Known Vulnerabilities for Apache HTTP Server by Apache Software Foundation
Listed below are 10 of the newest known vulnerabilities associated with "Apache HTTP Server" by "Apache Software Foundation".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-107938 json | In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname i... | Not Provided | 2026-10-09 | 2026-10-15 |
| CVE-2026-107460 json | Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0... | Not Provided | 2026-10-13 | 2026-10-20 |
| CVE-2026-105299 json | Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_req... | Not Provided | 2026-10-20 | 2026-10-20 |
| CVE-2026-100717 json | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and l... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-100669 json | Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In we... | Not Provided | 2026-09-26 | 2026-09-30 |
| CVE-2026-93546 json | Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access t... | Not Provided | 2026-10-01 | 2026-10-01 |
| CVE-2026-92142 json | Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on ... | Not Provided | 2026-09-29 | 2026-10-01 |
| CVE-2026-90937 json | froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customer... | Not Provided | 2026-09-14 | 2026-09-16 |
| CVE-2026-89282 json | The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vu... | Not Provided | 2026-09-22 | 2026-09-23 |
| CVE-2026-89281 json | The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability with... | Not Provided | 2026-09-22 | 2026-09-23 |