Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,827

Export CSV
CVE-2026-43871

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-61372

Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Jena Fuseki
CVE-2026-48145

Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-66713

Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat  (only when Tribes clustering is enabled, which is off by default) allows an  unauthenticated remote attacker with network access to the clustering port to  execute arbitrary code via a crafted serialized Java object delivered to the cluster  channel and deserialized in  org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. Users are  recommended to upgrade to version 2.0.1, which fixes this issue by removing the  clustering feature entirely.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Apache
Products
Apache Axis2/java Axis2\/java
CVE-2026-66299

Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Tomcat
CVE-2026-52680

Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. This issue affects Apache Kyuubi: from 1.7.0 through 1.11.1. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Apache
Products
Kyuubi
CVE-2026-28814

Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Jspwiki
CVE-2026-28811

Apache JSPWiki: Error Handling - Reveals Error Details

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Jspwiki
CVE-2026-62391

Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Kyuubi
CVE-2026-28812

Apache JSPWiki: UserManager does not sanity-check user database at startup

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Jspwiki
CVE-2026-28813

Apache JSPWiki: JSPWiki vulnerable to JSON hijacking

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Jspwiki
CVE-2026-66755

Apache Tika: Arbitrary Local File Read in ISArchiveParser

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab investigation file that traverses outside the dataset directory. Users are recommended to upgrade to version 3.3.2 or 4.0.0-beta-1, which fixes this issue.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Tika
CVE-2026-66756

Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Tika
CVE-2026-63071

Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Syncope
CVE-2026-55971

Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Thrift
CVE-2026-59243

Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role (CWE-347). Deployments running the FAB auth manager with the Azure AD OAuth login path under its default configuration are affected; the Authentik path already defaulted to `True`. This issue affects `apache-airflow-providers-fab` before 3.7.3. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.3, which defaults `verify_signature=True`.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Airflow Fab Provider Apache-airflow-providers-fab
CVE-2026-54399

Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Httpcomponents Core
CVE-2026-54428

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Httpcomponents Core
CVE-2026-47898

Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

CVSS 4.0 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Lucene.net
CVE-2026-47897

Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Lucene.net