Known Vulnerabilities for products from Apache
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Apache".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-73649 json | Not Provided | 2026-08-13 | 2026-08-14 | |
| CVE-2026-73635 json | Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the ... | Not Provided | 2026-08-15 | 2026-08-18 |
| CVE-2026-73634 json | Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content ... | Not Provided | 2026-08-15 | 2026-08-18 |
| CVE-2026-73633 json | Not Provided | 2026-08-14 | 2026-08-14 | |
| CVE-2026-73632 json | Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state... | Not Provided | 2026-08-15 | 2026-08-18 |
| CVE-2026-73631 json | Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could ... | Not Provided | 2026-08-15 | 2026-08-18 |
| CVE-2026-73240 json | Not Provided | 2026-08-12 | 2026-08-13 | |
| CVE-2026-73239 json | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This... | Not Provided | 2026-08-12 | 2026-08-17 |
| CVE-2026-73238 json | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended ... | Not Provided | 2026-08-12 | 2026-08-17 |
| CVE-2026-73237 json | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users... | Not Provided | 2026-08-12 | 2026-08-17 |
| CVE-2026-71560 json | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0... | Not Provided | 2026-08-07 | 2026-08-08 |
| CVE-2026-71559 json | Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial ... | Not Provided | 2026-08-07 | 2026-08-08 |
| CVE-2026-71558 json | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.... | Not Provided | 2026-08-07 | 2026-08-08 |
| CVE-2026-71290 json | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BU... | Not Provided | 2026-08-11 | 2026-08-17 |
| CVE-2026-69223 json | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.1... | Not Provided | 2026-08-11 | 2026-08-17 |
| CVE-2026-68981 json | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filt... | Not Provided | 2026-08-03 | 2026-08-05 |
| CVE-2026-68980 json | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through th... | Not Provided | 2026-08-03 | 2026-08-05 |
| CVE-2026-68979 json | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization chec... | Not Provided | 2026-08-03 | 2026-08-05 |
| CVE-2026-68971 json | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `... | Not Provided | 2026-08-12 | 2026-08-13 |
| CVE-2026-68970 json | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape... | Not Provided | 2026-08-12 | 2026-08-14 |
Known software with vulnerabilities from Apache
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Apache | Accumulo | 1.10.0 |
| Application | Apache | Activemq | - |
| Application | Apache | Activemq Apollo | 1.0 |
| Application | Apache | Activemq Artemis | - |
| Application | Apache | Airflow | 0.1 |
| Application | Apache | Allura | 1.0.0 |
| Application | Apache | Ambari | 0.9 |
| Application | Apache | Amqp 0-x Jms Client | 6.0.3 |
| Application | Apache | Amqp Jms Client | 0.9.0 |
| Application | Apache | Ant | 1.1 |
| Application | Apache | Apache-ssl | 1.37 |
| Application | Apache | Apache Test | - |
| Application | Apache | Apisix | 1.2 |
| Application | Apache | Apr-util | 0.9.1 |
| Application | Apache | Archiva | 0.9 |
| Application | Apache | Arrow | 0.1.0 |
| Application | Apache | Asterixdb | - |
| Application | Apache | Atlas | 0.5.0 |
| Application | Apache | Axis | - |
| Application | Apache | Axis2 | - |