Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,715

All time

Critical · Active

12,045

CVSS ≥ 9.0

New · 14 days

2,431

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 271–300 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42357	—	—	Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.	Jun 17, 2026 2mo ago
CVE-2026-41280	—	—	Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects	Jun 17, 2026 2mo ago
CVE-2026-32966	—	—	Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure	Jun 17, 2026 2mo ago
CVE-2026-50645	—	—	Apache CXF: No restriction on attachment headers per message	Jun 12, 2026 2mo ago
CVE-2026-50634	—	—	Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry	Jun 12, 2026 2mo ago
CVE-2026-50633	—	—	Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl	Jun 12, 2026 2mo ago
CVE-2026-50632	—	—	Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory	Jun 12, 2026 2mo ago
CVE-2026-50631	—	—	Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing	Jun 12, 2026 2mo ago
CVE-2026-50630	—	—	Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection	Jun 12, 2026 2mo ago
CVE-2026-50629	—	—	Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier	Jun 12, 2026 2mo ago
CVE-2026-50628	—	—	Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control	Jun 12, 2026 2mo ago
CVE-2026-50627	—	—	Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator	Jun 12, 2026 2mo ago
CVE-2026-49875	—	—	Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils	Jun 12, 2026 2mo ago
CVE-2026-50623	—	—	Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService	Jun 12, 2026 2mo ago
CVE-2026-47342	—	—	Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass	Jun 10, 2026 2mo ago
CVE-2026-50223	—	—	Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution	Jun 10, 2026 2mo ago
CVE-2026-25700	—	—	Apache Answer: AdminToken not invalidated after admin deactivation	Jun 10, 2026 2mo ago
CVE-2026-41732	high	8.1/10	In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization	Jun 9, 2026 2mo ago
CVE-2026-41731	high	8.1/10	In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization	Jun 9, 2026 2mo ago
CVE-2026-41727	medium	6.5/10	In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior	Jun 9, 2026 2mo ago
CVE-2026-41726	medium	6.5/10	In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header	Jun 9, 2026 2mo ago
CVE-2026-49818	—	—	Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names	Jun 9, 2026 2mo ago
CVE-2026-34905	—	—	Apache Answer: Unlisted Questions Accessible via Direct API Access	Jun 9, 2026 2mo ago
CVE-2026-34033	—	—	Apache Answer: HTML Content Injection in Email	Jun 9, 2026 2mo ago
CVE-2026-34031	—	—	Apache Answer: The custom avatar was not properly validated	Jun 9, 2026 2mo ago
CVE-2026-33582	—	—	Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error	Jun 9, 2026 2mo ago
CVE-2026-25699	—	—	Apache Answer: Authorization Bypass in Timeline API	Jun 9, 2026 2mo ago
CVE-2026-25688	—	—	Apache Answer: XSS in AI Answer Rendering	Jun 9, 2026 2mo ago
CVE-2026-49975	—	—	Apache HTTP Server: mod_http2 denial of service	Jun 8, 2026 2mo ago
CVE-2026-48913	—	—	Apache HTTP Server: mod_http2 memory corruption when file handles exhausted	Jun 8, 2026 2mo ago