CyberSIXT Search
Vendor

Apache

CVEs tracked · all time
199
in CISA KEV · all time
5
articles · since 11 Sep
34
articles · all time
87

34 articles since 11 Sep; 1 CISA notice, marked below the bars.

Show as table
Apache: articles per day
Day (UTC)Articles
Fri 11 Sep1
Mon 14 Sep1
Wed 16 Sep2
Thu 17 Sep1
Wed 23 Sep2
Fri 25 Sep1
Tue 29 Sep1
Wed 30 Sep1
Thu 1 Oct2
Fri 2 Oct1
Sat 3 Oct1
Mon 5 Oct2
Tue 6 Oct2
Wed 7 Oct1
Thu 8 Oct3
Fri 9 Oct3
Sun 11 Oct1
Mon 19 Oct1
Wed 21 Oct3
Thu 22 Oct3
Fri 23 Oct1
See the full timeline
Products: ActiveMQ, Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ AMQP and 52 more
ActiveMQApache ActiveMQApache ActiveMQ AllApache ActiveMQ AMQPApache ActiveMQ BrokerApache ActiveMQ WebApache AirflowApache Airflow Keycloak providerApache Airflow SFTP providerApache Airflow SSH providerApache AlluraApache AnswerApache APISIXApache bRPCApache Camel KApache Camel KaravanApache CloudStackApache CocoonApache CouchDBApache CXFApache Directory LDAP APIApache DorisApache Doris MCP ServerApache EChartsApache Fesod (Incubating)Apache FineractApache ForyApache HTTP ServerApache HttpComponents ClientApache HttpComponents CoreApache IgniteApache InLongApache IoTDBApache JackrabbitApache KvrocksApache KylinApache Log4j APIApache MINAApache MINA SSHDApache NiFiApache OpenOfficeApache PLC4XApache PulsarApache Pulsar ManagerApache Qpid Broker-JApache ShiroApache SolrApache StrutsApache SyncopeApache ThriftApache TomcatApache Traffic ServerApache WSS4JCordova Plugin InAppBrowserStrutsTomcat

CVEs

199 CVEs, the 40 listed known exploited first
CVE-2016-3081Apache Struts Command Injection VulnerabilityCVSS8.1HighExploited96%EPSS5articles
CVE-2017-5638Apache Struts Remote Code Execution VulnerabilityCVSS9.8CriticalExploited99.9%EPSS1article
CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityCVSS9.8CriticalExploited99%EPSS7articles
CVE-2026-34197Apache ActiveMQ Improper Input Validation VulnerabilityCVSS8.8HighExploited15%EPSS2articles
CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityCVSS10.0CriticalExploited99.8%EPSS1article
CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteCVSS9.8Critical–Not in KEV0.6%EPSS2articles
CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsCVSS9.1Critical–Not in KEV0.5%EPSS2articles
CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintCVSS9.1Critical–Not in KEV0.5%EPSS2articles
CVE-2026-77185Apache MINA SSHD: Asynchronous authentication can bypass signature verificationCVSS9.1Critical–Not in KEV0.5%EPSS1article
CVE-2026-86147Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprofCVSSUnrated–Not in KEV0.2%EPSS1article
CVE-2026-86146Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header ParsingCVSSUnrated–Not in KEV0.2%EPSS1article
CVE-2026-84747Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path SegmentsCVSSUnrated–Not in KEV0.2%EPSS1article
28 more CVEs
CVE-2026-78334Apache bRPC: Missing Authentication for Streaming RPC FramesCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-86249Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-48830Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-111813Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationCVSS10.0Critical–Not in KEV0.5%EPSS1article
CVE-2026-111811Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authenticationCVSS9.4Critical–Not in KEV0.4%EPSS0articles
CVE-2026-105944Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeCVSS10.0Critical–Not in KEV0.7%EPSS1article
CVE-2026-105869Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleCVSS9.2Critical–Not in KEV0.3%EPSS1article
CVE-2026-105937Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataCVSS8.7High–Not in KEV0.2%EPSS1article
CVE-2026-105945Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package StorageCVSS7.7High–Not in KEV0.5%EPSS1article
CVE-2026-58663Apache IoTDB: Auth Bypass in pipeTransfer() interfaceCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-59229Apache IoTDB: Legacy Pipe Privilege EscalationCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-86471Apache CouchDB: Admin credentials leading to code execution as operating system userCVSS9.3Critical–Not in KEV0.6%EPSS1article
CVE-2026-90800Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesCVSS8.1High–Not in KEV0.6%EPSS1article
CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionCVSS7.7High–Not in KEV0.7%EPSS1article
CVE-2026-108089Apache Cocoon: Unauthenticated access to diagnostic interfacesCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-107755Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLsCVSS6.0Medium–Not in KEV0.6%EPSS1article
CVE-2026-90799Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence valuesCVSS1.3Low–Not in KEV0.6%EPSS1article
CVE-2026-103119Apache Tomcat: AJP response mix-upCVSS9.1Critical–Not in KEV0.6%EPSS1article
CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processingCVSS9.1Critical–Not in KEV0.5%EPSS1article
CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsCVSS9.1Critical–Not in KEV0.7%EPSS1article
CVE-2026-94134Apache Software Foundation Apache Airflow SSH provider vulnerabilityCVSS9.1Critical–Not in KEV0.3%EPSS0articles
CVE-2026-96806Apache Software Foundation Apache Airflow Keycloak provider vulnerabilityCVSS5.8Medium–Not in KEV0.3%EPSS0articles
CVE-2026-94135Apache Software Foundation Apache Airflow SFTP provider vulnerabilityCVSS4.3Medium–Not in KEV0.2%EPSS0articles
CVE-2026-64959Apache Kylin: Missing authentication on certain cache API endpointsCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-103412Apache Software Foundation Apache Camel Karavan vulnerabilityCVSS8.8High–Not in KEV0.5%EPSS0articles
CVE-2026-103413Apache Software Foundation Apache Camel Karavan vulnerabilityCVSS8.8High–Not in KEV0.4%EPSS0articles
CVE-2026-66087Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint EndpointCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-66084Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream EndpointCVSSUnrated–Not in KEV0.3%EPSS1article

