Login Request a demo
AS
Vendor
Apache Software Foundation
278 products with CVEs on record
1,418
CVEs
12
On KEV
347
New 30D
Products
AT
Apache Thrift
Apache Software Foundation
9.8
86 CVEs0 on KEV61 new
AC
Apache Camel
Apache Software Foundation
10.0
86 CVEs0 on KEV46 new
AB
Apache bRPC
Apache Software Foundation
9.8
38 CVEs0 on KEV35 new
AK
Apache Kylin
Apache Software Foundation
9.8
30 CVEs0 on KEV21 new
AT
Apache Traffic Server
Apache Software Foundation
10.0
71 CVEs0 on KEV16 new
AP
Apache Pulsar
Apache Software Foundation
9.2
15 CVEs0 on KEV14 new
AA
Apache Answer
Apache Software Foundation
9.8
28 CVEs0 on KEV13 new
AD
Apache DolphinScheduler
Apache Software Foundation
9.8
27 CVEs0 on KEV13 new
AK
Apache Kafka
Apache Software Foundation
9.1
18 CVEs0 on KEV12 new
AC
Apache CXF
Apache Software Foundation
9.8
40 CVEs0 on KEV11 new
AM
Apache MINA SSHD
Apache Software Foundation
9.1
13 CVEs0 on KEV8 new
AA
Apache APISIX
Apache Software Foundation
9.8
29 CVEs1 on KEV7 new
AW
Apache WSS4J
Apache Software Foundation
9.8
7 CVEs0 on KEV7 new
AC
Apache CouchDB
Apache Software Foundation
9.8
8 CVEs1 on KEV6 new
AD
Apache Directory LDAP API
Apache Software Foundation
9.8
7 CVEs0 on KEV6 new
AD
Apache DataSketches
Apache Software Foundation
9.8
5 CVEs0 on KEV5 new
AK
Apache Karaf
Apache Software Foundation
9.8
8 CVEs0 on KEV4 new
AL
Apache log4net
Apache Software Foundation
5.3
6 CVEs0 on KEV6 new
AP
Apache PLC4X
Apache Software Foundation
9.2
4 CVEs0 on KEV4 new
AI
Apache IoTDB
Apache Software Foundation
9.8
23 CVEs0 on KEV3 new
AA
Apache Allura
Apache Software Foundation
9.8
13 CVEs0 on KEV3 new
AI
Apache Impala
Apache Software Foundation
9.8
7 CVEs0 on KEV3 new
AC
Apache Cocoon
Apache Software Foundation
7.5
5 CVEs0 on KEV4 new
AA
Apache Airflow Keycloak provider
Apache Software Foundation
9.8
4 CVEs0 on KEV2 new
AA
Apache Airflow SFTP provider
Apache Software Foundation
9.1
3 CVEs0 on KEV2 new
AJ
Apache Jackrabbit
Apache Software Foundation
9.1
3 CVEs0 on KEV2 new
AA
Apache Airflow SSH provider
Apache Software Foundation
9.1
2 CVEs0 on KEV2 new
AP
Apache Polaris
Apache Software Foundation
9.9
6 CVEs0 on KEV1 new
AX
Apache XMLSchema
Apache Software Foundation
7.5
3 CVEs0 on KEV3 new
AY
Apache YuniKorn
Apache Software Foundation
4.8
3 CVEs0 on KEV3 new
AF
Apache Fesod (Incubating)
Apache Software Foundation
9.1
2 CVEs0 on KEV1 new
AJ
Apache Johnzon
Apache Software Foundation
9.8
1 CVEs0 on KEV1 new
AP
Apache Pulsar Manager
Apache Software Foundation
10.0
1 CVEs0 on KEV1 new
AS
Apache SkyWalking BanyanDB
Apache Software Foundation
9.1
1 CVEs0 on KEV1 new
AS
Apache SIS
Apache Software Foundation
6.5
3 CVEs0 on KEV2 new
AA
Apache Airflow Teradata provider
Apache Software Foundation
6.5
2 CVEs0 on KEV2 new
AC
Apache Camel Karavan
Apache Software Foundation
8.8
2 CVEs0 on KEV2 new
AC
Apache Commons BCEL
Apache Software Foundation
5.9
2 CVEs0 on KEV2 new
AV
Apache Vysper
Apache Software Foundation
8.8
2 CVEs0 on KEV2 new
AO
Apache OpenOffice
Apache Software Foundation
8.8
9 CVEs0 on KEV1 new
AA
Apache Airflow Google provider
Apache Software Foundation
8.1
4 CVEs0 on KEV1 new
AG
Apache Geode
Apache Software Foundation
8.8
4 CVEs0 on KEV1 new
AA
Apache Airflow Amazon provider
Apache Software Foundation
6.5
3 CVEs0 on KEV1 new
AI
Apache IoTDB JDBC driver
Apache Software Foundation
7.5
2 CVEs0 on KEV1 new
AA
Apache Abdera
Apache Software Foundation
7.5
1 CVEs0 on KEV1 new
AA
Apache Airflow Snowflake provider
Apache Software Foundation
6.3
1 CVEs0 on KEV1 new
AA
Apache Arrow C++
Apache Software Foundation
–
1 CVEs0 on KEV1 new
AC
Apache Camel Quarkus
Apache Software Foundation
8.6
1 CVEs0 on KEV1 new
PY
PyArrow
Apache Software Foundation
–
1 CVEs0 on KEV1 new
AA
Apache Airflow
Apache Software Foundation
9.8
81 CVEs1 on KEV0 new
AA
Apache ActiveMQ All
Apache Software Foundation
8.8
20 CVEs1 on KEV0 new
AA
Apache ActiveMQ Broker
