,"kevAdded":null},{"id":"CVE-2018-11784","published":"2018-10-04T13:00:00.000Z","updated":"2026-10-15T17:21:32.749Z","title":"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.…","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.9768,"kevAdded":null},{"id":"CVE-2018-11763","published":"2018-09-25T21:00:00.000Z","updated":"2024-09-17T02:21:55.083Z","title":"In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.50847,"kevAdded":null},{"id":"CVE-2018-8023","published":"2018-09-21T13:00:00.000Z","updated":"2024-09-16T16:58:25.082Z","title":"Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0,…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Mesos","kev":false,"epss":0.03056,"kevAdded":null},{"id":"CVE-2018-11762","published":"2018-09-19T14:00:00.000Z","updated":"2024-09-16T20:26:36.852Z","title":"In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.05449,"kevAdded":null},{"id":"CVE-2018-11761","published":"2018-09-19T14:00:00.000Z","updated":"2024-09-16T18:39:59.951Z","title":"In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.0938,"kevAdded":null},{"id":"CVE-2018-8017","published":"2018-09-19T14:00:00.000Z","updated":"2024-09-17T02:27:20.580Z","title":"In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02284,"kevAdded":null},{"id":"CVE-2018-11787","published":"2018-09-18T14:00:00.000Z","updated":"2024-09-17T02:16:58.807Z","title":"In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.02573,"kevAdded":null},{"id":"CVE-2018-11786","published":"2018-09-18T14:00:00.000Z","updated":"2024-09-17T02:12:17.084Z","title":"In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.01904,"kevAdded":null},{"id":"CVE-2018-11781","published":"2018-09-17T14:00:00.000Z","updated":"2024-09-16T18:48:23.905Z","title":"Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache SpamAssassin","kev":false,"epss":0.00984,"kevAdded":null},{"id":"CVE-2018-11780","published":"2018-09-17T14:00:00.000Z","updated":"2024-09-16T20:57:28.432Z","title":"A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache SpamAssassin","kev":false,"epss":0.1082,"kevAdded":null},{"id":"CVE-2018-8041","published":"2018-09-17T14:00:00.000Z","updated":"2024-09-17T04:29:13.153Z","title":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.09586,"kevAdded":null},{"id":"CVE-2017-15705","published":"2018-09-17T14:00:00.000Z","updated":"2024-09-16T23:15:46.185Z","title":"A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache SpamAssassin","kev":false,"epss":0.07879,"kevAdded":null},{"id":"CVE-2018-1330","published":"2018-09-13T19:00:00.000Z","updated":"2024-09-16T20:42:57.117Z","title":"When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Mesos","kev":false,"epss":0.03745,"kevAdded":null},{"id":"CVE-2018-11775","published":"2018-09-10T20:00:00.000Z","updated":"2024-09-16T16:23:47.592Z","title":"TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a…","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.06959,"kevAdded":null},{"id":"CVE-2018-8040","published":"2018-08-29T13:00:00.000Z","updated":"2024-09-17T02:21:14.011Z","title":"Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.07166,"kevAdded":null},{"id":"CVE-2018-8022","published":"2018-08-29T13:00:00.000Z","updated":"2024-09-16T21:57:30.534Z","title":"A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.07402,"kevAdded":null},{"id":"CVE-2018-8005","published":"2018-08-29T13:00:00.000Z","updated":"2024-09-16T19:10:15.976Z","title":"When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.06808,"kevAdded":null},{"id":"CVE-2018-8004","published":"2018-08-29T13:00:00.000Z","updated":"2024-09-16T18:29:48.650Z","title":"There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.06228,"kevAdded":null},{"id":"CVE-2018-1318","published":"2018-08-29T13:00:00.000Z","updated":"2024-09-16T22:50:52.944Z","title":"Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS)…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.07627,"kevAdded":null},{"id":"CVE-2018-8028","published":"2018-08-23T15:00:00.000Z","updated":"2024-08-05T06:46:12.327Z","title":"An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Sentry","kev":false,"epss":0.0131,"kevAdded":null},{"id":"CVE-2018-11758","published":"2018-08-22T21:00:00.000Z","updated":"2024-09-16T20:07:21.956Z","title":"This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Cayenne","kev":false,"epss":0.02936,"kevAdded":null},{"id":"CVE-2018-11776","published":"2018-08-22T13:00:00.000Z","updated":"2025-10-21T23:45:48.386Z","title":"Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":true,"epss":0.99996,"kevAdded":"2021-11-03"},{"id":"CVE-2018-11771","published":"2018-08-16T15:00:00.000Z","updated":"2024-09-16T22:03:17.708Z","title":"When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.05253,"kevAdded":null},{"id":"CVE-2016-4975","published":"2018-08-14T13:00:00.000Z","updated":"2024-09-16T19:47:03.346Z","title":"mod_userdir CRLF injection","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.19798,"kevAdded":null},{"id":"CVE-2018-11770","published":"2018-08-13T00:00:00.000Z","updated":"2024-08-05T08:17:09.223Z","title":"From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by…","severity":"MEDIUM","score":4.2,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.66067,"kevAdded":null},{"id":"CVE-2018-11769","published":"2018-08-08T15:00:00.000Z","updated":"2024-09-16T17:59:21.214Z","title":"CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration…","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.08426,"kevAdded":null},{"id":"CVE-2017-12614","published":"2018-08-06T13:00:00.000Z","updated":"2024-09-16T21:57:17.157Z","title":"It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Airflow","kev":false,"epss":0.0202,"kevAdded":null},{"id":"CVE-2018-8037","published":"2018-08-02T14:00:00.000Z","updated":"2024-09-16T17:07:40.261Z","title":"If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.11156,"kevAdded":null},{"id":"CVE-2018-1336","published":"2018-08-02T14:00:00.000Z","updated":"2024-11-14T20:35:47.322Z","title":"An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service.…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.20354,"kevAdded":null},{"id":"CVE-2018-8032","published":"2018-08-02T13:00:00.000Z","updated":"2024-09-16T16:29:01.816Z","title":"Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Axis","kev":false,"epss":0.10554,"kevAdded":null},{"id":"CVE-2018-8034","published":"2018-08-01T18:00:00.000Z","updated":"2024-10-21T16:09:49.791Z","title":"The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.21048,"kevAdded":null},{"id":"CVE-2018-8027","published":"2018-07-31T13:00:00.000Z","updated":"2024-09-16T19:25:52.726Z","title":"Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.05448,"kevAdded":null},{"id":"CVE-2018-8020","published":"2018-07-31T13:00:00.000Z","updated":"2024-09-17T01:20:59.717Z","title":"Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple…","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.0418,"kevAdded":null},{"id":"CVE-2018-8019","published":"2018-07-31T13:00:00.000Z","updated":"2024-09-16T17:23:05.725Z","title":"When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked…","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.0405,"kevAdded":null},{"id":"CVE-2018-1288","published":"2018-07-26T14:00:00.000Z","updated":"2024-09-17T02:52:05.951Z","title":"In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.04801,"kevAdded":null},{"id":"CVE-2017-12610","published":"2018-07-26T14:00:00.000Z","updated":"2024-09-17T01:10:36.261Z","title":"In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with…","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Kafka","kev":false,"epss":0.02872,"kevAdded":null},{"id":"CVE-2018-8031","published":"2018-07-23T22:00:00.000Z","updated":"2024-09-16T17:58:50.281Z","title":"The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache TomEE","kev":false,"epss":0.02003,"kevAdded":null},{"id":"CVE-2018-11757","published":"2018-07-23T17:00:00.000Z","updated":"2024-09-16T22:20:06.215Z","title":"In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Docker Skeleton Runtime for Apache OpenWhisk","kev":false,"epss":0.07456,"kevAdded":null},{"id":"CVE-2018-11756","published":"2018-07-23T17:00:00.000Z","updated":"2024-09-16T17:03:31.828Z","title":"In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (or…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"PHP Runtime for Apache OpenWhisk","kev":false,"epss":0.08096,"kevAdded":null},{"id":"CVE-2018-8018","published":"2018-07-19T18:00:00.000Z","updated":"2024-09-17T04:24:27.033Z","title":"In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization,…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ignite","kev":false,"epss":0.06705,"kevAdded":null},{"id":"CVE-2018-8042","published":"2018-07-18T15:00:00.000Z","updated":"2024-09-17T01:26:55.110Z","title":"Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01754,"kevAdded":null},{"id":"CVE-2018-8011","published":"2018-07-18T14:00:00.000Z","updated":"2024-09-16T22:30:24.315Z","title":"mod_md, DoS via Coredumps on specially crafted requests","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.55608,"kevAdded":null},{"id":"CVE-2018-8024","published":"2018-07-12T13:00:00.000Z","updated":"2024-09-17T02:10:38.073Z","title":"In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.05294,"kevAdded":null},{"id":"CVE-2018-1334","published":"2018-07-12T13:00:00.000Z","updated":"2024-09-17T03:22:59.383Z","title":"In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark…","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Spark","kev":false,"epss":0.00509,"kevAdded":null},{"id":"CVE-2018-8007","published":"2018-07-11T13:00:00.000Z","updated":"2024-09-16T17:04:00.488Z","title":"Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration…","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.12164,"kevAdded":null},{"id":"CVE-2018-1331","published":"2018-07-10T17:00:00.000Z","updated":"2024-09-16T17:48:08.492Z","title":"In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.04424,"kevAdded":null},{"id":"CVE-2018-1337","published":"2018-07-10T13:00:00.000Z","updated":"2024-09-17T01:12:12.053Z","title":"In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Directory","kev":false,"epss":0.05152,"kevAdded":null},{"id":"CVE-2018-8026","published":"2018-07-05T14:00:00.000Z","updated":"2024-09-16T22:14:47.305Z","title":"This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml,…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.09025,"kevAdded":null},{"id":"CVE-2018-8038","published":"2018-07-05T13:00:00.000Z","updated":"2024-09-16T22:15:38.445Z","title":"Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF Fediz","kev":false,"epss":0.10597,"kevAdded":null},{"id":"CVE-2018-8036","published":"2018-07-03T20:00:00.000Z","updated":"2024-09-16T18:28:45.288Z","title":"In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache PDFBox","kev":false,"epss":0.03992,"kevAdded":null},{"id":"CVE-2018-8039","published":"2018-07-02T13:00:00.000Z","updated":"2024-09-17T04:04:46.184Z","title":"It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty(\"java.protocol.handler.pkgs\",…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.08507,"kevAdded":null},{"id":"CVE-2018-8016","published":"2018-06-28T16:00:00.000Z","updated":"2024-09-16T18:34:08.513Z","title":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Cassandra","kev":false,"epss":0.0227,"kevAdded":null},{"id":"CVE-2018-1306","published":"2018-06-27T18:00:00.000Z","updated":"2024-09-16T18:49:31.524Z","title":"The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Pluto","kev":false,"epss":0.42281,"kevAdded":null},{"id":"CVE-2018-8025","published":"2018-06-27T15:00:00.000Z","updated":"2024-09-16T16:12:44.735Z","title":"CVE-2018-8025 describes an issue in Apache HBase that affects the optional \"Thrift 1\" API server when running over HTTP. There is a race-condition which could…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache HBase","kev":false,"epss":0.01674,"kevAdded":null},{"id":"CVE-2018-8030","published":"2018-06-19T13:00:00.000Z","updated":"2024-09-16T19:41:52.432Z","title":"A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.03787,"kevAdded":null},{"id":"CVE-2018-1333","published":"2018-06-18T18:00:00.000Z","updated":"2024-09-17T04:09:37.340Z","title":"DoS for HTTP/2 connections by crafted requests","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.1652,"kevAdded":null},{"id":"CVE-2017-15695","published":"2018-06-13T17:00:00.000Z","updated":"2024-09-17T03:18:05.465Z","title":"When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02513,"kevAdded":null},{"id":"CVE-2018-1281","published":"2018-06-08T19:00:00.000Z","updated":"2024-09-17T00:26:46.445Z","title":"The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache MXNet","kev":false,"epss":0.01917,"kevAdded":null},{"id":"CVE-2018-8008","published":"2018-06-05T19:00:00.000Z","updated":"2024-09-16T16:38:31.346Z","title":"Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.02247,"kevAdded":null},{"id":"CVE-2018-1332","published":"2018-06-05T19:00:00.000Z","updated":"2024-09-16T16:23:01.430Z","title":"Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.01413,"kevAdded":null},{"id":"CVE-2018-8013","published":"2018-05-24T16:00:00.000Z","updated":"2024-09-16T23:16:36.073Z","title":"In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Batik","kev":false,"epss":0.18591,"kevAdded":null},{"id":"CVE-2018-1310","published":"2018-05-23T14:00:00.000Z","updated":"2024-09-16T23:15:51.628Z","title":"Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03116,"kevAdded":null},{"id":"CVE-2018-1309","published":"2018-05-23T14:00:00.000Z","updated":"2024-09-16T16:13:12.482Z","title":"Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.04436,"kevAdded":null},{"id":"CVE-2018-8012","published":"2018-05-21T19:00:00.000Z","updated":"2024-09-17T00:01:04.102Z","title":"No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.08415,"kevAdded":null},{"id":"CVE-2018-8010","published":"2018-05-21T19:00:00.000Z","updated":"2024-09-17T00:31:26.316Z","title":"This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml,…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.03707,"kevAdded":null},{"id":"CVE-2018-8015","published":"2018-05-18T17:00:00.000Z","updated":"2024-09-16T18:44:19.917Z","title":"In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ORC","kev":false,"epss":0.03233,"kevAdded":null},{"id":"CVE-2018-8014","published":"2018-05-16T16:00:00.000Z","updated":"2026-10-15T17:44:12.176Z","title":"The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.20942,"kevAdded":null},{"id":"CVE-2018-1313","published":"2018-05-07T13:00:00.000Z","updated":"2024-09-16T16:23:24.352Z","title":"In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Derby","kev":false,"epss":0.04587,"kevAdded":null},{"id":"CVE-2018-8003","published":"2018-05-03T23:00:00.000Z","updated":"2024-09-16T17:48:48.618Z","title":"Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP request which provides…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.04165,"kevAdded":null},{"id":"CVE-2017-15691","published":"2018-04-26T17:00:00.000Z","updated":"2024-09-16T23:42:23.280Z","title":"In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache UIMA","kev":false,"epss":0.08855,"kevAdded":null},{"id":"CVE-2018-1339","published":"2018-04-25T21:00:00.000Z","updated":"2024-09-16T17:14:39.308Z","title":"A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.02559,"kevAdded":null},{"id":"CVE-2018-1338","published":"2018-04-25T21:00:00.000Z","updated":"2024-09-17T00:07:04.416Z","title":"A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.01916,"kevAdded":null},{"id":"CVE-2018-1335","published":"2018-04-25T21:00:00.000Z","updated":"2024-09-17T03:58:34.667Z","title":"From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tika","kev":false,"epss":0.93555,"kevAdded":null},{"id":"CVE-2018-1292","published":"2018-04-20T18:00:00.000Z","updated":"2024-09-16T19:56:06.458Z","title":"Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.02045,"kevAdded":null},{"id":"CVE-2018-1291","published":"2018-04-20T18:00:00.000Z","updated":"2024-09-16T19:20:16.288Z","title":"Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.02003,"kevAdded":null},{"id":"CVE-2018-1290","published":"2018-04-20T18:00:00.000Z","updated":"2024-09-16T22:03:02.684Z","title":"In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.03234,"kevAdded":null},{"id":"CVE-2018-1289","published":"2018-04-20T18:00:00.000Z","updated":"2024-09-17T04:08:48.966Z","title":"In