Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,773

All time

Critical · Active

12,053

CVSS ≥ 9.0

New · 14 days

2,454

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 451–480 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-33454	—	—	Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)	Apr 27, 2026 4mo ago
CVE-2026-40022	—	—	Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime	Apr 27, 2026 4mo ago
CVE-2026-40858	—	—	Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository	Apr 27, 2026 4mo ago
CVE-2026-41409	critical	9.8/10	Apache MINA: CWE-502 Deserialization of Untrusted Data	Apr 27, 2026 4mo ago
CVE-2026-41635	critical	9.8/10	Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE	Apr 27, 2026 4mo ago
CVE-2026-40453	—	—	Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection	Apr 27, 2026 4mo ago
CVE-2026-40860	—	—	Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp	Apr 27, 2026 4mo ago
CVE-2026-40048	—	—	Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager	Apr 27, 2026 4mo ago
CVE-2026-40473	—	—	Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP	Apr 27, 2026 4mo ago
CVE-2026-39920	critical	9.3/10	BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE	Apr 24, 2026 4mo ago
CVE-2026-38743	—	—	Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities	Apr 24, 2026 4mo ago
CVE-2026-40690	—	—	Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users	Apr 24, 2026 4mo ago
CVE-2026-23902	—	—	Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.	Apr 24, 2026 4mo ago
CVE-2025-62233	—	—	Apache DolphinScheduler: Deserialization of untrusted data in RPC	Apr 24, 2026 4mo ago
CVE-2026-41044	—	—	Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia	Apr 24, 2026 4mo ago
CVE-2026-41043	—	—	Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues	Apr 24, 2026 4mo ago
CVE-2026-40466	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI	Apr 24, 2026 4mo ago
CVE-2026-40542	—	—	Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification	Apr 22, 2026 4mo ago
CVE-2026-33557	—	—	Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication	Apr 20, 2026 4mo ago
CVE-2025-66335	—	—	Apache Doris MCP Server: MCP SQL inject	Apr 20, 2026 4mo ago
CVE-2026-33558	—	—	Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output	Apr 20, 2026 4mo ago
CVE-2026-40948	—	—	Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager	Apr 18, 2026 4mo ago
CVE-2026-32690	—	—	Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1	Apr 18, 2026 4mo ago
CVE-2026-30898	—	—	Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf	Apr 18, 2026 4mo ago
CVE-2026-30912	—	—	Apache Airflow: Exposing stack trace in case of constraint error	Apr 18, 2026 4mo ago
CVE-2026-25917	—	—	Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)	Apr 18, 2026 4mo ago
CVE-2026-32228	—	—	Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to	Apr 18, 2026 4mo ago
CVE-2026-31987	—	—	Apache Airflow: JWT token appearing in logs	Apr 16, 2026 4mo ago
CVE-2026-25219	—	—	Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access	Apr 15, 2026 4mo ago
CVE-2026-30778	—	—	Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.	Apr 15, 2026 4mo ago