Apache Software Foundation
8.8
15 CVEs1 on KEV0 new
AS
Apache Superset
Apache Software Foundation
9.8
14 CVEs1 on KEV0 new
AS
Apache Spark
Apache Software Foundation
8.8
8 CVEs1 on KEV0 new
AH
Apache HugeGraph-Server
Apache Software Foundation
9.8
3 CVEs1 on KEV0 new
AF
Apache Flink
Apache Software Foundation
8.1
2 CVEs1 on KEV0 new
AA
Apache ActiveMQ Legacy OpenWire Module
Apache Software Foundation
9.8
1 CVEs1 on KEV0 new
AL
Apache Log4j2
Apache Software Foundation
10.0
1 CVEs1 on KEV0 new
AR
Apache RocketMQ
Apache Software Foundation
9.8
1 CVEs1 on KEV0 new
AC
Apache CloudStack
Apache Software Foundation
9.1
34 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-114349
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
CVE-2026-112375
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
CVE-2026-116593
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
CVE-2026-115644
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
CVE-2026-111551
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
CVE-2026-111496
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
CVE-2026-111115
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
CVE-2026-111108
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
CVE-2026-111073
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
CVE-2026-110985
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
CVE-2026-110952
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
CVE-2026-83525
New
AK
Apache Kafka
Apache Software Foundation
––Oct 28Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
CVE-2026-111422
New
AA
Apache Airflow SSH provider
Apache Software Foundation
–
0%
Oct 26Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
CVE-2026-115748
New
AV
Apache Vysper
Apache Software Foundation
8.8
1%
Oct 26Apache Vysper: Authorization bypass
CVE-2026-115721
New
AV
Apache Vysper
Apache Software Foundation
7.5
0%
Oct 26Apache Vysper: Unbounded allocation
CVE-2026-90885
New
AC
Apache Camel
Apache Software Foundation
7.5
1%
Oct 26Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
CVE-2026-94386
New
AC
Apache Camel
Apache Software Foundation
4.8
0%
Oct 26Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
CVE-2026-110748
New
AS
Apache SIS
Apache Software Foundation
–
0%
Oct 26Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
CVE-2026-110733
New
AS
Apache SIS
Apache Software Foundation
5.4
0%
Oct 26Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
CVE-2026-95628
New
AC
Apache Camel
Apache Software Foundation
5.4
0%
Oct 26Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
CVE-2026-95629
New
AC
Apache Camel
Apache Software Foundation
5.4
0%
Oct 26Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
CVE-2026-95663
New
AC
Apache Camel
Apache Software Foundation
4.8
0%
Oct 26Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
CVE-2026-95664
New
AC
Apache Camel
Apache Software Foundation
5.4
0%
Oct 26Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-101259
New
AC
Apache Camel
Apache Software Foundation
5.3
0%
Oct 26Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-113582
New
AA
Apache Abdera
Apache Software Foundation
7.5
0%
Oct 22Apache Abdera: XML external entity expansion in Atom document parsing
CVE-2026-103634
AD
Apache DataSketches
Apache Software Foundation
5.3
0%
Oct 22Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
CVE-2026-112381
AT
Apache Traffic Server
Apache Software Foundation
5.9
0%
Oct 21Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
CVE-2026-111817
AT
Apache Traffic Server
Apache Software Foundation
5.3
0%
Oct 21Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
CVE-2026-111812
AT
Apache Traffic Server
Apache Software Foundation
10.0
0%
Oct 21Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
CVE-2026-111811
AT
Apache Traffic Server
Apache Software Foundation
9.0
0%
Oct 21Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