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.02529,"kevAdded":null},{"id":"CVE-2018-1325","published":"2018-04-18T19:00:00.000Z","updated":"2024-09-16T20:52:40.880Z","title":"In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"wicket-jquery-ui","kev":false,"epss":0.00811,"kevAdded":null},{"id":"CVE-2018-1308","published":"2018-04-09T13:00:00.000Z","updated":"2024-09-17T02:47:11.497Z","title":"This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.20823,"kevAdded":null},{"id":"CVE-2018-1315","published":"2018-04-05T13:00:00.000Z","updated":"2024-09-17T00:05:55.849Z","title":"In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to…","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01746,"kevAdded":null},{"id":"CVE-2018-1284","published":"2018-04-05T13:00:00.000Z","updated":"2024-09-16T18:38:28.397Z","title":"In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_…","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.0215,"kevAdded":null},{"id":"CVE-2018-1282","published":"2018-04-05T13:00:00.000Z","updated":"2024-09-16T23:51:40.485Z","title":"This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC…","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.05483,"kevAdded":null},{"id":"CVE-2018-1295","published":"2018-04-02T17:00:00.000Z","updated":"2024-09-17T01:06:48.932Z","title":"In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ignite","kev":false,"epss":0.06349,"kevAdded":null},{"id":"CVE-2018-1327","published":"2018-03-27T21:00:00.000Z","updated":"2024-09-16T23:11:07.229Z","title":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.08647,"kevAdded":null},{"id":"CVE-2018-1312","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-16T19:14:07.045Z","title":"In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.15717,"kevAdded":null},{"id":"CVE-2018-1303","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-17T02:10:32.813Z","title":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.69802,"kevAdded":null},{"id":"CVE-2018-1302","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-17T02:41:36.706Z","title":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.1288,"kevAdded":null},{"id":"CVE-2018-1301","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-16T17:22:56.161Z","title":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.14428,"kevAdded":null},{"id":"CVE-2018-1283","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-16T19:36:29.564Z","title":"In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.09737,"kevAdded":null},{"id":"CVE-2017-15715","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-17T02:21:04.135Z","title":"In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.85452,"kevAdded":null},{"id":"CVE-2017-15710","published":"2018-03-26T15:00:00.000Z","updated":"2024-09-17T03:37:24.707Z","title":"In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.17084,"kevAdded":null},{"id":"CVE-2018-1322","published":"2018-03-20T17:00:00.000Z","updated":"2024-09-16T17:03:34.787Z","title":"An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be…","severity":"MEDIUM","score":4.9,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.19916,"kevAdded":null},{"id":"CVE-2018-1321","published":"2018-03-20T17:00:00.000Z","updated":"2024-09-16T18:03:42.299Z","title":"An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x…","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache Syncope","kev":false,"epss":0.17522,"kevAdded":null},{"id":"CVE-2018-1294","published":"2018-03-20T17:00:00.000Z","updated":"2024-09-16T22:31:23.620Z","title":"If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called \"Bounce Address\", and that input contains…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Email","kev":false,"epss":0.02765,"kevAdded":null},{"id":"CVE-2018-1324","published":"2018-03-16T13:00:00.000Z","updated":"2024-09-17T03:59:32.872Z","title":"A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Commons Compress","kev":false,"epss":0.03656,"kevAdded":null},{"id":"CVE-2018-1319","published":"2018-03-15T20:00:00.000Z","updated":"2024-09-17T01:41:55.447Z","title":"In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.02163,"kevAdded":null},{"id":"CVE-2018-1323","published":"2018-03-12T16:00:00.000Z","updated":"2024-09-17T02:16:54.351Z","title":"The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat Connectors","kev":false,"epss":0.46397,"kevAdded":null},{"id":"CVE-2017-15719","published":"2018-03-12T13:00:00.000Z","updated":"2024-09-17T02:11:55.065Z","title":"In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Wicket jQuery UI","kev":false,"epss":0.00874,"kevAdded":null},{"id":"CVE-2018-1316","published":"2018-03-05T14:00:00.000Z","updated":"2024-09-17T03:07:11.345Z","title":"The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ODE","kev":false,"epss":0.03138,"kevAdded":null},{"id":"CVE-2017-12627","published":"2018-03-01T14:00:00.000Z","updated":"2024-09-17T01:15:50.981Z","title":"In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Xerces C++","kev":false,"epss":0.0829,"kevAdded":null},{"id":"CVE-2018-1304","published":"2018-02-28T20:00:00.000Z","updated":"2026-10-15T17:31:46.613Z","title":"The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27,…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.1707,"kevAdded":null},{"id":"CVE-2018-1286","published":"2018-02-28T18:00:00.000Z","updated":"2024-09-16T18:07:50.245Z","title":"In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01085,"kevAdded":null},{"id":"CVE-2017-7671","published":"2018-02-27T20:00:00.000Z","updated":"2024-09-16T22:09:57.141Z","title":"There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02188,"kevAdded":null},{"id":"CVE-2017-5660","published":"2018-02-27T20:00:00.000Z","updated":"2024-09-17T00:37:13.932Z","title":"There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when…","severity":"HIGH","score":8.6,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.01933,"kevAdded":null},{"id":"CVE-2012-3536","published":"2018-02-27T19:00:00.000Z","updated":"2024-09-16T18:09:20.814Z","title":"Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Hupa","kev":false,"epss":0.01917,"kevAdded":null},{"id":"CVE-2017-15693","published":"2018-02-27T15:00:00.000Z","updated":"2024-09-16T23:26:07.455Z","title":"In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02469,"kevAdded":null},{"id":"CVE-2017-15692","published":"2018-02-27T15:00:00.000Z","updated":"2024-09-17T04:03:51.590Z","title":"In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.04781,"kevAdded":null},{"id":"CVE-2017-15696","published":"2018-02-26T02:00:00.000Z","updated":"2024-09-16T20:31:34.354Z","title":"When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests.…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02005,"kevAdded":null},{"id":"CVE-2018-1305","published":"2018-02-23T23:00:00.000Z","updated":"2026-10-15T17:32:20.933Z","title":"Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.14472,"kevAdded":null},{"id":"CVE-2016-8750","published":"2018-02-19T15:00:00.000Z","updated":"2024-09-17T00:36:15.735Z","title":"Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Karaf","kev":false,"epss":0.05179,"kevAdded":null},{"id":"CVE-2017-15712","published":"2018-02-19T14:00:00.000Z","updated":"2024-09-17T01:46:21.738Z","title":"Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Oozie","kev":false,"epss":0.02496,"kevAdded":null},{"id":"CVE-2018-1287","published":"2018-02-14T14:00:00.000Z","updated":"2024-09-17T03:02:25.926Z","title":"In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache JMeter","kev":false,"epss":0.03352,"kevAdded":null},{"id":"CVE-2017-15699","published":"2018-02-13T22:00:00.000Z","updated":"2024-09-17T00:40:56.845Z","title":"A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Dispatch Router","kev":false,"epss":0.03219,"kevAdded":null},{"id":"CVE-2017-15709","published":"2018-02-13T20:00:00.000Z","updated":"2024-09-16T22:14:34.363Z","title":"When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed…","severity":"LOW","score":3.7,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.22776,"kevAdded":null},{"id":"CVE-2018-1297","published":"2018-02-13T12:00:00.000Z","updated":"2024-09-17T03:37:56.459Z","title":"When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache JMeter","kev":false,"epss":0.11502,"kevAdded":null},{"id":"CVE-2016-8742","published":"2018-02-12T17:00:00.000Z","updated":"2024-09-17T00:26:42.742Z","title":"The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.01961,"kevAdded":null},{"id":"CVE-2016-5397","published":"2018-02-12T17:00:00.000Z","updated":"2024-09-16T20:47:38.486Z","title":"The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Thrift","kev":false,"epss":0.06873,"kevAdded":null},{"id":"CVE-2018-1307","published":"2018-02-09T19:00:00.000Z","updated":"2024-09-16T19:24:28.480Z","title":"In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache jUDDI","kev":false,"epss":0.01671,"kevAdded":null},{"id":"CVE-2018-1298","published":"2018-02-09T14:00:00.000Z","updated":"2024-09-16T20:59:06.782Z","title":"A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.02329,"kevAdded":null},{"id":"CVE-2018-1299","published":"2018-02-06T19:00:00.000Z","updated":"2024-09-16T21:07:54.673Z","title":"In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Allura","kev":false,"epss":0.03001,"kevAdded":null},{"id":"CVE-2016-6813","published":"2018-02-06T14:00:00.000Z","updated":"2024-09-17T00:26:36.412Z","title":"Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.05592,"kevAdded":null},{"id":"CVE-2013-4317","published":"2018-02-06T14:00:00.000Z","updated":"2024-09-17T01:36:03.050Z","title":"In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see…","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache CloudStack","kev":false,"epss":0.01173,"kevAdded":null},{"id":"CVE-2017-3160","published":"2018-02-01T21:00:00.000Z","updated":"2024-09-16T19:56:14.676Z","title":"After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the…","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Cordova Android","kev":false,"epss":0.03753,"kevAdded":null},{"id":"CVE-2017-15706","published":"2018-01-31T14:00:00.000Z","updated":"2024-09-16T20:16:59.533Z","title":"As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.06083,"kevAdded":null},{"id":"CVE-2017-15698","published":"2018-01-31T14:00:00.000Z","updated":"2024-09-16T16:12:41.804Z","title":"When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","kev":false,"epss":0.03527,"kevAdded":null},{"id":"CVE-2017-12626","published":"2018-01-29T17:00:00.000Z","updated":"2026-05-28T17:54:38.163Z","title":"Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache POI","kev":false,"epss":0.10142,"kevAdded":null},{"id":"CVE-2017-15703","published":"2018-01-25T21:00:00.000Z","updated":"2024-09-16T22:20:47.668Z","title":"Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of…","severity":"MEDIUM","score":5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.00862,"kevAdded":null},{"id":"CVE-2017-15718","published":"2018-01-24T14:00:00.000Z","updated":"2024-09-17T03:02:11.843Z","title":"The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.03567,"kevAdded":null},{"id":"CVE-2017-15697","published":"2018-01-23T22:00:00.000Z","updated":"2024-09-17T03:48:44.883Z","title":"A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.04832,"kevAdded":null},{"id":"CVE-2017-12632","published":"2018-01-23T22:00:00.000Z","updated":"2024-09-16T20:01:20.753Z","title":"A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.02848,"kevAdded":null},{"id":"CVE-2017-15713","published":"2018-01-19T17:00:00.000Z","updated":"2024-09-17T04:08:48.075Z","title":"Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.0221,"kevAdded":null},{"id":"CVE-2017-3158","published":"2018-01-18T20:00:00.000Z","updated":"2024-09-16T16:37:33.486Z","title":"A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Guacamole","kev":false,"epss":0.01221,"kevAdded":null},{"id":"CVE-2016-6810","published":"2018-01-10T15:00:00.000Z","updated":"2024-09-16T22:41:37.290Z","title":"In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console.…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache ActiveMQ","kev":false,"epss":0.06093,"kevAdded":null},{"id":"CVE-2017-15717","published":"2018-01-10T14:00:00.000Z","updated":"2024-09-17T01:06:14.724Z","title":"A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Sling","kev":false,"epss":0.0291,"kevAdded":null},{"id":"CVE-2017-12622","published":"2018-01-10T03:00:00.000Z","updated":"2024-09-17T02:01:38.575Z","title":"When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the…","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02075,"kevAdded":null},{"id":"CVE-2017-9796","published":"2018-01-10T03:00:00.000Z","updated":"2024-09-17T00:16:51.123Z","title":"When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.01479,"kevAdded":null},{"id":"CVE-2017-9795","published":"2018-01-10T03:00:00.000Z","updated":"2024-09-16T22:30:33.662Z","title":"When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.04177,"kevAdded":null},{"id":"CVE-2012-3353","published":"2018-01-08T21:00:00.000Z","updated":"2024-09-16T23:56:19.347Z","title":"The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Sling","kev":false,"epss":0.03143,"kevAdded":null},{"id":"CVE-2017-17837","published":"2018-01-04T15:00:00.000Z","updated":"2024-09-17T02:21:15.482Z","title":"The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache DeltaSpike","kev":false,"epss":0.04471,"kevAdded":null},{"id":"CVE-2017-15714","published":"2018-01-04T15:00:00.000Z","updated":"2024-09-16T22:31:04.561Z","title":"The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.03292,"kevAdded":null},{"id":"CVE-2017-5641","published":"2017-12-28T15:00:00.000Z","updated":"2024-09-16T21:08:12.604Z","title":"Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Flex Blaze DS","kev":false,"epss":0.20747,"kevAdded":null},{"id":"CVE-2017-15700","published":"2017-12-18T20:00:00.000Z","updated":"2024-09-17T01:06:32.698Z","title":"A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Sling","kev":false,"epss":0.01858,"kevAdded":null},{"id":"CVE-2017-12630","published":"2017-12-18T14:00:00.000Z","updated":"2024-09-16T20:16:31.531Z","title":"In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Drill","kev":false,"epss":0.01242,"kevAdded":null},{"id":"CVE-2017-5663","published":"2017-12-14T15:00:00.000Z","updated":"2024-09-17T01:05:44.339Z","title":"In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Fineract","kev":false,"epss":0.02089,"kevAdded":null},{"id":"CVE-2017-15708","published":"2017-12-11T15:00:00.000Z","updated":"2024-09-17T02:51:55.934Z","title":"In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0,…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Synapse","kev":false,"epss":0.1788,"kevAdded":null},{"id":"CVE-2017-15707","published":"2017-12-01T16:00:00.000Z","updated":"2024-09-16T22:01:58.959Z","title":"In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious…","severity":"MEDIUM","score":6.2,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.04889,"kevAdded":null},{"id":"CVE-2017-15702","published":"2017-12-01T15:00:00.000Z","updated":"2024-09-16T16:38:43.290Z","title":"In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port,…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.06214,"kevAdded":null},{"id":"CVE-2017-15701","published":"2017-12-01T15:00:00.000Z","updated":"2024-09-16T16:28:48.395Z","title":"In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.04389,"kevAdded":null},{"id":"CVE-2017-12631","published":"2017-11-30T14:00:00.000Z","updated":"2024-09-16T21:58:27.297Z","title":"Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CXF Fediz","kev":false,"epss":0.01609,"kevAdded":null},{"id":"CVE-2017-12608","published":"2017-11-20T20:00:00.000Z","updated":"2024-09-16T20:17:10.353Z","title":"A vulnerability in Apache OpenOffice Writer DOC file parser before 4.1.4, and specifically in ImportOldFormatStyles, allows attackers to craft