apache vulnerabilities

Products

• Apache HTTP Server 352
• tomcat 271
• airflow 159
• Apache Tomcat 146
• traffic server 120
• camel 117
• Apache Traffic Server 111
• Apache OFBiz 101
• ofbiz 101
• struts 98
• cxf 79
• activemq 75
• openoffice 72
• superset 70
• Apache Superset 65
• cloudstack 65
• nifi 59
• Apache Airflow 56
• Apache CloudStack 51
• Apache Thrift 49
• github.com/apache/thrift 47
• solr 47
• subversion 47
• Apache InLong 42
• inlong 42
• apache/brpc 41
• Apache Roller 40
• Apache Kylin 39
• hadoop 37
• Apache NiFi 35

Latest apache CVEs

Newest publication first · page 2 of 40 · showing the latest 1,000

1. CVE-2026-74756 Apache James: WebAdmin exposed without authentication on official Docker default

   Published 2026-11-06

   Critical·CVSS 9.1 EPSS 0.39%

   Some docker-compose shipped by the project exposes by default Webadmin REST API publically without proper authentication setup. Version 3.9.1 onward sets a random credential by default on unprotected webadmin endpoints to prevent this while retain convenience.

2. CVE-2026-76171 Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

   Published 2026-11-06

   Critical·CVSS 9.1 EPSS 0.37%

   In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue.

3. CVE-2026-49939 Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol

   Published 2026-11-06

   High·CVSS 7.5 EPSS 0.36%

   In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly...

4. CVE-2025-66621 Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

   Published 2026-11-06

   Unknown EPSS 0.14%

   Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend u...

5. CVE-2026-66903 Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

   Published 2026-11-05

   Medium·CVSS 6.5 EPSS 0.44%

   Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

6. CVE-2026-71901 Apache OFBiz: Dispatch arbitrary internal services on SFA component

   Published 2026-11-05

   High·CVSS 8.1 EPSS 0.39%

   Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users ar...

7. CVE-2026-68524 Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.43%

   An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. The described vulnerability was discovered independantly twice, with each having a CVE assign...

8. CVE-2026-73577 Apache OFBiz: Unauthenticated path-suffix view authorization bypass

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.59%

   Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/List...

9. CVE-2026-73578 Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.62%

   Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LAST_VIEW_NAME value, which is...

10. CVE-2026-73580 Apache OFBiz: Unauthenticated HR organization and employee disclosure

    Published 2026-11-05

    Medium·CVSS 5.3 EPSS 0.39%

    Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment positio...

11. CVE-2026-74841 Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode

    Published 2026-11-05

    Critical·CVSS 9.1 EPSS 0.52%

    In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is a...

12. CVE-2026-76150 Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage

    Published 2026-11-05

    Medium·CVSS 6.5 EPSS 0.35%

    Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-e...

13. CVE-2026-81734 Apache OFBiz: Missing authorization - catalog quick-admin product writes

    Published 2026-11-05

    Medium·CVSS 6.5 EPSS 0.39%

    Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association...

14. CVE-2026-76152 Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services

    Published 2026-11-05

    Medium·CVSS 6.5 EPSS 0.50%

    Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz proces...

15. CVE-2026-81744 Apache OFBiz: Authorization bypass - self-grant content OWNER

    Published 2026-11-05

    Medium·CVSS 6.5 EPSS 0.29%

    Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole...

16. CVE-2026-81808 Apache OFBiz: Missing authorization - search-result bulk catalog mutation

    Published 2026-11-05

    Medium·CVSS 6.5 EPSS 0.39%

    Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a br...

17. CVE-2026-81815 Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

    Published 2026-11-05

    Critical·CVSS 9.8 EPSS 0.61%

    SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _...

18. CVE-2026-81816 Apache OFBiz: XML external entity injection (XXE)

    Published 2026-11-05

    Low·CVSS 3.5 EPSS 0.31%

    XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xm...

19. CVE-2026-81828 Apache OFBiz: Server-side request forgery in SurveyWrapper

    Published 2026-11-05

    High·CVSS 8.1 EPSS 0.36%

    Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata...

20. CVE-2026-82894 Apache OFBiz: Content renderer runs a service name stored on the row

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.50%

    Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, a...

21. CVE-2026-82902 Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile

    Published 2026-11-05

    Medium·CVSS 4.3 EPSS 0.54%

    Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and a...

22. CVE-2026-82904 Apache OFBiz: Unbounded multi-form row count from a parameter name

    Published 2026-11-05

    High·CVSS 7.5 EPSS 0.69%

    Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer m...

23. CVE-2026-82907 Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

    Published 2026-11-05

    Critical·CVSS 9.8 EPSS 0.87%

    Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issue...

24. CVE-2026-82910 Apache OFBiz: renderLink compiles link parameters as FreeMarker source

    Published 2026-11-05

    High·CVSS 8.8 EPSS 0.80%

    Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet...

25. CVE-2026-82912 Apache OFBiz: Unsandboxed Groovy compiled from a service parameter

    Published 2026-11-05

    High·CVSS 8.8 EPSS 0.83%

    Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.