Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,773

All time

Critical · Active

12,053

CVSS ≥ 9.0

New · 14 days

2,454

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 421–450 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42809	critical	9.4/10	Apache Polaris: staged table creation could vend storage credentials for unvalidated locations	May 4, 2026 3mo ago
CVE-2026-42812	critical	9.4/10	Apache Polaris: No protection on `write.metadata.path`	May 4, 2026 3mo ago
CVE-2026-40563	—	—	Apache Atlas: Script injection allows access to unintended data	May 4, 2026 3mo ago
CVE-2026-29169	—	—	Apache HTTP Server: mod_dav_lock indirect lock crash	May 4, 2026 3mo ago
CVE-2026-23918	—	—	Apache HTTP Server: http2: double free and possible RCE on early reset	May 4, 2026 3mo ago
CVE-2026-33006	—	—	Apache HTTP Server: mod_auth_digest timing attack	May 4, 2026 3mo ago
CVE-2026-33007	—	—	Apache HTTP Server: mod_authn_socache crash	May 4, 2026 3mo ago
CVE-2026-33523	—	—	Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line	May 4, 2026 3mo ago
CVE-2026-33857	—	—	Apache HTTP Server: Off-by-one OOB reads in AJP getter functions	May 4, 2026 3mo ago
CVE-2026-34032	—	—	Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)	May 4, 2026 3mo ago
CVE-2026-34059	—	—	Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()	May 4, 2026 3mo ago
CVE-2026-24072	—	—	Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr	May 4, 2026 3mo ago
CVE-2026-42778	critical	9.8/10	Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)	May 1, 2026 3mo ago
CVE-2026-42779	critical	9.8/10	Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)	May 1, 2026 3mo ago
CVE-2026-42404	medium	6.5/10	Apache Neethi: Unrestricted HTTP Redirect Following in Policy References	May 1, 2026 3mo ago
CVE-2026-42402	high	7.5/10	Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS	May 1, 2026 3mo ago
CVE-2026-42403	high	7.5/10	Apache Neethi: Circular Policy Reference Infinite Loop	May 1, 2026 3mo ago
CVE-2026-41016	—	—	Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider	Apr 30, 2026 3mo ago
CVE-2026-41636	high	8.7/10	Apache Thrift: Node.js skip() recursion	Apr 28, 2026 4mo ago
CVE-2026-41607	—	—	Apache Thrift: C++ JSON OOB read	Apr 28, 2026 4mo ago
CVE-2026-41606	—	—	Apache Thrift: c_glib dispatch stack overflow	Apr 28, 2026 4mo ago
CVE-2026-41605	—	—	Apache Thrift: Swift Compact Protocol integer overflow	Apr 28, 2026 4mo ago
CVE-2026-41604	—	—	Apache Thrift: Swift Range crash in skip()	Apr 28, 2026 4mo ago
CVE-2026-41603	—	—	Apache Thrift: Java TSSLTransportFactory hostname verification	Apr 28, 2026 4mo ago
CVE-2026-41602	—	—	Apache Thrift: Go TFramedTransport uint32 overflow	Apr 28, 2026 4mo ago
CVE-2025-48431	—	—	Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.	Apr 28, 2026 4mo ago
CVE-2026-40557	—	—	Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections	Apr 27, 2026 4mo ago
CVE-2026-41081	—	—	Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure	Apr 27, 2026 4mo ago
CVE-2026-27172	—	—	Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store	Apr 27, 2026 4mo ago
CVE-2026-33453	—	—	Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution	Apr 27, 2026 4mo ago