malicious…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.02889,"kevAdded":null},{"id":"CVE-2017-3157","published":"2017-11-20T20:00:00.000Z","updated":"2024-09-16T20:16:57.330Z","title":"By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.03122,"kevAdded":null},{"id":"CVE-2017-12607","published":"2017-11-20T19:00:00.000Z","updated":"2024-09-16T19:11:04.058Z","title":"A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.02588,"kevAdded":null},{"id":"CVE-2017-9806","published":"2017-11-20T17:00:00.000Z","updated":"2024-09-16T22:45:39.564Z","title":"A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.01805,"kevAdded":null},{"id":"CVE-2016-6804","published":"2017-11-20T15:00:00.000Z","updated":"2024-09-16T17:32:53.280Z","title":"The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.03011,"kevAdded":null},{"id":"CVE-2017-12634","published":"2017-11-15T15:00:00.000Z","updated":"2024-09-16T18:43:28.109Z","title":"The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.07194,"kevAdded":null},{"id":"CVE-2017-12633","published":"2017-11-15T15:00:00.000Z","updated":"2024-09-16T22:25:45.252Z","title":"The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.07194,"kevAdded":null},{"id":"CVE-2017-12636","published":"2017-11-14T20:00:00.000Z","updated":"2024-09-16T18:48:31.205Z","title":"CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries…","severity":"HIGH","score":7.2,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.90602,"kevAdded":null},{"id":"CVE-2017-12635","published":"2017-11-14T20:00:00.000Z","updated":"2024-09-17T01:31:53.828Z","title":"Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache CouchDB","kev":false,"epss":0.99838,"kevAdded":null},{"id":"CVE-2017-12624","published":"2017-11-14T16:00:00.000Z","updated":"2024-09-17T00:05:34.380Z","title":"Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.03697,"kevAdded":null},{"id":"CVE-2017-3166","published":"2017-11-13T14:00:00.000Z","updated":"2024-09-16T23:41:26.878Z","title":"In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2016-6803","published":"2017-11-13T14:00:00.000Z","updated":"2024-09-16T17:54:04.633Z","title":"An installer defect known as an \"unquoted Windows search path vulnerability\" affected the Apache OpenOffice before 4.1.3 installers for Windows. The PC must…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache OpenOffice","kev":false,"epss":0.02101,"kevAdded":null},{"id":"CVE-2017-12625","published":"2017-11-01T13:00:00.000Z","updated":"2024-09-16T22:30:24.930Z","title":"Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or…","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01431,"kevAdded":null},{"id":"CVE-2017-12618","published":"2017-10-24T01:00:00.000Z","updated":"2024-08-05T18:43:56.405Z","title":"Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a…","severity":"MEDIUM","score":4.7,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2017-12613","published":"2017-10-24T01:00:00.000Z","updated":"2024-08-05T18:43:56.151Z","title":"When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of…","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Portable Runtime","kev":false,"epss":0.01749,"kevAdded":null},{"id":"CVE-2010-2232","published":"2017-10-23T13:00:00.000Z","updated":"2024-08-07T02:25:07.510Z","title":"In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Derby","kev":false,"epss":0.03797,"kevAdded":null},{"id":"CVE-2017-12628","published":"2017-10-20T15:00:00.000Z","updated":"2024-08-05T18:43:56.437Z","title":"The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute…","severity":"HIGH","score":7.8,"vendor":"Apache Software Foundation","product":"Apache James","kev":false,"epss":0.00759,"kevAdded":null},{"id":"CVE-2017-5636","published":"2017-10-19T20:00:00.000Z","updated":"2024-08-05T15:04:15.356Z","title":"In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03599,"kevAdded":null},{"id":"CVE-2017-5635","published":"2017-10-19T20:00:00.000Z","updated":"2024-08-05T15:04:15.431Z","title":"In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03289,"kevAdded":null},{"id":"CVE-2016-8748","published":"2017-10-19T20:00:00.000Z","updated":"2024-09-17T04:05:08.852Z","title":"In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.01994,"kevAdded":null},{"id":"CVE-2016-8734","published":"2017-10-16T13:00:00.000Z","updated":"2024-09-16T20:01:52.257Z","title":"Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.0638,"kevAdded":null},{"id":"CVE-2017-12629","published":"2017-10-14T21:00:00.000Z","updated":"2024-08-05T18:43:56.440Z","title":"Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener…","severity":"CRITICAL","score":9.8,"vendor":null,"product":"Apache Solr before 7.1 with Apache Lucene before 7.1","kev":false,"epss":0.91896,"kevAdded":null},{"id":"CVE-2016-6815","published":"2017-10-13T14:00:00.000Z","updated":"2024-09-17T04:14:03.099Z","title":"In Apache Ranger before 0.6.2, users with \"keyadmin\" role should not be allowed to change password for users with \"admin\" role.","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.02071,"kevAdded":null},{"id":"CVE-2016-8736","published":"2017-10-12T18:00:00.000Z","updated":"2024-08-06T02:27:41.285Z","title":"Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.04781,"kevAdded":null},{"id":"CVE-2017-12623","published":"2017-10-10T18:00:00.000Z","updated":"2024-09-16T16:17:35.807Z","title":"An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.0194,"kevAdded":null},{"id":"CVE-2017-5637","published":"2017-10-10T01:00:00.000Z","updated":"2024-09-17T00:16:26.240Z","title":"Two four letter word commands \"wchp/wchc\" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache ZooKeeper","kev":false,"epss":0.73064,"kevAdded":null},{"id":"CVE-2017-12617","published":"2017-10-03T15:00:00.000Z","updated":"2025-10-21T23:55:32.381Z","title":"When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":true,"epss":0.99968,"kevAdded":"2022-03-25"},{"id":"CVE-2017-9792","published":"2017-10-03T01:00:00.000Z","updated":"2024-09-17T04:24:31.508Z","title":"In Apache Impala (incubating) before 2.10.0, a malicious user with \"ALTER\" permissions on an Impala table can access any other Kudu table data by altering the…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.01576,"kevAdded":null},{"id":"CVE-2017-12620","published":"2017-10-02T14:00:00.000Z","updated":"2024-09-16T19:15:51.072Z","title":"When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OpenNLP","kev":false,"epss":0.03041,"kevAdded":null},{"id":"CVE-2017-9797","published":"2017-10-02T13:00:00.000Z","updated":"2024-09-16T20:41:55.665Z","title":"When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.01358,"kevAdded":null},{"id":"CVE-2016-6806","published":"2017-10-02T13:00:00.000Z","updated":"2024-09-16T20:57:22.659Z","title":"Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.00822,"kevAdded":null},{"id":"CVE-2014-0043","published":"2017-10-02T13:00:00.000Z","updated":"2024-09-16T19:56:10.491Z","title":"In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Wicket","kev":false,"epss":0.03012,"kevAdded":null},{"id":"CVE-2017-9794","published":"2017-09-29T21:00:00.000Z","updated":"2024-09-17T03:02:45.659Z","title":"When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In…","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.01178,"kevAdded":null},{"id":"CVE-2017-9790","published":"2017-09-28T20:00:00.000Z","updated":"2024-09-16T22:14:23.745Z","title":"When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Mesos","kev":false,"epss":0.02446,"kevAdded":null},{"id":"CVE-2017-7687","published":"2017-09-28T20:00:00.000Z","updated":"2024-09-16T16:43:52.011Z","title":"When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1,…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Mesos","kev":false,"epss":0.02448,"kevAdded":null},{"id":"CVE-2017-12621","published":"2017-09-27T16:00:00.000Z","updated":"2024-09-16T16:14:10.234Z","title":"During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a \"SYSTEM\" entity with a URL and that entity is used in the…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Commons