Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

344,180

All time

Critical · Active

11,533

CVSS ≥ 9.0

New · 14 days

2,691

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-49506	—	—	Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack	Aug 6, 2026 today
CVE-2026-32327	—	—	Apache Portable Runtime Utility: apr-util XML stack recursion crash	Aug 6, 2026 today
CVE-2026-34191	—	—	Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle	Aug 6, 2026 today
CVE-2026-34501	—	—	Apache Portable Runtime Utility: Heap buffer overflow in APR redis client	Aug 6, 2026 today
CVE-2026-34502	—	—	Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client	Aug 6, 2026 today
CVE-2026-57818	—	—	Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider	Aug 6, 2026 today
CVE-2026-61466	—	—	Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation	Aug 6, 2026 today
CVE-2026-63687	—	—	Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters	Aug 6, 2026 today
CVE-2026-65583	—	—	Apache CXF: Self-issued ID token claims validation skipped	Aug 6, 2026 today
CVE-2026-68079	—	—	Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay	Aug 6, 2026 today
CVE-2026-68481	—	—	Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider	Aug 6, 2026 today
CVE-2026-65432	—	—	Apache CXF: XXE via WSDL/XSD import parsing	Aug 6, 2026 yesterday
CVE-2026-57817	—	—	Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow	Aug 6, 2026 yesterday
CVE-2026-66909	—	—	Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage	Aug 6, 2026 yesterday
CVE-2026-64958	—	—	Apache CXF: Denial of service via message header attachments	Aug 6, 2026 yesterday
CVE-2026-57819	—	—	Apache CXF: No default restriction on the amount of form parameters per message	Aug 6, 2026 yesterday
CVE-2026-54225	—	—	Apache CXF: Denial of Service attack via large attachments	Aug 6, 2026 yesterday
CVE-2026-64640	medium	5.3/10	Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation	Aug 6, 2026 yesterday
CVE-2026-60053	—	—	Apache Answer: Residual Administrative API Key Access After Role or Account Revocation	Aug 5, 2026 yesterday
CVE-2026-60023	—	—	Apache Answer: Unauthorized disclosure of deleted or pending answer content	Aug 5, 2026 yesterday
CVE-2026-50749	—	—	Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions	Aug 5, 2026 yesterday
CVE-2026-48912	—	—	Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL	Aug 5, 2026 yesterday
CVE-2026-48911	—	—	Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow	Aug 5, 2026 yesterday
CVE-2026-48834	—	—	Apache Answer: Denial of service via crafted Accept-Language header parsing	Aug 5, 2026 yesterday
CVE-2026-61486	—	—	Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input	Aug 5, 2026 2d ago
CVE-2026-61485	—	—	Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation reading an index	Aug 5, 2026 2d ago
CVE-2026-61484	—	—	Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS	Aug 5, 2026 2d ago
CVE-2026-61483	—	—	Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS	Aug 5, 2026 2d ago
CVE-2026-68080	—	—	Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service	Aug 5, 2026 2d ago
CVE-2026-67592	—	—	Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery	Aug 5, 2026 2d ago