Coverage

87 articles, all timeFull timeline RSS feed
  1. Atlassian Flags 162 High and 14 Critical Flaws in Server ProductsSecurityWeek
  2. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoSSecurityOnline
  3. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE RiskSecurityOnline
  4. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant AccessSecurityOnline
  5. Atlassian patches 176 flaws across Jira and Confluence productsSecurityOnline
  6. Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache WarnsSecurityOnline
  7. Apache Tomcat fixes authentication bypass and data leaks in key releasesSecurityOnline
  8. Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent UpgradeSecurityOnline
  9. CISA Flags Five Exploited Flaws in China Linked Cyber CampaignSecurity Affairs
  10. Apache Camel Karavan flaws could let attackers hijack Kubernetes deploymentsSecurityOnline
  11. CISA Adds Five Flaws to KEV After Flax Typhoon AttacksThe Hacker News
  12. CISA Flags Five Actively Exploited Flaws in Enterprise ToolsSecurityOnline
  13. CISA Flags Actively Exploited Apache Struts Flaw for Urgent PatchingCISA · official notice
  14. China-Based Hackers Accused of Stealing Emails Across 7 CountriesThe Hacker News
  15. Apache DolphinScheduler Fixes Six Flaws Exposing Credentials and DataSecurityOnline
  16. Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks SessionsSecurityOnline
  17. LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on OpenThe Hacker News
  18. Apache Thrift fixes 61 flaws, including unauthenticated critical bugsSecurityOnline
  19. Apache Struts fixes four flaws, including remote code execution riskSecurityOnline
  20. Dark Web Claims Expose 10 Million French Records and MoreSOCRadar
  21. Apache OpenOffice Flaw Enables Code Execution Through Crafted DocumentsSecurityOnline
  22. Apache Fixes 20 Flaws Including Critical mod_vhost_alias BugSecurityOnline
  23. Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.1SecurityOnline
  24. Apache WSS4J Flaws Let Attackers Forge Authenticated MessagesSecurityOnline
  25. Critical Apache PLC4X Flaw Enables OPC UA Server ImpersonationSecurityOnline
  26. Apache Karaf Flaws Let Low-Privilege Users Seize Admin AccessSecurityOnline
  27. Apache Qpid Broker-J Fixes Six Flaws, Including Critical Session BugSecurityOnline
  28. Apache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoSSecurityOnline
  29. Apache Doris Fixes Flaws Exposing Cluster Data and Enabling RCESecurityOnline
  30. Apache Fixes NiFi Path Traversal and Denial of Service FlawsSecurityOnline
  31. Apache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof LogsSecurityOnline
  32. Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox EscapeSecurityOnline
  33. Apache Storm Fixes 17 Flaws Enabling Root Access and Data TheftSecurityOnline
  34. Apache Camel K Patches Critical Flaws Enabling Code ExecutionSecurityOnline
  35. Apache Artemis Flaws Let Attackers Steal Sessions and Expose CredentialsSecurityOnline
  36. CVE-2026-41870: Unauthenticated RCE in Apache NutchSecurityOnline
  37. Apache Impala Flaws Let Attackers Seize Analytics Clusters RemotelySecurityOnline
  38. Apache Allura Fixes Four Flaws That Could Expose RepositoriesSecurityOnline
  39. Apache CloudStack patches critical KVM RCE flaw CVE-2026-50112SecurityOnline
  40. CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0SecurityOnline
  41. Apache HttpClient bug lets attackers hijack traffic, update urgedSecurityOnline
  42. Apache patches five Struts 2 bugs, warns of remote DoS and leaksSecurityOnline
  43. CISA Flags Critical Flaws in IBM Langflow, N able and TomcatSecurity Affairs
  44. CISA warns of exploits in IBM Langflow, Nable, and Tomcat flawsSecurityWeek
  45. Apple tightens bug bounty amid surge of AI generated flaw reportsSecurityOnline
  46. N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV CatalogSecurityOnline
  47. CISA Adds Apache Tomcat Flaw CVE-2026-34486 to KEV CatalogCISA · official notice
  48. CISA warns Apache Tomcat flaw CVE-2026-34486 risks dataCISA · official notice
  49. Apache NiFi flaws enable code execution and auth bypassSecurityOnline
  50. Apache ActiveMQ Patches Authorization Bypass and DoS FlawsSecurityOnline

The latest 50 are listed. Every article is in the RSS feed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device