Jelly","kev":false,"epss":0.0813,"kevAdded":null},{"id":"CVE-2017-12611","published":"2017-09-20T17:00:00.000Z","updated":"2024-09-17T01:30:41.845Z","title":"In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.87123,"kevAdded":null},{"id":"CVE-2017-9804","published":"2017-09-20T17:00:00.000Z","updated":"2024-09-17T03:37:30.803Z","title":"In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.08237,"kevAdded":null},{"id":"CVE-2017-9793","published":"2017-09-20T17:00:00.000Z","updated":"2024-09-16T20:12:54.032Z","title":"The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.08787,"kevAdded":null},{"id":"CVE-2016-8738","published":"2017-09-20T17:00:00.000Z","updated":"2024-09-16T20:32:00.228Z","title":"In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.03259,"kevAdded":null},{"id":"CVE-2016-6795","published":"2017-09-20T17:00:00.000Z","updated":"2024-09-17T02:33:08.731Z","title":"In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.08219,"kevAdded":null},{"id":"CVE-2017-12616","published":"2017-09-19T13:00:00.000Z","updated":"2026-10-15T15:52:29.095Z","title":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.70118,"kevAdded":null},{"id":"CVE-2017-12615","published":"2017-09-19T13:00:00.000Z","updated":"2026-08-06T03:55:30.740Z","title":"When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false)…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":true,"epss":0.99707,"kevAdded":"2022-03-25"},{"id":"CVE-2017-9803","published":"2017-09-18T21:00:00.000Z","updated":"2024-09-17T02:01:07.460Z","title":"Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.02194,"kevAdded":null},{"id":"CVE-2017-9798","published":"2017-09-18T15:00:00.000Z","updated":"2025-11-04T16:09:11.219Z","title":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.94999,"kevAdded":null},{"id":"CVE-2017-9805","published":"2017-09-15T19:00:00.000Z","updated":"2025-10-21T23:55:34.589Z","title":"The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for…","severity":"HIGH","score":8.1,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":true,"epss":0.99396,"kevAdded":"2021-11-03"},{"id":"CVE-2017-12612","published":"2017-09-13T16:00:00.000Z","updated":"2024-08-05T18:43:56.253Z","title":"In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched…","severity":"HIGH","score":7.8,"vendor":null,"product":null,"kev":false,"epss":0.00734,"kevAdded":null},{"id":"CVE-2017-3165","published":"2017-09-13T16:00:00.000Z","updated":"2024-09-16T18:54:35.712Z","title":"In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of…","severity":"MEDIUM","score":5.4,"vendor":"Apache Software Foundation","product":"Apache Brooklyn","kev":false,"epss":0.02224,"kevAdded":null},{"id":"CVE-2016-8744","published":"2017-09-13T16:00:00.000Z","updated":"2024-09-16T18:09:23.475Z","title":"Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Brooklyn","kev":false,"epss":0.03825,"kevAdded":null},{"id":"CVE-2016-8737","published":"2017-09-13T16:00:00.000Z","updated":"2024-09-17T03:34:06.512Z","title":"In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Brooklyn","kev":false,"epss":0.01318,"kevAdded":null},{"id":"CVE-2016-3086","published":"2017-09-05T13:00:00.000Z","updated":"2024-09-16T17:13:54.507Z","title":"The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.0365,"kevAdded":null},{"id":"CVE-2016-5001","published":"2017-08-30T19:00:00.000Z","updated":"2024-09-16T19:51:02.745Z","title":"This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.00698,"kevAdded":null},{"id":"CVE-2016-6800","published":"2017-08-30T17:00:00.000Z","updated":"2024-09-16T16:34:06.607Z","title":"The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.03523,"kevAdded":null},{"id":"CVE-2016-4462","published":"2017-08-30T17:00:00.000Z","updated":"2024-09-17T00:30:36.308Z","title":"By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OFBiz","kev":false,"epss":0.03802,"kevAdded":null},{"id":"CVE-2017-3163","published":"2017-08-30T14:00:00.000Z","updated":"2024-09-16T18:39:30.795Z","title":"When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name.…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.06559,"kevAdded":null},{"id":"CVE-2017-3155","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-16T19:36:18.696Z","title":"Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02052,"kevAdded":null},{"id":"CVE-2017-3154","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-16T21:07:44.241Z","title":"Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02053,"kevAdded":null},{"id":"CVE-2017-3153","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-16T18:24:06.592Z","title":"Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02215,"kevAdded":null},{"id":"CVE-2017-3152","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-16T22:16:03.163Z","title":"Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02215,"kevAdded":null},{"id":"CVE-2017-3151","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-17T00:55:58.778Z","title":"Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02174,"kevAdded":null},{"id":"CVE-2017-3150","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-16T19:57:05.348Z","title":"Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02213,"kevAdded":null},{"id":"CVE-2016-8752","published":"2017-08-29T20:00:00.000Z","updated":"2024-09-16T19:05:02.136Z","title":"Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Atlas","kev":false,"epss":0.02127,"kevAdded":null},{"id":"CVE-2017-9802","published":"2017-08-14T13:00:00.000Z","updated":"2024-08-05T17:18:01.967Z","title":"The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows…","severity":"MEDIUM","score":6.1,"vendor":null,"product":null,"kev":false,"epss":0.03657,"kevAdded":null},{"id":"CVE-2017-9800","published":"2017-08-11T21:00:00.000Z","updated":"2024-09-16T23:36:59.228Z","title":"A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Subversion","kev":false,"epss":0.18892,"kevAdded":null},{"id":"CVE-2017-7675","published":"2017-08-11T02:00:00.000Z","updated":"2024-09-17T03:48:21.726Z","title":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.1014,"kevAdded":null},{"id":"CVE-2017-7674","published":"2017-08-11T02:00:00.000Z","updated":"2026-10-15T15:58:47.144Z","title":"The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating…","severity":"MEDIUM","score":4.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.08037,"kevAdded":null},{"id":"CVE-2016-6796","published":"2017-08-11T02:00:00.000Z","updated":"2026-10-08T21:13:49.454Z","title":"A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.08321,"kevAdded":null},{"id":"CVE-2016-8745","published":"2017-08-10T22:00:00.000Z","updated":"2024-11-14T20:02:16.961Z","title":"A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.16038,"kevAdded":null},{"id":"CVE-2016-6817","published":"2017-08-10T22:00:00.000Z","updated":"2024-10-15T19:01:10.556Z","title":"The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0719,"kevAdded":null},{"id":"CVE-2016-6797","published":"2017-08-10T22:00:00.000Z","updated":"2026-10-08T21:13:49.584Z","title":"The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.0807,"kevAdded":null},{"id":"CVE-2017-3156","published":"2017-08-10T18:00:00.000Z","updated":"2024-09-16T23:16:01.996Z","title":"The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.06315,"kevAdded":null},{"id":"CVE-2016-8739","published":"2017-08-10T18:00:00.000Z","updated":"2024-09-16T22:51:45.164Z","title":"The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.07317,"kevAdded":null},{"id":"CVE-2016-6812","published":"2017-08-10T16:00:00.000Z","updated":"2024-09-17T00:51:19.414Z","title":"The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.07547,"kevAdded":null},{"id":"CVE-2016-6794","published":"2017-08-10T16:00:00.000Z","updated":"2026-10-15T15:49:19.934Z","title":"When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.07152,"kevAdded":null},{"id":"CVE-2016-5018","published":"2017-08-10T16:00:00.000Z","updated":"2026-10-08T21:13:48.751Z","title":"In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass…","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.10303,"kevAdded":null},{"id":"CVE-2016-0762","published":"2017-08-10T16:00:00.000Z","updated":"2026-10-08T21:13:49.851Z","title":"The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.07991,"kevAdded":null},{"id":"CVE-2017-9799","published":"2017-08-09T21:00:00.000Z","updated":"2024-09-17T02:06:16.001Z","title":"It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache Storm","kev":false,"epss":0.04872,"kevAdded":null},{"id":"CVE-2017-9801","published":"2017-08-07T15:00:00.000Z","updated":"2024-09-16T19:05:37.866Z","title":"When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Commons Email","kev":false,"epss":0.06036,"kevAdded":null},{"id":"CVE-2016-8743","published":"2017-07-27T21:00:00.000Z","updated":"2024-09-16T17:03:31.158Z","title":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers.…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.13252,"kevAdded":null},{"id":"CVE-2016-2161","published":"2017-07-27T21:00:00.000Z","updated":"2024-09-16T22:02:00.808Z","title":"In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.20952,"kevAdded":null},{"id":"CVE-2016-0736","published":"2017-07-27T21:00:00.000Z","updated":"2024-09-16T17:52:49.825Z","title":"In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.49024,"kevAdded":null},{"id":"CVE-2017-7659","published":"2017-07-26T21:00:00.000Z","updated":"2024-08-05T16:12:27.873Z","title":"A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.53939,"kevAdded":null},{"id":"CVE-2016-6798","published":"2017-07-19T15:00:00.000Z","updated":"2024-09-16T16:47:49.975Z","title":"In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Sling","kev":false,"epss":0.03669,"kevAdded":null},{"id":"CVE-2017-7688","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-17T03:02:48.446Z","title":"Apache OpenMeetings 1.0.0 updates user password in insecure manner.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.0297,"kevAdded":null},{"id":"CVE-2017-7685","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T16:59:04.257Z","title":"Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.0286,"kevAdded":null},{"id":"CVE-2017-7684","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-17T03:18:54.640Z","title":"Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.02813,"kevAdded":null},{"id":"CVE-2017-7683","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T18:33:49.648Z","title":"Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01996,"kevAdded":null},{"id":"CVE-2017-7682","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T22:09:03.569Z","title":"Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.","severity":"HIGH","score":8.2,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01642,"kevAdded":null},{"id":"CVE-2017-7681","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T18:39:15.972Z","title":"Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01285,"kevAdded":null},{"id":"CVE-2017-7680","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T19:09:47.391Z","title":"Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01807,"kevAdded":null},{"id":"CVE-2017-7673","published":"2017-07-14T15:00:00.000Z","updated":"2024-08-05T16:12:27.911Z","title":"Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.01647,"kevAdded":null},{"id":"CVE-2017-7666","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T18:39:41.477Z","title":"Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.00804,"kevAdded":null},{"id":"CVE-2017-7664","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-16T23:36:16.238Z","title":"Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.","severity":"CRITICAL","score":10,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.02346,"kevAdded":null},{"id":"CVE-2017-7663","published":"2017-07-14T15:00:00.000Z","updated":"2024-09-17T03:08:15.636Z","title":"Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache OpenMeetings","kev":false,"epss":0.02666,"kevAdded":null},{"id":"CVE-2017-9789","published":"2017-07-13T16:00:00.000Z","updated":"2024-09-16T20:22:58.028Z","title":"When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.09584,"kevAdded":null},{"id":"CVE-2017-9788","published":"2017-07-13T16:00:00.000Z","updated":"2024-09-16T17:53:37.547Z","title":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset…","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.5677,"kevAdded":null},{"id":"CVE-2017-9787","published":"2017-07-13T15:00:00.000Z","updated":"2024-09-17T02:47:37.383Z","title":"When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.10554,"kevAdded":null},{"id":"CVE-2017-7672","published":"2017-07-13T15:00:00.000Z","updated":"2024-09-17T01:41:33.467Z","title":"If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":false,"epss":0.09835,"kevAdded":null},{"id":"CVE-2017-7678","published":"2017-07-12T13:00:00.000Z","updated":"2024-08-05T16:12:27.760Z","title":"In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points…","severity":"MEDIUM","score":6.1,"vendor":null,"product":null,"kev":false,"epss":0.0338,"kevAdded":null},{"id":"CVE-2017-5652","published":"2017-07-10T20:00:00.000Z","updated":"2024-09-16T16:42:27.591Z","title":"During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent data in plaintext even when the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.01217,"kevAdded":null},{"id":"CVE-2017-5640","published":"2017-07-10T20:00:00.000Z","updated":"2024-09-16T22:50:44.601Z","title":"It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Impala","kev":false,"epss":0.02852,"kevAdded":null},{"id":"CVE-2017-7670","published":"2017-07-10T18:00:00.000Z","updated":"2024-09-16T17:52:59.730Z","title":"The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Control","kev":false,"epss":0.04671,"kevAdded":null},{"id":"CVE-2017-9791","published":"2017-07-10T16:00:00.000Z","updated":"2025-10-21T23:55:38.964Z","title":"The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":true,"epss":0.98908,"kevAdded":"2022-02-10"},{"id":"CVE-2017-7660","published":"2017-07-07T19:00:00.000Z","updated":"2024-09-16T18:13:03.269Z","title":"Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Solr","kev":false,"epss":0.05632,"kevAdded":null},{"id":"CVE-2017-7686","published":"2017-06-28T13:00:00.000Z","updated":"2024-08-05T16:12:28.262Z","title":"Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ignite","kev":false,"epss":0.0297,"kevAdded":null},{"id":"CVE-2017-7679","published":"2017-06-20T01:00:00.000Z","updated":"2024-08-05T16:12:27.904Z","title":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.39341,"kevAdded":null},{"id":"CVE-2017-7668","published":"2017-06-20T01:00:00.000Z","updated":"2024-08-05T16:12:28.098Z","title":"The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.57472,"kevAdded":null},{"id":"CVE-2017-3169","published":"2017-06-20T01:00:00.000Z","updated":"2024-08-05T14:16:28.220Z","title":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection()…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.19953,"kevAdded":null},{"id":"CVE-2017-3167","published":"2017-06-20T01:00:00.000Z","updated":"2025-11-04T16:09:10.240Z","title":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.20231,"kevAdded":null},{"id":"CVE-2017-7677","published":"2017-06-14T17:00:00.000Z","updated":"2024-08-05T16:12:27.880Z","title":"In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.02614,"kevAdded":null},{"id":"CVE-2017-7676","published":"2017-06-14T17:00:00.000Z","updated":"2024-08-05T16:12:27.762Z","title":"Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.04198,"kevAdded":null},{"id":"CVE-2016-8751","published":"2017-06-14T17:00:00.000Z","updated":"2024-08-06T02:35:00.223Z","title":"Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary…","severity":"MEDIUM","score":4.8,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.02133,"kevAdded":null},{"id":"CVE-2016-8746","published":"2017-06-14T17:00:00.000Z","updated":"2024-08-06T02:34:59.604Z","title":"Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to…","severity":"MEDIUM","score":5.9,"vendor":"Apache Software Foundation","product":"Apache Ranger","kev":false,"epss":0.02733,"kevAdded":null},{"id":"CVE-2017-7667","published":"2017-06-12T16:00:00.000Z","updated":"2024-08-05T16:12:27.709Z","title":"Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.01431,"kevAdded":null},{"id":"CVE-2017-7665","published":"2017-06-12T16:00:00.000Z","updated":"2024-08-05T16:12:27.928Z","title":"In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache NiFi","kev":false,"epss":0.03506,"kevAdded":null},{"id":"CVE-2017-5664","published":"2017-06-06T14:00:00.000Z","updated":"2026-10-15T15:58:14.391Z","title":"The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.16567,"kevAdded":null},{"id":"CVE-2017-7669","published":"2017-06-02T17:00:00.000Z","updated":"2024-08-05T16:12:27.980Z","title":"In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.01795,"kevAdded":null},{"id":"CVE-2016-3083","published":"2017-05-30T14:00:00.000Z","updated":"2024-08-05T23:40:15.584Z","title":"Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Hive","kev":false,"epss":0.01006,"kevAdded":null},{"id":"CVE-2017-5646","published":"2017-05-26T21:00:00.000Z","updated":"2024-08-05T15:11:47.380Z","title":"For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS…","severity":"MEDIUM","score":6.8,"vendor":"Apache Software Foundation","product":"Apache Knox","kev":false,"epss":0.00752,"kevAdded":null},{"id":"CVE-2017-5657","published":"2017-05-22T18:00:00.000Z","updated":"2024-08-05T15:11:48.764Z","title":"Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same…","severity":"HIGH","score":8,"vendor":"Apache Software Foundation","product":"Apache Archiva","kev":false,"epss":0.00869,"kevAdded":null},{"id":"CVE-2015-5241","published":"2017-05-19T19:00:00.000Z","updated":"2024-08-06T06:41:08.590Z","title":"After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the…","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache jUDDI","kev":false,"epss":0.02289,"kevAdded":null},{"id":"CVE-2017-7662","published":"2017-05-16T17:00:00.000Z","updated":"2024-08-05T16:12:27.730Z","title":"Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CXF Fediz","kev":false,"epss":0.01136,"kevAdded":null},{"id":"CVE-2017-7661","published":"2017-05-16T17:00:00.000Z","updated":"2024-08-05T16:12:27.800Z","title":"Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style…","severity":"HIGH","score":8.8,"vendor":"Apache Software Foundation","product":"Apache CXF Fediz","kev":false,"epss":0.01104,"kevAdded":null},{"id":"CVE-2017-5655","published":"2017-05-15T14:00:00.000Z","updated":"2024-08-05T15:11:47.387Z","title":"In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are…","severity":"MEDIUM","score":6.5,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.02059,"kevAdded":null},{"id":"CVE-2016-8741","published":"2017-05-15T14:00:00.000Z","updated":"2024-08-06T02:34:59.610Z","title":"The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Qpid Broker-J","kev":false,"epss":0.06299,"kevAdded":null},{"id":"CVE-2017-5654","published":"2017-05-12T21:00:00.000Z","updated":"2024-08-05T15:11:48.668Z","title":"In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.02191,"kevAdded":null},{"id":"CVE-2016-6799","published":"2017-05-09T15:00:00.000Z","updated":"2024-08-06T01:43:37.895Z","title":"Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(),…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Cordova Android","kev":false,"epss":0.02582,"kevAdded":null},{"id":"CVE-2017-3162","published":"2017-04-26T20:00:00.000Z","updated":"2024-08-05T14:16:28.315Z","title":"HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in…","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.06423,"kevAdded":null},{"id":"CVE-2017-3161","published":"2017-04-26T20:00:00.000Z","updated":"2024-08-05T14:16:28.253Z","title":"The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.","severity":"MEDIUM","score":6.1,"vendor":"Apache Software Foundation","product":"Apache Hadoop","kev":false,"epss":0.03869,"kevAdded":null},{"id":"CVE-2017-5656","published":"2017-04-18T16:00:00.000Z","updated":"2024-08-05T15:11:48.432Z","title":"Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.06827,"kevAdded":null},{"id":"CVE-2017-5653","published":"2017-04-18T16:00:00.000Z","updated":"2024-08-05T15:11:48.424Z","title":"JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows…","severity":"MEDIUM","score":5.3,"vendor":"Apache Software Foundation","product":"Apache CXF","kev":false,"epss":0.11167,"kevAdded":null},{"id":"CVE-2017-5662","published":"2017-04-18T14:00:00.000Z","updated":"2024-08-05T15:11:47.301Z","title":"In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG…","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache Batik","kev":false,"epss":0.04118,"kevAdded":null},{"id":"CVE-2017-5661","published":"2017-04-18T14:00:00.000Z","updated":"2024-08-05T15:11:48.294Z","title":"In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files.…","severity":"HIGH","score":7.3,"vendor":"Apache Software Foundation","product":"Apache FOP","kev":false,"epss":0.02519,"kevAdded":null},{"id":"CVE-2017-5645","published":"2017-04-17T21:00:00.000Z","updated":"2026-10-08T21:14:06.089Z","title":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Log4j","kev":false,"epss":0.89358,"kevAdded":null},{"id":"CVE-2017-5659","published":"2017-04-17T18:00:00.000Z","updated":"2024-08-05T15:11:48.217Z","title":"Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02958,"kevAdded":null},{"id":"CVE-2016-5396","published":"2017-04-17T18:00:00.000Z","updated":"2024-08-06T01:00:59.916Z","title":"Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Traffic Server","kev":false,"epss":0.02881,"kevAdded":null},{"id":"CVE-2017-5651","published":"2017-04-17T16:00:00.000Z","updated":"2024-08-05T15:11:47.130Z","title":"In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.07752,"kevAdded":null},{"id":"CVE-2017-5650","published":"2017-04-17T16:00:00.000Z","updated":"2024-08-05T15:11:48.408Z","title":"In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.08275,"kevAdded":null},{"id":"CVE-2017-5648","published":"2017-04-17T16:00:00.000Z","updated":"2026-10-15T15:56:30.787Z","title":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to…","severity":"CRITICAL","score":9.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.13225,"kevAdded":null},{"id":"CVE-2017-5647","published":"2017-04-17T16:00:00.000Z","updated":"2026-11-02T17:27:36.591Z","title":"A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.1684,"kevAdded":null},{"id":"CVE-2016-8735","published":"2017-04-06T21:00:00.000Z","updated":"2025-10-21T23:55:42.758Z","title":"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":true,"epss":0.90338,"kevAdded":"2023-05-12"},{"id":"CVE-2017-5649","published":"2017-04-04T18:00:00.000Z","updated":"2024-08-05T15:11:47.417Z","title":"Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Geode","kev":false,"epss":0.02776,"kevAdded":null},{"id":"CVE-2017-5642","published":"2017-04-03T16:00:00.000Z","updated":"2024-08-05T15:04:15.357Z","title":"During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.01894,"kevAdded":null},{"id":"CVE-2016-6807","published":"2017-03-28T20:00:00.000Z","updated":"2024-08-06T01:43:37.895Z","title":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Ambari","kev":false,"epss":0.02446,"kevAdded":null},{"id":"CVE-2016-8749","published":"2017-03-28T18:00:00.000Z","updated":"2024-08-06T02:35:00.312Z","title":"Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.10604,"kevAdded":null},{"id":"CVE-2017-5644","published":"2017-03-24T14:00:00.000Z","updated":"2024-08-05T15:11:47.262Z","title":"Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an…","severity":"MEDIUM","score":5.5,"vendor":"Apache Software Foundation","product":"Apache POI","kev":false,"epss":0.04595,"kevAdded":null},{"id":"CVE-2016-6816","published":"2017-03-20T18:00:00.000Z","updated":"2024-11-14T20:05:46.260Z","title":"The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line…","severity":"HIGH","score":7.1,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.39633,"kevAdded":null},{"id":"CVE-2017-5643","published":"2017-03-16T15:00:00.000Z","updated":"2024-08-05T15:04:15.368Z","title":"Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.","severity":"HIGH","score":7.4,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.05863,"kevAdded":null},{"id":"CVE-2016-8747","published":"2017-03-14T09:02:00.000Z","updated":"2024-10-15T19:01:18.289Z","title":"An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations.…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache Tomcat","kev":false,"epss":0.07121,"kevAdded":null},{"id":"CVE-2017-5638","published":"2017-03-11T02:11:00.000Z","updated":"2025-10-21T23:55:46.106Z","title":"The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation…","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Struts","kev":true,"epss":0.99999,"kevAdded":"2021-11-03"},{"id":"CVE-2017-3159","published":"2017-03-07T15:00:00.000Z","updated":"2024-08-05T14:16:28.249Z","title":"Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.","severity":"CRITICAL","score":9.8,"vendor":"Apache Software Foundation","product":"Apache Camel","kev":false,"epss":0.06286,"kevAdded":null},{"id":"CVE-2016-8740","published":"2016-12-05T19:00:00.000Z","updated":"2024-08-06T02:34:59.624Z","title":"The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header…","severity":"HIGH","score":7.5,"vendor":"Apache Software Foundation","product":"Apache HTTP Server","kev":false,"epss":0.7907,"kevAdded":null}]}