CVEs we hold for Apache

Records whose assigning authority named Apache as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-97791Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requestsApache CXF

CVE-2026-97720Apache Impala: Impala Executor Webserver Auth BypassApache Impala

CVE-2026-97636Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled keyApache Airflow HashiCorp provider

CVE-2026-97468Apache CXF: Authentication bypass via weak cache keys for validated STS tokensApache CXF

CVE-2026-97395Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled…Apache Polaris

CVE-2026-97146Apache YuniKorn: Admission control bypass via system label forgeryApache YuniKorn

CVE-2026-96990Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size boundApache Thrift

CVE-2026-96806Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints…Apache Airflow Keycloak provider

CVE-2026-96443Apache Doris: JDBC driver URL validation bypass leads to remote code executionApache Doris

CVE-2026-96294Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionApache Thrift

CVE-2026-96292Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)Apache Thrift

CVE-2026-96289Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guardApache Thrift

CVE-2026-96288Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)Apache Thrift

CVE-2026-96287Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call…Apache Thrift

CVE-2026-96286Apache Thrift: Perl servers end `serve()` when serving one connection failsApache Thrift

CVE-2026-96277Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exceptionApache Thrift

CVE-2026-95616Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensionsApache WSS4J

CVE-2026-94658Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)Apache Thrift

CVE-2026-94657Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size boundApache Thrift

CVE-2026-94656Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size boundApache Thrift

CVE-2026-94655Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadraticApache Thrift

CVE-2026-94654Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frameApache Thrift

CVE-2026-94653Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)Apache Thrift

CVE-2026-94652Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling backApache Thrift

CVE-2026-94651Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse errorApache Thrift

CVE-2026-94650Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)Apache Thrift

CVE-2026-94648Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size boundApache Thrift

CVE-2026-94646Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)Apache Thrift

CVE-2026-94645Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop boundApache Thrift

CVE-2026-94644Apache Thrift: PHP `TJSONProtocol` string/number readers have no size boundApache Thrift

CVE-2026-94642Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionApache Thrift

CVE-2026-94639Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection…Apache Thrift

CVE-2026-94638Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`Apache Thrift

CVE-2026-94637Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frameApache Thrift

CVE-2026-94636Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upApache Thrift

CVE-2026-94635Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned nameApache Thrift

CVE-2026-94634Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by defaultApache Thrift

CVE-2026-94633Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name lengthApache Thrift

CVE-2026-94301Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232Apache MINA

CVE-2026-94276Apache APISIX: Openid-connect introspection validation issueApache APISIX

CVE-2026-94269Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatchApache APISIX

CVE-2026-94251Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resourceApache Sling Security Bundle

CVE-2026-94250Apache APISIX: Batch response aggregation can exhaust worker memoryApache APISIX

CVE-2026-94243Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidenceApache Sling Security Bundle

CVE-2026-94220Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth pluginApache APISIX

CVE-2026-94212Apache APISIX: unauthenticated impersonation issue in saml-authApache APISIX

CVE-2026-94135Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultApache Airflow SFTP provider

CVE-2026-94134Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by defaultApache Airflow SFTP provider

CVE-2026-94114Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoningApache Commons BCEL

CVE-2026-94053Apache MINA SSHD: LDAP injection in sshd-ldapApache MINA SSHD

CVE-2026-94052Apache MINA SSHD: LDAP password authentication ineffectiveApache MINA SSHD

CVE-2026-94029Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extensionApache MINA SSHD

CVE-2026-94002Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesApache MINA SSHD

CVE-2026-93996Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line readApache MINA SSHD

CVE-2026-93995Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the serverApache MINA SSHD

CVE-2026-93994Apache MINA SSHD: Repeated-publickey policy bypass on serverApache MINA SSHD

CVE-2026-93926Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error pathApache Thrift

CVE-2026-93925Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol idApache Thrift

CVE-2026-93684Apache Impala: Stored XSS in Impala query plansApache Impala

CVE-2026-93546Apache HTTP Server: mod_dav_fs namespace overflowApache HTTP Server

CVE-2026-92899Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceApache WSS4J

CVE-2026-92834Apache Thrift: C++ WebSocket server transport does not read a full request lengthApache Thrift

CVE-2026-92609Apache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationApache Qpid Broker-J

CVE-2026-92608Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10Apache Qpid Broker-J

CVE-2026-92573Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP…Apache Qpid Broker-J

CVE-2026-92564Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1…Apache Qpid Broker-J

CVE-2026-92560Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10…Apache Qpid Broker-J

CVE-2026-92550Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP…Apache Qpid Broker-J

CVE-2026-92415Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodiesApache Jackrabbit

CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensApache Jackrabbit

CVE-2026-92393Apache YuniKorn: Admission control bypass via workload UPDATE operationApache YuniKorn

CVE-2026-92230Apache Karaf: Improper release of ClassLoader references via static ThreadLocal cachingApache Karaf

CVE-2026-92228Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log readApache Airflow Keycloak provider

