By vendor

Apache vulnerabilities

Known CVEs affecting Apache products, prioritized by severity, with SEC.co remediation and detection guidance.

130 published vulnerabilities · page 1 of 2

• CVE-2026-39998HIGH 8.8

  Apache APISIX versions 2.12.0 through 3.16.0 contain an input validation flaw in the forward-auth plugin that allows an authenticated attacker to spoof identity headers. By crafting malicious requests, an attacker can bypass intended authentication checks and assume the identity of other users or services, potentially gaining unauthorized access to protected resources.

• CVE-2026-42359HIGH 8.8

  Apache Airflow contains a bypass of an earlier security fix that allows authenticated users with restricted permissions to inject malicious code into deferred tasks. An attacker with legitimate write access to task metadata can craft a specially formatted request to set hidden configuration values that trigger remote code execution when the task resumes. This affects organizations where any untrusted team members have editing permissions on Airflow workflows.

• CVE-2026-45505HIGH 8.8

  Apache ActiveMQ contains a code injection vulnerability that allows authenticated attackers to execute arbitrary code on the broker. The issue stems from improper validation of discovery wrapper URLs—specifically non-parenthesized formats like `masterslave:vm://...` and `static:vm://`—which bypass a previous security fix. An attacker with valid credentials can exploit the Jolokia JMX-HTTP bridge to load malicious Spring XML configurations, leading to remote code execution with broker privileges.

• CVE-2026-46590HIGH 8.8

  Apache Camel's post-quantum cryptography (PQC) component has a critical flaw in how it handles cryptographic key metadata. When key managers like HashiCorp Vault or AWS Secrets Manager retrieve stored keys, they deserialize data using an unsafe Java deserialization method without any validation. An attacker who can write to the backend storage system (Vault or AWS Secrets Manager) can inject a malicious serialized object that executes arbitrary code when the application deserializes it during normal key operations. This is particularly dangerous because the vulnerability persists from an earlier incomplete fix and affects three different key storage implementations.

• CVE-2026-47342HIGH 8.8

  Apache OFBiz contains a privilege escalation flaw that allows authenticated users with limited system access to gain elevated privileges. An attacker who already has basic login credentials can exploit this vulnerability to perform administrative actions without proper authorization. The issue affects all versions prior to 24.09.07. Organizations running vulnerable OFBiz instances should prioritize patching to prevent unauthorized privilege elevation.

• CVE-2026-49157HIGH 8.8

  Apache ActiveMQ contains a permissions misconfiguration in its Jolokia interface that allows low-privilege web users to perform high-level broker management operations. Specifically, non-admin accounts can execute commands like addQueue and removeQueue that should be restricted to administrators only. This violates the principle of least privilege and can lead to unauthorized service disruption or configuration tampering. Affected versions are ActiveMQ 5.x before 5.19.7 and 6.x before 6.2.6.

• CVE-2026-49298HIGH 8.8

  Apache Airflow's KubernetesExecutor has a credential exposure bug where JWT tokens used by worker pods to authenticate against the Execution API are inadvertently visible in Kubernetes pod specifications. An attacker with read-only access to the Airflow namespace in Kubernetes (a common access level) can retrieve these tokens from standard `kubectl describe pod` commands and then use them to execute privileged API operations—such as triggering DAG runs, clearing runs, or modifying Variables, Connections, and XComs—without needing direct task execution privileges. This vulnerability only affects deployments using the KubernetesExecutor. The fix requires upgrading both the airflow-providers-cncf-kubernetes package (if not already done per CVE-2026-27173) and the core apache-airflow package to close complementary attack surfaces.

• CVE-2026-50223HIGH 8.8

  Apache OFBiz contains a code injection vulnerability that allows users with limited permissions to inject malicious template code and execute arbitrary commands on affected servers. An authenticated attacker with Content or DataResource editing privileges can exploit this weakness to gain full control over the system. The vulnerability affects all OFBiz versions prior to 24.09.07 and requires immediate patching.

• CVE-2026-35563HIGH 8.5

  A flaw in Apache Directory LDAP API version 2.1.7 allows an attacker with network interception capability to impersonate an LDAP server. The library validates that a certificate is signed by a trusted authority but fails to confirm that the certificate was actually issued for the LDAP server being connected to. An attacker positioned between a client and server can present any valid certificate from their trust store, hijacking the connection and accessing sensitive authentication and directory data.

• CVE-2026-46591HIGH 8.2

  Apache Camel's Neo4j integration contains a query injection flaw that lets attackers manipulate database queries by crafting malicious property names in match operations. Although previous patches blocked injection through property values, the property names themselves are still inserted directly into Cypher queries without escaping. If your application routes untrusted data—such as JSON request bodies or headers—into the Neo4j producer's match configuration, an attacker can inject arbitrary Cypher syntax to read, modify, or delete any data in your Neo4j database. The vulnerability exists in Camel versions from 4.10.0 through 4.20.x, with patches available in 4.14.8 (LTS), 4.18.3, and 4.21.0+.

• CVE-2025-66336HIGH 8.1

  Apache Doris MCP Server has a SQL injection vulnerability in how it handles metadata queries. When a user provides a database name, that name gets directly inserted into a SQL query without proper safeguards. An attacker with valid credentials—or without any credentials if authentication is turned off—can exploit this to run unauthorized SQL commands and access data from databases they shouldn't be able to reach. The vendor recommends upgrading to version 0.6.1 or later to fix the problem.

• CVE-2026-40859HIGH 8.1

  Apache Camel's vertx-http component contains a critical deserialization flaw that can lead to remote code execution. When the component is configured to transfer exceptions from backend HTTP responses (an opt-in setting), it deserializes Java objects from responses without any safety checks. An attacker controlling or intercepting the backend service can send a malicious serialized object that, if suitable gadget classes exist in the application's dependencies, executes arbitrary code on the Camel host. This vulnerability requires non-default configuration to trigger and relies on either compromising the backend service or intercepting unencrypted HTTP traffic.

• CVE-2026-42527HIGH 8.1

  Apache Camel contains a deserialization vulnerability that allows attackers to trigger DNS queries during message processing. When serialized Java objects are sent to affected Camel components—particularly JMS consumers—the framework's default security filter allows certain classes like java.net.URL through. An attacker can craft a HashMap with malicious URL keys that, when deserialized, causes the JVM to issue DNS queries to attacker-controlled servers. This creates an out-of-band information disclosure channel without requiring code execution. The risk is highest in JMS deployments where message deserialization happens by default.

• CVE-2026-42588HIGH 8.1

  Apache ActiveMQ's web console exposes a remote interface (Jolokia) that allows authenticated users to interact with the message broker's management functions. An attacker who has legitimate access credentials can craft a specially formed network connector request that tricks the broker into loading and executing arbitrary code hidden in a Spring XML configuration file. The vulnerability exists because the broker doesn't properly validate the input before processing it, and Spring automatically instantiates code within those XML files before any security checks occur.

• CVE-2026-43865HIGH 8.1

  Apache Camel's Hazelcast integration component has a critical flaw in how it handles data coming from cluster nodes. When Camel automatically creates and manages Hazelcast instances without custom configuration, it doesn't protect against malicious serialized Java objects. An attacker positioned on or able to reach the Hazelcast cluster can send a specially crafted object that gets automatically deserialized on every Camel node, executing arbitrary code. This happens silently in the background for any route using Hazelcast consumers or certain Camel repositories—no special endpoint setup is required for the vulnerability to exist.

• CVE-2026-44825HIGH 8.1

  Apache Solr's authentication setup tool comes with hardcoded default credentials that are silently installed in addition to any user-specified accounts. A remote attacker who knows these public defaults can bypass the security layer entirely and gain full administrative control of the Solr cluster. This affects versions 9.4.0 through 9.10.1 and 10.0.0, but only if the basic authentication setup tool was used during cluster initialization.

• CVE-2026-47339HIGH 8.1

  Apache APISIX has an authorization flaw in its authz-casdoor plugin that allows attackers with valid credentials to bypass authentication controls and gain access using credentials from a different authentication source. This is possible when the plugin is deployed with its default settings. The vulnerability affects APISIX versions 2.14.1 through 3.16.0, and upgrading to version 3.17.0 eliminates the issue.

• CVE-2026-49297HIGH 8.1

  Apache Airflow's Google Cloud Storage integrations contain a path traversal vulnerability that allows malicious object naming to write files outside their intended destination. If your DAGs ingest data from GCS buckets controlled by external partners, service accounts, or public sources, an attacker could craft object names with `..` sequences to overwrite files on SFTP servers or worker machines. The risk is elevated in multi-tenant or federated data environments where bucket write permissions are granted to less-trusted principals.

• CVE-2026-49872HIGH 8.1

  Apache APISIX versions 3.0.0 through 3.16.0 contain an authentication bypass flaw in the CAS authentication plugin. An attacker with valid credentials to one system can potentially use those credentials to authenticate as a different user or gain unauthorized access through the misconfigured authentication logic. This is a significant issue because CAS (Central Authentication Service) is commonly deployed in enterprise environments where authentication decisions directly gate access to sensitive APIs and services.

• CVE-2026-49877HIGH 8.1

  Apache ActiveMQ contains an improper authorization flaw that allows any authenticated user with low-privilege access to the Web Console to reach administrative paths they shouldn't be able to access. By default, the embedded Jetty web server fails to enforce proper access controls on /admin/* endpoints, meaning a regular user can potentially perform administrative actions. This affects ActiveMQ versions before 5.19.8 and 6.0.0 through 6.2.6.

• CVE-2026-50632HIGH 8.1

  Apache CXF contains a gap in a previously patched vulnerability that allows remote code execution when untrusted users can configure Java Message Service (JMS) endpoints. This is a second-order fix to CVE-2026-44417, indicating the original patch was incomplete. An attacker with JMS configuration privileges could execute arbitrary code on the system, making this a serious risk for organizations relying on Apache CXF to handle messaging.

• CVE-2026-50633HIGH 8.1

  Apache CXF, a widely-used web services framework, contains a JNDI (Java Naming and Directory Interface) injection flaw in its JCA integration module. An attacker who can modify the JCA deployment descriptor file (ra.xml) or influence runtime activation parameters could inject malicious code that executes with the privileges of the application server. This is a high-risk vulnerability because JNDI injection can lead to full code execution and system compromise.

• CVE-2026-24012HIGH 7.5

  Apache IoTDB contains a denial-of-service vulnerability in query processing that allows unauthenticated attackers to crash DataNode instances. When submitting queries with extreme parameters—such as a very large time range paired with a minimal aggregation interval—an attacker can force the DataNode to allocate massive amounts of memory, overwhelming the Java heap and terminating the process. No authentication is required to exploit this issue, making it a network-accessible threat to any exposed IoTDB deployment.

• CVE-2026-34355HIGH 7.5

  A buffer overflow vulnerability exists in Apache HTTP Server's mod_proxy_html module, affecting versions 2.4.67 and earlier. An attacker controlling an untrusted backend server can trigger this overflow, causing the Apache service to crash and become unavailable. The vulnerability requires network access but no authentication or user interaction to exploit.

• CVE-2026-34356HIGH 7.5

  Apache HTTP Server contains a heap-based buffer overflow vulnerability affecting versions 2.4.0 through 2.4.67. The flaw can be triggered when the server is configured with ProxyPassReverse directives that process cookies, and communicates with a malicious backend server. An attacker controlling a backend server could exploit this to cause a denial of service by crashing the Apache process. While the vulnerability does not directly enable data theft or compromise, the crash impact is significant in production environments. Upgrade to version 2.4.68 or later to resolve the issue.

