Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,749

All time

Critical · Active

12,050

CVSS ≥ 9.0

New · 14 days

2,437

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 391–420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-41018	—	—	Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL	May 11, 2026 3mo ago
CVE-2026-43826	—	—	Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL	May 11, 2026 3mo ago
CVE-2026-6722	critical	9.5/10	Use-After-Free in SOAP using Apache map	May 10, 2026 3mo ago
CVE-2026-7262	low	2.9/10	NULL pointer dereference in SOAP apache:Map decoder with missing <value>	May 10, 2026 3mo ago
CVE-2026-39816	high	7.5/10	Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService	May 8, 2026 3mo ago
CVE-2026-25199	—	—	Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access	May 8, 2026 3mo ago
CVE-2026-25077	—	—	Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates	May 8, 2026 3mo ago
CVE-2025-69233	medium	6.5/10	Apache CloudStack: Domain/account resources limits not honored	May 8, 2026 3mo ago
CVE-2025-66467	high	8.0/10	Apache CloudStack: MinIO policy remains intact on bucket deletion	May 8, 2026 3mo ago
CVE-2025-66172	—	—	Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to	May 8, 2026 3mo ago
CVE-2025-66171	—	—	Apache CloudStack: Any user can create a new VM from backups they should not have access to	May 8, 2026 3mo ago
CVE-2025-66170	—	—	Apache CloudStack: Any user can list backups that they should not have access to	May 8, 2026 3mo ago
CVE-2013-10075	—	—	Apache::Session versions through 1.94 for Perl re-creates deleted sessions	May 8, 2026 3mo ago
CVE-2026-33844	critical	9.0/10	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	May 7, 2026 3mo ago
CVE-2026-33109	critical	9.9/10	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	May 7, 2026 3mo ago
CVE-2026-5081	—	—	Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure	May 6, 2026 3mo ago
CVE-2026-40010	—	—	Apache Wicket: possible session fixation using AuthenticatedWebSession	May 6, 2026 3mo ago
CVE-2026-42509	—	—	Apache Wicket: crafted strings can break out of the JavaScript sequence	May 6, 2026 3mo ago
CVE-2026-43646	—	—	Apache Wicket: crafted URLs can bypass PackageResourceGuard	May 6, 2026 3mo ago
CVE-2026-43975	—	—	Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager	May 6, 2026 3mo ago
CVE-2026-28780	—	—	Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()	May 5, 2026 3mo ago
CVE-2026-29168	—	—	Apache HTTP Server: mod_md unrestricted OCSP response	May 5, 2026 3mo ago
CVE-2026-43868	—	—	Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern	May 5, 2026 3mo ago
CVE-2026-43870	—	—	Apache Thrift: Node.js web_server.js multi-vulnerability	May 5, 2026 3mo ago
CVE-2026-43869	—	—	Apache Thrift: TSSLTransportFactory.java hostname verification	May 5, 2026 3mo ago
CVE-2026-40682	—	—	Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor	May 4, 2026 3mo ago
CVE-2026-42810	critical	9.4/10	Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names	May 4, 2026 3mo ago
CVE-2026-42027	—	—	Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader	May 4, 2026 3mo ago
CVE-2026-42440	—	—	Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader	May 4, 2026 3mo ago
CVE-2026-42811	critical	9.4/10	Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions	May 4, 2026 3mo ago