Apache · weakness class
Cross-Site Request Forgery
33 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 2
Every one of the 33 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache JSPWiki CSRF in UserPreferences.jsp
- Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
- Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces
- In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
- Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been foun…
- A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
- In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked w…
- User Group Privilege Escalation
- Apache JSPWiki CSRF Account Takeover
- Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted,…
- Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been foun…
- Apache Airflow: Missing CSRF protection on DAG/trigger
- Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva si…
- Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only…
- Apache Wicket: Possible bypass of CSRF protection
- Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
- Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
- Apache CloudStack: Request origin validation bypass makes account takeover possible
- Apache Zeppelin: CSRF vulnerability in the Credentials page
- Apache Roller: Weakness in CSRF protection allows privilege escalation
- Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager
- Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
- Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system
- Apache APISIX: cas-auth login CSRF / session injection issue
- Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
- Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.