Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,382

All time

Critical · Active

12,007

CVSS ≥ 9.0

New · 14 days

2,196

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-63041	medium	5.3/10	Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers	Aug 26, 2026 today
CVE-2026-68525	—	—	Apache Tomcat: Redirect after FORM auth may bypass method specific constraints	Aug 25, 2026 today
CVE-2026-66422	—	—	Apache Tomcat: Servlet role references can bypass declarative role constraints	Aug 25, 2026 today
CVE-2026-65927	—	—	Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control	Aug 25, 2026 today
CVE-2026-65905	—	—	Apache Tomcat: Limited replay attack possible with DIGEST authentication	Aug 25, 2026 today
CVE-2026-50112	—	—	Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates	Aug 21, 2026 5d ago
CVE-2026-61400	—	—	Apache CloudStack: Get and Run Diagnostics Command Injection	Aug 21, 2026 5d ago
CVE-2026-65770	critical	10.0/10	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Aug 20, 2026 5d ago
CVE-2026-63042	—	—	Apache InLong: Missing authorization on DataNode management endpoints	Aug 20, 2026 5d ago
CVE-2026-63040	—	—	Apache InLong: Missing authorization in StreamSource forceDelete	Aug 20, 2026 5d ago
CVE-2026-63039	—	—	Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService	Aug 20, 2026 5d ago
CVE-2026-63038	—	—	Apache InLong: SQL Injection via String Concatenation Vulnerability Report	Aug 20, 2026 5d ago
CVE-2026-63037	—	—	Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint	Aug 20, 2026 5d ago
CVE-2026-63015	—	—	Apache InLong: Non-template responsible persons can view template information	Aug 20, 2026 5d ago
CVE-2026-66256	—	—	Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)	Aug 13, 2026 12d ago
CVE-2026-73239	—	—	Apache Allura: Missing permission checks IDOR	Aug 12, 2026 13d ago
CVE-2026-73240	—	—	Apache Allura: Git command injection	Aug 12, 2026 13d ago
CVE-2026-59244	—	—	Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI	Aug 12, 2026 13d ago
CVE-2026-58076	—	—	Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server	Aug 12, 2026 13d ago
CVE-2026-59242	—	—	Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint	Aug 12, 2026 13d ago
CVE-2026-54183	—	—	Apache Airflow: Airflow Variables were not masked in the UI for authenticated users	Aug 12, 2026 13d ago
CVE-2026-71290	—	—	Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)	Aug 11, 2026 14d ago
CVE-2026-69223	—	—	Apache Allura: Server-side request forgery	Aug 11, 2026 14d ago
CVE-2026-68871	—	—	Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable	Aug 10, 2026 15d ago
CVE-2026-68870	—	—	Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable	Aug 10, 2026 15d ago
CVE-2026-61899	—	—	Apache Tapestry: Possible classpath file download through URL manipulation	Aug 10, 2026 16d ago
CVE-2026-28672	—	—	Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder	Aug 10, 2026 16d ago
CVE-2026-32227	—	—	Apache Ranger: SQL Injection vulnerability in lookup functionality	Aug 10, 2026 16d ago
CVE-2026-55814	—	—	Apache Ranger: Download APIs expose plugin data without authentication	Aug 10, 2026 16d ago
CVE-2026-65942	—	—	Apache Ranger: Clients accept TLS certificates issued for other hostnames	Aug 10, 2026 16d ago