• CVE-2026-41084HIGH 7.5

  A flaw in Apache Airflow's task management API allows an authenticated user with editing permission on one workflow (DAG) to secretly modify task states in completely different workflows—including those owned by other teams. The vulnerability exploits a mismatch between authorization checks (which validate against the workflow in the URL) and the actual workflow being modified (specified in the request body). An attacker with legitimate access to edit one workflow can bypass permission controls to interfere with unrelated workflows, potentially disrupting operations, hiding failures, or triggering unintended task executions.

• CVE-2026-42536HIGH 7.5

  A heap-based buffer overflow vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.67 when processing XML content through the mod_xml2enc module. An attacker can send specially crafted XML data to trigger a memory corruption issue that causes the server to crash, resulting in denial of service. The vulnerability requires no authentication and can be exploited over the network without user interaction.

• CVE-2026-46457HIGH 7.5

  Apache Camel's NATS component has a header-handling flaw that allows untrusted message publishers to inject fake control headers into Camel routes. When a NATS client sends a message to a topic that Camel is consuming, those headers—including Camel's own internal directives like CamelHttpUri or CamelFileName—are copied directly into the message flow without filtering. An attacker who can publish to that NATS topic can craft headers that hijack downstream behavior: redirecting HTTP calls, changing file paths, altering database queries, or worse. The vulnerability affects Camel 4.0.0 through 4.21.0 (with fixes in 4.14.8, 4.18.3, and 4.21.0). It requires NATS 2.2+ and is exploitable on out-of-the-box NATS servers that have no authentication.

• CVE-2026-46585HIGH 7.5

  Apache Camel's Lucene component contains a vulnerability that allows attackers to bypass intended query restrictions and access unauthorized data through HTTP requests. When a Camel route exposes Lucene search functionality via HTTP, an attacker can inject a malicious search query by setting specific HTTP headers, causing the application to execute searches against the full text index that should have been blocked or filtered. This affects Camel versions 4.0.0 through 4.20.x, with no authentication required if the HTTP endpoint is public. The risk ranges from unauthorized document disclosure to resource exhaustion through expensive queries.

• CVE-2026-46592HIGH 7.5

  Apache Camel's CXF component has a vulnerability that allows an attacker to trick the system into invoking unintended operations on a backend SOAP service. When a Camel route bridges an HTTP request directly to a SOAP backend, an attacker can inject HTTP headers that override which SOAP operation gets executed. This could mean replacing a safe read operation with a destructive write or delete. The vulnerability exists because Camel's header filtering didn't recognize these control headers as needing protection, letting them pass through from untrusted HTTP clients into the routing logic.

• CVE-2026-46726HIGH 7.5

  Apache Camel's Vertx WebSocket component fails to filter incoming connection parameters, allowing unauthenticated attackers to inject Camel control headers through query or path parameters. When a WebSocket consumer feeds data into an HTTP producer downstream, attackers can redirect the HTTP request to arbitrary internal or external servers and extract sensitive information like environment variables, application properties, or vault secrets by embedding property placeholder references in the injected headers. This is a remote attack requiring no authentication if the WebSocket endpoint is publicly exposed.

• CVE-2026-47430HIGH 7.5

  A vulnerability in the Apache Cordova InAppBrowser plugin (versions 3.1.0–6.0.0) allows attackers to trick iOS apps into executing unintended plugin callbacks. When an app displays untrusted content in InAppBrowser—such as a social login redirect or marketing landing page—an attacker can craft a malicious message that fires callbacks meant for other installed plugins (like Camera, Contacts, or Geolocation). Because Cordova uses predictable callback naming, attackers can enumerate and target these IDs without specialized knowledge. The result is that the attacker can spoof plugin results: falsely approving a camera request, injecting fake contacts, or returning fabricated file data—all appearing to come from legitimate plugin operations.

• CVE-2026-47896HIGH 7.5

  Apache Lucene.Net's Lucene.Net.Replicator library contains a path traversal vulnerability that allows an attacker to read files outside the intended directory on affected systems. An unauthenticated remote attacker can exploit this over the network without user interaction, potentially exposing sensitive data. The vulnerability affects beta versions 4.8.0-beta00005 through 4.8.0-beta00017, and a fix is available in version 4.8.0-beta00018.

• CVE-2026-47897HIGH 7.5

  A path traversal vulnerability exists in Apache Lucene.Net's Replicator library (versions 4.8.0-beta00005 through 4.8.0-beta00017) that allows unauthenticated network attackers to write or modify files outside of their intended directory. An attacker can craft requests that bypass directory restrictions, potentially overwriting configuration files, application binaries, or other sensitive data on affected systems. The vulnerability requires no authentication and can be exploited remotely over the network.

• CVE-2026-49361HIGH 7.5

  Apache Fluss, a distributed stream processing engine still in incubation at the Apache Software Foundation, contains a critical flaw in how it handles network traffic. Versions 0.8.0 and 0.9.0 allow attackers on the network to send specially crafted data packets that trick the system into consuming massive amounts of memory, causing the service to crash. No authentication is required—an attacker can do this from anywhere on the network without logging in. This is a denial-of-service vulnerability that impacts both the TabletServer and CoordinatorServer components.

• CVE-2026-49432HIGH 7.5

  Apache ActiveMQ has a flaw that allows an unauthenticated attacker to crash message broker instances by sending malformed network requests through the STOMP protocol connector. By specifying a negative content-length header and streaming body data, the attacker can either exhaust memory on NIO transports or trigger a forced connection closure on blocking transports, resulting in denial of service. No authentication is required, and the attack succeeds if the STOMP port is accessible over the network.

• CVE-2026-49434HIGH 7.5

  Apache ActiveMQ contains an input validation flaw that allows attackers with LDAP write access to inject malicious configuration. By modifying LDAP entries matching the broker's search criteria, an attacker can force the broker to instantiate unauthorized transports, retrieve external URLs, and spawn a second message broker instance within the same JVM. This effectively gives an attacker the ability to create a parallel, attacker-controlled broker alongside the legitimate one.

• CVE-2026-49486HIGH 7.5

  Apache Airflow's FTP provider has a critical flaw in how it establishes secure file transfers. When using FTPSHook or FTPSFileTransmitOperator, the connection setup protects the initial login channel with TLS encryption, but fails to enable encryption for the actual file data being transmitted. This means an attacker positioned on the network path between your Airflow instance and the FTP server can intercept and read file contents and any embedded credentials, despite the connection appearing secure. The vulnerability affects all versions of apache-airflow-providers-ftp prior to 3.15.1.

• CVE-2026-49975HIGH 7.5

  Apache HTTP Server contains a vulnerability in its mod_http module that allows attackers to crash the web server by sending specially crafted HTTP requests. The flaw stems from improper memory allocation handling—specifically, when the server attempts to allocate an excessively large block of memory in response to a malicious request, it can exhaust system resources and cause a denial of service. No user authentication is required to exploit this vulnerability, and attackers can trigger it remotely over the network. Affected versions span from 2.4.17 through 2.4.67.

• CVE-2026-50645HIGH 7.5

  Apache CXF, a popular web services framework, does not limit the number of attachment headers it accepts when processing incoming messages. An attacker can exploit this by sending messages with an extremely large number of attachments, forcing the application to consume excessive memory and CPU resources, resulting in a denial-of-service condition. The vulnerability affects message deserialization—the process of converting data from network format back into usable objects—making it a network-level attack that requires no authentication or user interaction.

• CVE-2026-50734HIGH 7.5

  Apache ActiveMQ has a vulnerability in how it handles initial connection setup with clients. An attacker on the network can send a specially crafted message during the handshake phase that tricks the broker into trying to allocate an unreasonably large amount of memory. Because this validation happens before the attacker is even authenticated, they don't need credentials. If successful, the broker runs out of memory and crashes, leaving it unable to serve legitimate users. This is a straightforward denial-of-service attack that requires only network access and no special privileges.

• CVE-2026-50750HIGH 7.5

  Apache ActiveMQ has a denial-of-service vulnerability where an unauthenticated attacker can crash the message broker by sending repeated BrokerInfo commands without establishing a proper connection. This flaw emerged as a regression after a fix for an earlier vulnerability, allowing attackers to exhaust server memory until the broker becomes unavailable. The issue affects multiple recent versions of ActiveMQ across 5.19.x and 6.2.x release lines.

• CVE-2026-53916HIGH 7.5

  Apache ActiveMQ has a vulnerability that allows an attacker without credentials to crash the message broker by sending specially crafted data over a STOMP connection. The attacker sends header bytes that never end, causing the broker to accumulate them in memory indefinitely until the Java process runs out of heap space and fails. This is a straightforward denial-of-service attack that requires only network access to the STOMP port.

• CVE-2026-53917HIGH 7.5

  Apache ActiveMQ has a denial-of-service vulnerability where authenticated users can crash the broker by sending a specially crafted message with an oversized map size declaration. When the broker tries to allocate memory based on this inflated size value without validation, it exhausts available memory and crashes. This affects multiple ActiveMQ products across two version families: 5.x releases before 5.19.8 and 6.x releases from 6.0.0 through 6.2.6.

• CVE-2026-54399HIGH 7.5

  Apache HttpComponents Core is a widely-used Java library for building HTTP clients and servers. A vulnerability in its HTTP/1.1 message parser allows attackers to crash services or render them unresponsive by flooding them with requests containing unusually large numbers of headers or extremely long header values. The parser consumes memory without adequate limits, leading to exhaustion and denial of service. This affects versions 5.4.2 and earlier, as well as the 5.5-beta1 release.

• CVE-2026-54428HIGH 7.5

  Apache HttpComponents Core, a widely-used Java library for HTTP communication, contains a denial-of-service vulnerability in its HTTP/2 header decompression handler. An attacker can send specially crafted oversized compressed headers to exhaust server memory before the library's safety limits kick in, crashing the service. This affects versions 5.4.2 and earlier, including the 5.5-beta1 release.

• CVE-2026-54475HIGH 7.5

  Apache ActiveMQ has a missing authorization vulnerability that breaks the isolation of temporary message destinations. These destinations are supposed to be private to each client connection, but the check exists only on the client side. An attacker with network access can bypass this by connecting directly to the broker and consuming messages from another connection's private temporary destination. This allows unauthorized message interception without requiring credentials or authentication bypass.

• CVE-2026-55993HIGH 7.5

  Apache Camel's WebSocket component has a critical flaw that allows unauthenticated attackers to redirect server-side HTTP requests and steal sensitive configuration data. When a WebSocket endpoint receives connections, it accepts query parameters that get converted into internal Camel headers without validation. An attacker can inject specially crafted parameters to override the HTTP destination URI and trigger exposure of environment variables, application properties, and vault secrets through placeholder resolution. This is particularly dangerous in deployments where the WebSocket endpoint feeds directly into downstream HTTP producers and lacks authentication controls.

• CVE-2026-55994HIGH 7.5

  Apache Camel's Iggy component fails to filter incoming message headers before copying them into the application's internal header map. This allows an attacker who can publish messages to a monitored Iggy stream to inject specially crafted headers that override Camel's internal routing directives. When those messages flow through an HTTP request, the injected headers can redirect the request to an attacker-controlled server (SSRF attack) or leak sensitive data like environment variables and secrets. The vulnerability affects Camel versions 4.17.0 through 4.20.x and requires patching to 4.18.3 (for 4.18 branch users) or 4.21.0 (for current releases).

• CVE-2026-57111HIGH 7.5

  Apache Helix exposes administrative REST API endpoints to unauthorized cross-origin requests due to overly permissive CORS (Cross-Origin Resource Sharing) configuration. An attacker who tricks a user with legitimate access to visit a malicious web page can make requests to these administrative endpoints from the attacker's domain, potentially reading sensitive responses or performing administrative actions. The vulnerability exists in versions through 2.0.0 and is fixed in 2.0.1.

• CVE-2026-50631HIGH 7.4

  Apache CXF contains a race condition in its OAuth token handling that allows attackers to generate multiple valid access tokens from a single refresh token when the 'recycleRefreshTokens' setting is disabled. If a refresh token is leaked or compromised, an attacker can send concurrent requests to the OAuth provider using that token, potentially obtaining numerous valid access tokens before the provider realizes the refresh token has been misused. This breaks the intended single-use semantics of refresh tokens and significantly expands the window of compromise.

• CVE-2026-43825HIGH 7.3

  Apache OpenNLP's SvmDoccatModel contains a dangerous deserialization flaw that can allow attackers to execute arbitrary code. The vulnerability exists in how the library reads serialized model files—it deserializes untrusted data without proper validation, meaning malicious input can trigger code execution if certain common Java libraries are present on the system. This affects OpenNLP 3.x versions prior to 3.0.0-M4. The risk is highest for applications that load SvmDoccatModel instances from external or user-supplied sources.

• CVE-2026-43866HIGH 7.3

  Apache Camel and its JMS-related components contain a critical deserialization bypass vulnerability that allows an attacker to inject malicious Exchange state into JMS applications. The issue stems from an incomplete fix to a prior vulnerability (CVE-2026-40860): while that patch added a class allowlist to prevent arbitrary object deserialization, it inadvertently allowed a Camel internal class (DefaultExchangeHolder) to slip through. An attacker who can publish a crafted ObjectMessage to a JMS queue or topic consumed by a vulnerable Camel application can exploit this to manipulate routing logic, inject headers, modify properties, and alter error handling—all without needing a complex deserialization gadget chain. The attack leverages only standard Java classes that all systems trust.

• CVE-2026-44185HIGH 7.3

  Apache HTTP Server contains a buffer over-read vulnerability triggered when the server makes outbound OCSP (Online Certificate Status Protocol) requests to an attacker-controlled server. An attacker can craft a malicious OCSP response that causes the HTTP Server to read beyond allocated memory boundaries, potentially exposing sensitive data or causing service disruption. All versions from 2.4.0 through 2.4.67 are affected; upgrading to version 2.4.68 resolves the issue.

• CVE-2026-44186HIGH 7.3

  Apache HTTP Server versions 2.4.0 through 2.4.67 contain a vulnerability in the mod_proxy_ftp module that can be triggered when the server proxies requests to a backend FTP server under attacker control. The vulnerability manifests as an infinite loop—a condition where the module becomes stuck in a repeating sequence and never exits cleanly. This can cause the affected worker process to hang indefinitely, consuming CPU resources and becoming unresponsive. An attacker does not need credentials or user interaction to exploit this; they only need to control or compromise the FTP server that the Apache proxy is configured to forward requests to.

• CVE-2026-45360HIGH 7.3

  Apache Airflow's scheduler contains a deserialization vulnerability in how it handles deadline references created by DAG authors. When a DAG author creates a custom deadline reference, the scheduler deserializes it without validating what code it might execute. An attacker who can author a DAG—or influence its contents—can embed malicious class paths that the scheduler will import and instantiate, gaining the ability to execute arbitrary code within the scheduler's security context and access its database connection.

• CVE-2026-46587HIGH 7.3

  Apache Camel contains an input validation flaw that allows attackers to send specially crafted requests to affected systems without authentication. The vulnerability can lead to information disclosure, unauthorized modifications, and service disruption. Organizations running vulnerable versions of Camel should prioritize upgrading to patched releases.

• CVE-2026-46588HIGH 7.3

  Apache Camel, a widely-used open-source integration framework, contains a flaw in how it validates user input. This weakness allows an attacker to send specially crafted requests over the network without authentication, potentially compromising the confidentiality, integrity, or availability of affected systems. The vulnerability spans multiple version lines, affecting releases through 4.14.7, versions 4.15.0 through 4.18.2, and versions 4.19.0 through 4.20.0.

• CVE-2026-48913HIGH 7.3

  Apache HTTP Server's HTTP/2 module (mod_http2) contains a use-after-free vulnerability that can be triggered when the system runs out of available file handles. An unauthenticated attacker on the network can exploit this flaw to cause memory corruption, potentially leading to information disclosure, data modification, or service disruption. The vulnerability affects versions 2.4.55 through 2.4.67 of Apache HTTP Server.

• CVE-2026-49042HIGH 7.3

  Apache Camel, a widely used integration framework, contains an improper input validation vulnerability that allows unauthenticated attackers to send malformed requests over the network. This flaw can lead to information disclosure, data manipulation, or service disruption depending on how the affected application processes untrusted input. The vulnerability affects multiple version lines and requires immediate patching to maintain security posture.

• CVE-2026-53404HIGH 7.3

  Apache Tomcat's URL rewrite valve contains a logic flaw where the processing of conditional rules breaks when an OR condition is matched first. Instead of continuing to evaluate remaining conditions as designed, the system incorrectly skips over non-OR conditions that should still be checked. This can cause rewrite rules to behave unpredictably, potentially allowing traffic that should be blocked or modifying requests in unintended ways. The flaw affects multiple Tomcat versions across several release branches.

• CVE-2026-55957HIGH 7.3

  Apache Tomcat contains an authentication bypass vulnerability when GSSAPI-based LDAP authentication is enabled through JNDIRealm. An attacker can log in without providing a valid password, gaining unauthorized access to the application. The flaw affects multiple Tomcat versions spanning nearly two decades of releases, from version 7 through 11.

• CVE-2026-25700HIGH 7.2

  Apache Answer versions up to 2.0.0 contain a security flaw where administrative API tokens remain valid even after an administrator account is suspended, deleted, or deactivated. An attacker with knowledge of a revoked admin's token can continue making administrative API calls until the token naturally expires, potentially allowing unauthorized changes to system configuration, user accounts, or sensitive data. The vulnerability requires high privilege (an existing admin account) to initially create the problematic token, but once created, that token persists independently of account status.

• CVE-2026-40961HIGH 7.2

  Apache Airflow contains a flaw in its login redirect mechanism that allows authenticated users to redirect people to malicious websites. The vulnerability exists because the URL safety check (`is_safe_url`) can be circumvented through crafted URLs, enabling attackers to potentially harvest credentials or distribute malware by making the redirect appear to come from a trusted Airflow instance. Any organization running Airflow and allowing authentication should treat this as a priority.

• CVE-2026-44913HIGH 7.2

  Apache NiFi versions 1.2.0 through 2.9.0 contain a SQL injection vulnerability in the CaptureChangeMySQL Processor. The flaw stems from inadequate escaping of database table names, allowing an authenticated attacker with high privileges to inject arbitrary SQL commands by supplying crafted table names. A partial mitigation added in version 1.8.0 introduced quoted boundaries but did not eliminate the risk entirely. Organizations using other NiFi processors are unaffected. Upgrading to version 2.10.0 resolves the issue through improved identifier escaping.

• CVE-2026-44914HIGH 7.2

  Apache NiFi versions 1.12.0 through 2.9.0 contain a flaw where the system fails to properly verify user permissions when someone tries to replace Process Groups that contain restricted components. Restricted components are those requiring elevated privileges, but the framework skipped this authorization check during replacement operations. This means a user with basic write access could circumvent intended security controls and deploy restricted components without proper authorization. The vulnerability is effectively a privilege escalation through authorization bypass in the Process Group replacement workflow.

• CVE-2026-48895HIGH 7.2

  Apache APISIX versions 3.0.0 through 3.16.0 contain an open-redirect vulnerability that allows attackers to manipulate HTTP client headers and redirect users to untrusted websites. This attack could potentially expose session tokens or other sensitive authentication data. The issue affects the API gateway's request handling and requires upgrading to version 3.17.0 or later to remediate.

• CVE-2026-48827HIGH 7.1

  Apache MINA SSHD's sshd-git module contains a path traversal vulnerability that allows SSH-authenticated users to access git repositories and perform git operations (upload-pack, receive-pack, and others) outside the configured git server root directory. An attacker with valid SSH credentials can escape the intended directory boundary and potentially read or modify repositories they should not have access to. This affects only applications explicitly using the sshd-git component; standard SSHD deployments without sshd-git are unaffected.

• CVE-2025-48977MEDIUM 6.5

  Apache Ignite REST API contains a path traversal vulnerability that allows authenticated users to read arbitrary files from the server by manipulating the log path parameter in API commands. An attacker with valid REST API credentials can escape the intended log directory and access sensitive files anywhere on the system. This affects Ignite versions 2.0.0 through 2.17.0, and the vendor has released version 2.18.0 to address it.

• CVE-2026-33582MEDIUM 6.5

  Apache Answer versions through 2.0.0 contain a vulnerability allowing authenticated users to upload specially crafted TIFF image files that trigger excessive memory consumption during processing, causing the server to crash. This is an availability issue that can disrupt service but does not compromise data confidentiality or integrity.

• CVE-2026-34031MEDIUM 6.5

  Apache Answer versions through 2.0.0 contain a vulnerability in how they handle user-supplied image URLs for profile pictures. The application fails to properly validate these URLs, allowing attackers to inject arbitrary external image sources. When users load their profiles or view other users' profiles, their browsers make requests to attacker-controlled servers, enabling tracking, analytics collection, or other reconnaissance activities. This is not a direct data breach, but rather a mechanism for exposing user behavior and session information to external parties.

• CVE-2026-34905MEDIUM 6.5

  Apache Answer versions up to 2.0.0 contain a flaw where unlisted questions—content intended to be hidden from public view—can be discovered and read by any authenticated user through direct API calls. The vulnerability bypasses the access controls meant to keep these questions private, exposing not only the questions themselves but also their answers, comments, and revision history to users who should not have permission to see them.

• CVE-2026-40861MEDIUM 6.5

  CVE-2026-40861 is a path traversal vulnerability in Apache Airflow that allows a DAG (Directed Acyclic Graph) author to read or write arbitrary files on the system when the worker and API server share a log directory. An attacker with DAG authoring privileges can either create symbolic links in their task's log folder to access sensitive files like `/etc/passwd` or `airflow.cfg`, or inject path traversal sequences (`..`) in task IDs to escape the intended log directory. The vulnerability exposes confidential configuration data and could enable file overwrites on the API server's filesystem.

• CVE-2026-42357MEDIUM 6.5

  Apache DolphinScheduler contains an authorization flaw that allows authenticated users to view workflow instance data from projects they should not have access to. An attacker with valid credentials could browse sensitive workflow information across project boundaries, exposing task execution details, logs, and operational data without proper permission checks. The vulnerability requires an existing user account but does not require elevated privileges, making it a significant information disclosure risk in multi-tenant or shared environments.

• CVE-2026-42358MEDIUM 6.5

  Apache Airflow's secret-masking feature, which is supposed to hide sensitive values in Variables when they're accessed through the UI or API, has a flaw that lets authenticated users read plaintext secrets stored in deeply nested JSON structures. The masking tool gives up checking for sensitive key names (like 'password', 'token', 'secret', 'api_key') once it reaches a certain nesting depth, so secrets buried deeper than that limit slip through unmasked. Any user with permission to read Variables can exploit this. This is a follow-up to an earlier fix; that patch addressed shallow nesting, but didn't raise the depth limit itself, leaving the same bypass hole for deeper structures.

• CVE-2026-42360MEDIUM 6.5

  Apache Airflow has a flaw in how it protects sensitive information embedded within complex data structures (like JSON templates). When a workflow template is large enough to exceed Airflow's size limit for storing template data, the system converts it to plain text before masking secrets—a process that loses track of nested sensitive fields like passwords, tokens, and API keys. An authenticated user with access to read stored template fields could then retrieve these unmasked secrets. The issue affects Airflow deployments where workflow authors pass structured data containing nested sensitive values to operators. Even organizations that patched a related vulnerability (CVE-2025-68438) last year need to apply this additional update, as that earlier fix did not address this specific nested-key masking gap.

• CVE-2026-43951MEDIUM 6.5

  Apache HTTP Server contains an out-of-bounds read vulnerability in the mod_headers and mod_mime modules when handling responses with multiple language variants. An unauthenticated attacker on the network can trigger this flaw to read sensitive data from server memory without requiring user interaction or special privileges. The vulnerability affects all versions from 2.4.0 through 2.4.67.

• CVE-2026-45192MEDIUM 6.5

  Apache Airflow's connection API endpoint leaks sensitive credentials that should have been hidden. When a user with permission to read connections retrieves connection details via the REST API, the system fails to redact secrets stored in the connection's extra fields if they don't match known credential field names. This means passwords, API keys, and tokens for services like Slack can be exposed to any authenticated user with basic connection-read access—a permission that's often broadly granted in Airflow deployments.

• CVE-2026-46718MEDIUM 6.5

  Apache Calcite versions 1.5.0 through 1.41 contain a vulnerability that allows attackers to supply malicious input which the application then uses to dynamically load arbitrary Java classes. This unsafe reflection flaw requires only network access and no authentication, enabling remote attackers to potentially execute unintended code or access sensitive data. The vulnerability has been resolved in version 1.42.

• CVE-2026-47340MEDIUM 6.5

  CVE-2026-47340 is a privilege escalation flaw in Apache DolphinScheduler that allows authenticated users to view alert instances they should not have access to. An attacker with valid credentials can bypass permission controls to see alerts associated with alert groups outside their authorization scope. This is a post-authentication issue—the attacker must already have a user account—but it enables unauthorized information disclosure within the system.

• CVE-2026-47341MEDIUM 6.5

  Apache APISIX versions 3.11.0 through 3.16.0 contain an authentication bypass vulnerability in the hmac-auth plugin. Under certain configurations, an attacker can capture and replay authentication tokens indefinitely, circumventing the token expiry mechanism designed to limit credential lifetime. This allows an attacker to maintain unauthorized access to protected APIs without re-authenticating, as long as they possess a valid token.

• CVE-2026-48726MEDIUM 6.5

  Apache Airflow has a logout bypass vulnerability where JWT tokens remain valid after users log out through the web UI. When users click logout, the system fails to properly revoke their authentication tokens in deployments using FAB (Flask-AppBuilder) or Keycloak authentication. An attacker with a stolen or previously-issued JWT can continue making authenticated API calls as that logged-out user until the token naturally expires. This is a follow-up to an earlier fix that patched cookies but missed the JWT revocation paths in these two authentication modules.

• CVE-2026-48828MEDIUM 6.5

  Apache Airflow's Bulk Variables API has a flaw where it bypasses the built-in redaction mechanism when retrieving JSON-formatted variables. Normally, Airflow hides the values of variables with secret-related key names (like `db_password`, `api_token`, or `service_secret`). However, this protection fails for JSON variables accessed through the bulk API because the redactor isn't given the variable's key name to evaluate. An authenticated user with read permissions to bulk variables can therefore extract sensitive data that should have been hidden, even though the variable name itself would normally trigger redaction. The exposure is limited to JSON-typed variables and requires existing access to Airflow's UI or API.

• CVE-2026-48892MEDIUM 6.5

  Apache Airflow's configuration API unintentionally exposed secrets-backend credentials to authenticated users. When administrators configure Airflow to fetch secrets from external systems like HashiCorp Vault, they often use environment variables to specify authentication details (such as role IDs and secret IDs). Due to a masking oversight, these credentials were stored as visible configuration options in the Config API. Any user with permission to read Airflow's configuration through the UI or API could retrieve these plaintext credentials, bypassing the normal secret-redaction mechanism. The vulnerability requires valid Airflow authentication, so it poses an insider threat rather than a publicly exploitable attack vector.

• CVE-2026-49086MEDIUM 6.5

  Apache Camel's DAPR Pub/Sub component has a routing vulnerability that allows an attacker to redirect messages to unintended destinations. When a Camel route consumes messages from one DAPR topic and republishes them to another, a message publisher can craft CloudEvents with manipulated routing headers that override the route's intended destination. This causes messages to be delivered to arbitrary topics or Dapr components instead of where the route was configured to send them, potentially exposing sensitive data or bypassing access controls. The vulnerability requires only the ability to publish to the topic the route subscribes to—no special authentication is needed.

• CVE-2026-49097MEDIUM 6.5

  Apache Camel's IRC component contains a flaw that allows attackers to redirect IRC messages to unintended recipients through HTTP requests. When a web application uses Camel to bridge HTTP traffic into IRC channels, an attacker can inject special HTTP headers that override the intended destination, causing messages to be diverted to attacker-controlled IRC channels or users. This leak can expose sensitive message content or make automated bots appear to send malicious messages on an attacker's behalf. The vulnerability requires an unauthenticated HTTP consumer to function but does not require credentials or specialized attack tools.

• CVE-2026-49296MEDIUM 6.5

  Apache Airflow versions before 3.3.0 contain an authorization bypass that exposes source code of DAGs (Directed Acyclic Graphs) that a user should not be able to see. When a user with permission to view one DAG's source code requests it via the API or web UI, the system returns the entire source file—including all other DAGs stored in that same file—without checking whether the user is authorized to view them. This affects only deployments that store multiple DAGs in a single source file and rely on per-DAG access controls. Organizations with one DAG per file are unaffected.

• CVE-2026-49487MEDIUM 6.5

  Apache Airflow's REST API was exposing secrets in plain text when workers deferred task execution. If you run Airflow and use deferred operators (tasks that pause and resume later), any authenticated user who could view task details could see API keys, credentials, and other sensitive values that operators passed to their trigger functions. This is particularly risky in multi-tenant or team environments where different users manage different DAGs. The issue is fixed in Airflow 3.3.0 and later, which now masks these sensitive values before returning them via the API.

• CVE-2026-49818MEDIUM 6.5

  A path traversal flaw in Apache Airflow's Samba provider allows attackers to write files to unintended locations on Samba file shares. The vulnerability exists in the `GCSToSambaOperator`, which copies objects from Google Cloud Storage to Samba without validating that the destination path remains within the configured boundary. An attacker who can upload files to the source GCS bucket (a common scenario when external data producers have write access) could craft object names using directory traversal sequences like `../` to escape the intended destination and write files anywhere on the target Samba system. This is particularly dangerous in shared data pipelines where the GCS bucket is not exclusively controlled by the DAG author.

• CVE-2026-50630MEDIUM 6.5

  A flaw in Apache CXF's OAuth2 authentication mechanism allows attackers to inject line breaks into HTTP response headers. By crafting a malicious realm parameter, an attacker can trick the server into sending arbitrary headers or fragmenting the response entirely, potentially leading to session hijacking, cache poisoning, or other header-based attacks. The vulnerability affects versions before 4.2.2 and 4.1.7.

• CVE-2026-50634MEDIUM 6.5

  Apache CXF's JwsJsonContainerRequestFilter contains a flaw that allows attackers to bypass signature verification on request metadata. An attacker can send a request with tampered HTTP headers or Content-Type information that the application believes came from a verified signature, but actually did not. This mismatch between what the filter validates and what downstream application code processes can lead to security assumptions being violated, potentially enabling unauthorized data access or modification.

• CVE-2026-55955MEDIUM 6.5

  Apache Tomcat contains an authentication weakness that allows attackers to replay encrypted cluster communications. When multiple Tomcat servers are configured to work together in a cluster, they use encryption to protect inter-server messages. This vulnerability lets an attacker capture and resend those encrypted messages without needing to know the encryption key, potentially gaining unauthorized access or making unauthorized changes. The flaw affects several versions of Tomcat across multiple release branches.

• CVE-2026-55956MEDIUM 6.5

  Apache Tomcat contains a flaw where security rules meant to restrict access to the default servlet don't properly enforce method-based restrictions. An attacker could potentially bypass these access controls by exploiting how the server handles HTTP method filtering, allowing unauthorized access to resources that should be protected. This affects multiple active versions of Tomcat across the 7.x, 8.5.x, 9.x, 10.1.x, and 11.x release lines.

• CVE-2026-44911MEDIUM 6.3

  Apache NiFi versions 1.15.0 through 2.9.0 contain an authorization flaw in how configuration verification requests are handled. Users with only read access to component configurations can submit modified configuration properties that override the current settings, effectively letting them invoke verification methods with alternative parameters they shouldn't be allowed to change. This bypasses the intended separation between who can view configurations and who can modify them. The fix requires upgrading to NiFi 2.10.0, which enforces write access requirements for configuration verification requests.

• CVE-2026-25688MEDIUM 6.1

  Apache Answer versions through 2.0.0 contain a cross-site scripting (XSS) vulnerability in how AI-generated response content is displayed to users. When Answer generates responses using AI, the application fails to properly clean this content before showing it in the browser. This allows an attacker to inject malicious scripts that execute in a user's browser when they view the generated response. The vulnerability requires user interaction (clicking a link or viewing a page with the malicious content) but can affect multiple users if the generated response is shared or cached.

• CVE-2026-25699MEDIUM 6.1

  Apache Answer versions up to 2.0.0 contain an authorization bypass in timeline-related APIs that allows any authenticated user to view content they shouldn't have access to—including deleted items, private submissions, and unapproved materials, along with their full revision history. An attacker with a regular user account can exploit this by directly calling these APIs without needing elevated privileges. The vendor has released version 2.0.1 to address the flaw.

• CVE-2026-29170MEDIUM 6.1

  Apache HTTP Server versions 2.4.67 and earlier contain a cross-site scripting (XSS) vulnerability in the mod_proxy_ftp module. When the server is configured to proxy FTP directory listings—whether forwarding traffic to an upstream FTP server or presenting one via reverse proxy—it fails to properly sanitize HTML generated for directory contents. An attacker can craft malicious FTP directory entries or filenames containing JavaScript code. When an administrator or user views the directory listing in a browser, the malicious script executes in their session, potentially allowing session hijacking, credential theft, or administrative actions.

• CVE-2026-42253MEDIUM 6.1

  Apache ActiveMQ's web console contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious content into HTTP response headers. The flaw exists in how the MessageServlet handles JMS message properties—it copies them directly into HTTP headers without filtering or validation. An attacker who can craft a JMS message with specially crafted properties could inject security headers, potentially leading to session hijacking, credential theft, or malware delivery when a user views the affected web console. The vulnerability requires user interaction (a victim must view the injected content) and affects versions of ActiveMQ and ActiveMQ Web released before 5.19.7 and 6.2.6.

• CVE-2026-44915MEDIUM 6.1

  Apache APISIX contains an open redirect vulnerability in its default CAS authentication configuration. An attacker can craft a malicious link that redirects users to an untrusted website after they authenticate, enabling phishing and credential theft. The vulnerability affects APISIX versions 3.0.0 through 3.16.0, and organizations should upgrade to version 3.17.0 to remediate the issue.

• CVE-2026-50229MEDIUM 6.1

  Apache Tomcat contains a cross-site scripting (XSS) vulnerability in its bundled number-guessing example application. An attacker can inject malicious scripts into web pages served by this example, which execute in the browsers of users who interact with it. This affects multiple Tomcat versions across several release branches. The vulnerability requires user interaction (such as clicking a link) to trigger, and impacts confidentiality and integrity rather than availability.