Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,715

All time

Critical · Active

12,045

CVSS ≥ 9.0

New · 14 days

2,415

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-45360	—	—	Apache Airflow: Arbitrary import in custom deadline-reference deserialization	Jun 1, 2026 2mo ago
CVE-2026-45426	—	—	Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access	Jun 1, 2026 2mo ago
CVE-2026-46764	—	—	Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter	Jun 1, 2026 2mo ago
CVE-2026-48726	—	—	Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path	Jun 1, 2026 2mo ago
CVE-2026-49298	—	—	Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments	Jun 1, 2026 2mo ago
CVE-2026-42253	—	—	Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties	Jun 1, 2026 2mo ago
CVE-2026-42588	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector	Jun 1, 2026 2mo ago
CVE-2026-45505	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass	Jun 1, 2026 2mo ago
CVE-2026-46605	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal	Jun 1, 2026 2mo ago
CVE-2026-49157	—	—	Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default	Jun 1, 2026 2mo ago
CVE-2026-49270	—	—	Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)	Jun 1, 2026 2mo ago
CVE-2026-35563	high	8.8/10	Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname	Jun 1, 2026 2mo ago
CVE-2026-45192	—	—	Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response	Jun 1, 2026 2mo ago
CVE-2026-40914	—	—	Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission	May 28, 2026 3mo ago
CVE-2025-48977	high	8.5/10	Apache Ignite: REST HTTP arbitrary file read vulnerability	May 28, 2026 3mo ago
CVE-2026-40564	—	—	Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator	May 26, 2026 3mo ago
CVE-2026-48589	—	0.0/10	Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow	May 25, 2026 3mo ago
CVE-2026-44598	medium	5.1/10	Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)	May 25, 2026 3mo ago
CVE-2026-43828	medium	5.9/10	Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default	May 25, 2026 3mo ago
CVE-2026-43827	medium	5.9/10	Apache Shiro: Session fixation: new session is not created after login by default	May 25, 2026 3mo ago
CVE-2026-42797	—	—	Apache Syncope: JexlContextBuilder Information Disclosure	May 25, 2026 3mo ago
CVE-2026-42782	—	—	Apache Syncope: Post-auth RCE via Groovy static	May 25, 2026 3mo ago
CVE-2026-46745	—	—	Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token	May 25, 2026 3mo ago
CVE-2026-45361	—	—	Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)	May 25, 2026 3mo ago
CVE-2026-45249	—	—	Apache ECharts: XSS in Lines series tooltip rendering	May 25, 2026 3mo ago
CVE-2026-44417	—	—	Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)	May 22, 2026 3mo ago
CVE-2026-44618	—	—	Apache CXF: XXE vulnerability in WS-Transfer functionality	May 22, 2026 3mo ago
CVE-2026-44930	—	—	Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository	May 22, 2026 3mo ago
CVE-2026-48207	—	—	Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement	May 21, 2026 3mo ago
CVE-2026-45760	—	—	Apache Camel K: Camel K Cross-Namespace Build Deputy Attack	May 21, 2026 3mo ago