CVE-2026-92142Apache Karaf: Authorization bypass in JMX MBean lifecycle operationsApache Karaf

CVE-2026-92121Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceApache WSS4J

CVE-2026-92120Apache Allura: Oauth1 Replay AttackApache Allura

CVE-2026-92119Apache Allura: REST API Mass AssignmentApache Allura

CVE-2026-92116Apache Allura: OAuth1 missing callback validationApache Allura

CVE-2026-92001Apache Sling XSS: Missing parser resource limitsApache Sling XSS

CVE-2026-91999Apache Sling XSS: Improper escaping in the XSS Webconsole pluginApache Sling XSS

CVE-2026-91928Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanismsApache Sling XSS

CVE-2026-91867Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitelyApache Neethi

CVE-2026-91866Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceApache Neethi

CVE-2026-91865Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceApache Neethi

CVE-2026-91864Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionApache Neethi

CVE-2026-91863Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceApache Neethi

CVE-2026-91852Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImplApache Sling XSS

CVE-2026-91206Apache Roller: Reflected XSS in the optional LDAP comment authenticatorApache Roller

CVE-2026-91204Apache Roller: Stored javascript: URI in HTML commentsApache Roller

CVE-2026-91137Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elementsApache Thrift

CVE-2026-91135Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)Apache Thrift

CVE-2026-91085Apache Karaf: config:install missing ACL entry allows privilege escalation to adminApache Karaf

CVE-2026-91048Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code…Apache Karaf

CVE-2026-91012Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege EscalationApache Karaf

CVE-2026-91006Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)Apache Karaf

CVE-2026-90979Apache Karaf: LDAP filter injection in JAAS LDAP login modulesApache Karaf

CVE-2026-90466Apache Impala: Path traversal executes JARs outside trusted pathsApache Impala

CVE-2026-90440Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an…Apache Thrift

CVE-2026-89282CVE-2026-89282Apache Lounge Windows

CVE-2026-89281CVE-2026-89281Apache Lounge Windows

CVE-2026-89238Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionApache WSS4J

CVE-2026-88920Apache WSS4J: SAML Sender-Vouches Authentication BypassApache WSS4J

CVE-2026-88789Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardeningApache Camel Quarkus

CVE-2026-87976Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension BundlesApache NiFi Registry

CVE-2026-87830Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.Apache WSS4J

CVE-2026-87802Apache Syncope: SRA OAuth2 JWT signature verification bypassApache Syncope

CVE-2026-87785Apache Syncope: JWT subject spoofingApache Syncope

CVE-2026-87779Apache Syncope: AES Secret Key disclosure via log outputApache Syncope

CVE-2026-87117Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element specApache Thrift

CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflateApache Tomcat

CVE-2026-86843Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example DagApache Airflow Teradata provider

CVE-2026-86792Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection…Apache Kafka provider

CVE-2026-86537Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to…Apache Thrift

CVE-2026-86536Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in…Apache Thrift

CVE-2026-86535Apache Thrift: A JSON member name can stall the Node server's event loop indefinitelyApache Thrift

CVE-2026-86507Apache Roller: Stored XSS in comment moderation via comment author URLApache Roller

CVE-2026-86473Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryApache Airflow

CVE-2026-86466Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedApache Airflow FAB provider

CVE-2026-86465Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled keyApache Airflow Akeyless provider

CVE-2026-86463Apache CXF: FIQL Query Parser Denial of ServiceApache CXF

CVE-2026-86462Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsApache Airflow FAB provider

CVE-2026-86460Apache Syncope: Cypher Injection via FIQL Search on Neo4j PersistenceApache Syncope

CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upApache Tomcat

CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is…Apache Tomcat

CVE-2026-86247Apache Tomcat Native: Client certificate requirements can be down-gradedApache Tomcat Native

CVE-2026-86246Apache Tomcat Native: Insecure OpenSSL options enabledApache Tomcat Native

CVE-2026-86243Apache Tomcat Native: DoS via TLS handshakeApache Tomcat Native

CVE-2026-86089Apache NiFi: Missing Process Group Authorization for Connector MigrationApache NiFi

CVE-2026-85532Apache WSS4J: Insufficient Validation of Derived-Key ParametersApache WSS4J

CVE-2026-85499Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxyApache SkyWalking BanyanDB

CVE-2026-85494Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…Apache Thrift

CVE-2026-85493Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java…Apache Thrift

CVE-2026-85483Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream endApache Thrift

CVE-2026-85476Apache Thrift: c_glib `read_all` spins when the underlying read returns 0Apache Thrift

CVE-2026-85229Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)Apache SkyWalking

CVE-2026-85088Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName…Apache Thrift

CVE-2026-85087Apache Thrift: Python ≥3.12 host-name check silently becomes a no-opApache Thrift

CVE-2026-85086Apache Thrift: Perl TLS client disables certificate verification by defaultApache Thrift