CVE-2026-111809
AT
Apache Traffic Server
Apache Software Foundation
9.3
0%
Oct 21Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
CVE-2026-111810
AT
Apache Traffic Server
Apache Software Foundation
7.5
0%
Oct 21Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
CVE-2026-111815
AT
Apache Traffic Server
Apache Software Foundation
10.0
0%
Oct 21Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
CVE-2026-111814
AT
Apache Traffic Server
Apache Software Foundation
10.0
0%
Oct 21Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
CVE-2026-111808
AT
Apache Traffic Server
Apache Software Foundation
8.6
0%
Oct 21Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
CVE-2026-111805
AT
Apache Traffic Server
Apache Software Foundation
8.6
0%
Oct 21Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
CVE-2026-111816
AT
Apache Traffic Server
Apache Software Foundation
9.3
0%
Oct 21Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
CVE-2025-55702
AT
Apache Traffic Server
Apache Software Foundation
8.7
0%
Oct 21Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
CVE-2025-31699
AT
Apache Traffic Server
Apache Software Foundation
8.9
0%
Oct 21Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
CVE-2026-111804
AT
Apache Traffic Server
Apache Software Foundation
8.2
0%
Oct 21Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
CVE-2026-111813
AT
Apache Traffic Server
Apache Software Foundation
10.0
0%
Oct 21Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
CVE-2026-105945
AP
Apache Pulsar
Apache Software Foundation
7.7
0%
Oct 21Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
CVE-2026-105944
AP
Apache Pulsar Manager
Apache Software Foundation
10.0
1%
Oct 21Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
CVE-2026-105942
AP
Apache Pulsar
Apache Software Foundation
7.7
0%
Oct 21Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
CVE-2026-105938
AP
Apache Pulsar
Apache Software Foundation
2.3
1%
Oct 21Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
CVE-2026-105937
AP
Apache Pulsar
Apache Software Foundation
8.7
0%
Oct 21Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
CVE-2026-105936
AP
Apache Pulsar
Apache Software Foundation
5.3
1%
Oct 21Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
CVE-2026-105935
AP
Apache Pulsar
Apache Software Foundation
4.9
0%
Oct 21Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
CVE-2026-105934
AP
Apache Pulsar
Apache Software Foundation
7.2
0%
Oct 21Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
CVE-2026-105933
AP
Apache Pulsar
Apache Software Foundation
2.3
0%
Oct 21Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
CVE-2026-105932
AP
Apache Pulsar
Apache Software Foundation
2.3
1%
Oct 21Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
CVE-2026-105931
AP
Apache Pulsar
Apache Software Foundation
2.3
1%
Oct 21Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
CVE-2026-105930
AP
Apache Pulsar
Apache Software Foundation
6.0
0%
Oct 21Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
CVE-2026-105927
AP
Apache Pulsar
Apache Software Foundation
2.3
0%
Oct 21Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
CVE-2026-105926
AP
Apache Pulsar
Apache Software Foundation
5.3
0%
Oct 21Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
CVE-2026-105869
AP
Apache Pulsar
Apache Software Foundation
9.2
0%
Oct 21Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
CVE-2026-90484
AB
Apache bRPC
Apache Software Foundation
6.5
0%
Oct 21Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
CVE-2026-87849
AB
Apache bRPC
Apache Software Foundation
4.3
0%
Oct 21Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
CVE-2026-86249
AB
Apache bRPC
Apache Software Foundation
–
0%
Oct 21Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
CVE-2026-86147
AB
Apache bRPC
Apache Software Foundation
–
0%
Oct 21Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof