Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

702

Newly disclosed

Feed last synced

15 hrs ago

Data freshness

Showing 301–330 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-23984	high	7.1/10	Apache Superset: SQLLab Read-Only Bypass on PostgreSQL	Feb 24, 2026 4mo ago
CVE-2024-56373	—	—	Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information	Feb 24, 2026 4mo ago
CVE-2026-25747	—	—	Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB	Feb 23, 2026 4mo ago
CVE-2026-23552	—	—	Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy	Feb 23, 2026 4mo ago
CVE-2025-65995	—	—	Apache Airflow: Disclosure of secrets to UI via kwargs	Feb 21, 2026 4mo ago
CVE-2026-24734	—	—	Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass	Feb 17, 2026 4mo ago
CVE-2026-24733	—	—	Apache Tomcat: Security constraint bypass with HTTP/0.9	Feb 17, 2026 4mo ago
CVE-2025-66614	—	—	Apache Tomcat: Client certificate verification bypass due to virtual host mapping	Feb 17, 2026 4mo ago
CVE-2026-25087	—	—	Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering	Feb 17, 2026 4mo ago
CVE-2026-25903	high	8.7/10	Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates	Feb 17, 2026 4mo ago
CVE-2025-33042	—	—	Apache Avro Java SDK: Code injection on Java generated code	Feb 13, 2026 4mo ago
CVE-2026-24343	—	—	Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions	Feb 10, 2026 4mo ago
CVE-2026-23906	—	—	Apache Druid: Authentication Bypass via LDAP Anonymous Bind	Feb 10, 2026 4mo ago
CVE-2026-23901	low	1.0/10	Apache Shiro: Brute force attack possible to determine valid user names	Feb 10, 2026 4mo ago
CVE-2026-22922	—	—	Apache Airflow: Airflow externalLogUrl Permission Bypass	Feb 9, 2026 4mo ago
CVE-2026-24098	—	—	Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors	Feb 9, 2026 4mo ago
CVE-2026-23903	—	—	Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems	Feb 9, 2026 4mo ago
CVE-2026-24735	—	—	Apache Answer: Revision API Improper Access Control leads to Information Disclosure	Feb 4, 2026 4mo ago
CVE-2026-23794	—	—	Apache Syncope: Reflected XSS on Enduser Login	Feb 3, 2026 4mo ago
CVE-2026-23795	—	—	Apache Syncope: Console XXE on Keymaster parameters	Feb 3, 2026 4mo ago
CVE-2016-15057	—	—	Apache Continuum: Command injection leading to RCE	Jan 26, 2026 5mo ago
CVE-2026-24656	—	—	Apache Karaf: Decanter log-socket collector has deserialization vulnerability	Jan 26, 2026 5mo ago
CVE-2026-22022	—	—	Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin	Jan 21, 2026 5mo ago
CVE-2026-22444	—	—	Apache Solr: Insufficient file-access checking in standalone core-creation requests	Jan 21, 2026 5mo ago
CVE-2025-59355	—	—	Apache Linkis: Password Exposure	Jan 19, 2026 5mo ago
CVE-2025-29847	—	—	Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass	Jan 19, 2026 5mo ago
CVE-2025-68675	—	—	Apache Airflow: proxy credentials for various providers might leak in task logs	Jan 16, 2026 5mo ago
CVE-2025-68438	—	—	Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated	Jan 16, 2026 5mo ago
CVE-2025-60021	—	—	Apache bRPC: Remote command injection vulnerability in heap builtin service	Jan 16, 2026 5mo ago
CVE-2025-66169	—	—	Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component	Jan 14, 2026 5mo ago