CVE-2026-84939Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacksApache FreeMarker

CVE-2026-84501Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProviderApache ZooKeeper

CVE-2026-84439Apache ZooKeeper: Audit log injection via unsanitized output from multiple sourcesApache ZooKeeper

CVE-2026-84179Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology PageApache Storm UI

CVE-2026-83745Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the…Apache Thrift

CVE-2026-83663Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)Apache Thrift

CVE-2026-83632Apache Thrift: C++ THttpTransport grows its line buffer without boundApache Thrift

CVE-2026-82806Apache APISIX: cross-request permission pollution via static permission list mutationApache APISIX

CVE-2026-82804Apache DolphinScheduler: Command Injection in the Alert Script PluginApache DolphinScheduler

CVE-2026-82617Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsApache OpenNLP

CVE-2026-82561Apache NiFi: Missing Authorization for Components Referenced in Flow Update MethodsApache NiFi

CVE-2026-82546Apache Roller: Stored cross-site scripting through incoming Trackback linksApache Roller

CVE-2026-82459Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit…Apache Thrift

CVE-2026-82458Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…Apache Thrift

CVE-2026-82441Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency KeysApache Storm Nimbus

CVE-2026-82439Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPCApache Storm DRPC

CVE-2026-82438Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web OriginsApache Storm Webapp

CVE-2026-82437Apache Storm Logviewer: Log Access Controls Not Enforced by LogviewerApache Storm Logviewer

CVE-2026-82435Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderApache Storm Worker

CVE-2026-82434Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to LogsApache Storm Client

CVE-2026-82433Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UIApache Storm UI

CVE-2026-82432Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration OverridesApache Storm Nimbus

CVE-2026-82431Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.usersApache Storm Client

CVE-2026-82430Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the TenantApache Storm Worker Launcher

CVE-2026-82429Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker LauncherApache Storm Worker Launcher

CVE-2026-82428Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob KeysApache Storm Client

CVE-2026-82427Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local NameApache Storm Nimbus

CVE-2026-82426Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar LocationApache Storm Nimbus

CVE-2026-82387Apache Roller: Stored cross-site scripting via uploaded media content typeApache Roller

CVE-2026-82386Apache Roller: XML external entity processing in OPML bookmark importApache Roller

CVE-2026-82385Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath filesApache Roller

CVE-2026-82384Apache Roller: Unauthenticated deserialization in the XML-RPC endpointApache Roller

CVE-2026-82383Apache Roller: Anonymous setup action allows frontpage configuration tamperingApache Roller

CVE-2026-82382Apache Roller: Reflected cross-site scripting in the frontpage directory parameterApache Roller

CVE-2026-82381Apache Roller: Stored cross-site scripting in the authoring UIApache Roller

CVE-2026-82380Apache Roller: CSRF protection bypass via self-generated salt validationApache Roller

CVE-2026-82379Apache Roller: WSSE digest authentication headers can be replayedApache Roller

CVE-2026-82378Apache Roller: OAuth authorization endpoint trusts request-supplied identityApache Roller

CVE-2026-82377Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlersApache Roller

CVE-2026-82376Apache Roller: XML external entity processing in trackback response parserApache Roller

CVE-2026-82375Apache Roller: Server-side request forgery via entry trackback and enclosure URLsApache Roller

CVE-2026-82355Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixationApache Airflow

CVE-2026-82348Apache Roller: Cross-weblog resource tampering via unscoped authoring lookupsApache Roller

CVE-2026-82331Apache BuildStream: tar source extraction escapeApache BuildStream

CVE-2026-82311Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always…Apache Airflow FAB provider

CVE-2026-82310Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessApache Airflow FAB provider

CVE-2026-82232Apache Syncope: SQL injection via sort parameter in Task searchApache Syncope

CVE-2026-81930Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domainApache Airflow Snowflake provider

CVE-2026-81914Apache Airflow Google provider: Google Drive query injection via unescaped file and folder namesApache Airflow Google provider

CVE-2026-81866Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector ConfigurationApache NiFi

CVE-2026-81862Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs…Apache Airflow Teradata provider

CVE-2026-81569Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow ExecutionApache DolphinScheduler

CVE-2026-81270Apache Allura: Information exposure via searchApache Allura

CVE-2026-80354Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespaceApache Camel K

CVE-2026-80352Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objectsApache Camel K

CVE-2026-80351Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator podApache Camel K

CVE-2026-80190Apache Allura: Stored XSS via code repositoriesApache Allura

CVE-2026-80181Apache Allura: Server-side request forgeryApache Allura

CVE-2026-80180Apache Allura: Stored XSS via markdown HTML processingApache Allura

CVE-2026-79993Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty…Apache ZooKeeper

CVE-2026-79768Apache HTTP Server: mod_userdir information disclosureApache HTTP Server

CVE-2026-79677Apache Tomcat: WebSocket DoS due to lost asynchronous write timeoutApache Tomcat

200 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.