Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,773

All time

Critical · Active

12,053

CVSS ≥ 9.0

New · 14 days

2,447

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 481–510 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-5088	—	—	Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts	Apr 15, 2026 4mo ago
CVE-2025-54550	—	—	Apache Airflow: RCE by race condition in example_xcom dag	Apr 15, 2026 4mo ago
CVE-2026-31923	—	—	Apache APISIX: Openid-connect `tls_verify` field is disabled by default	Apr 14, 2026 4mo ago
CVE-2026-33929	—	—	Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code	Apr 14, 2026 4mo ago
CVE-2026-31924	—	—	Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP	Apr 14, 2026 4mo ago
CVE-2026-31908	—	—	Apache APISIX: forward auth plugin allows header injection	Apr 14, 2026 4mo ago
CVE-2026-33858	—	—	Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API	Apr 13, 2026 4mo ago
CVE-2025-66236	—	—	Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI	Apr 13, 2026 4mo ago
CVE-2026-34476	—	—	Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server	Apr 13, 2026 4mo ago
CVE-2026-35337	—	—	Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling	Apr 13, 2026 4mo ago
CVE-2026-35565	—	—	Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI	Apr 13, 2026 4mo ago
CVE-2026-40023	medium	6.3/10	Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 4mo ago
CVE-2026-40021	medium	6.3/10	Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 4mo ago
CVE-2026-34481	medium	6.3/10	Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout	Apr 10, 2026 4mo ago
CVE-2026-34480	medium	6.9/10	Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 4mo ago
CVE-2026-34479	medium	6.9/10	Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 4mo ago
CVE-2026-34478	medium	6.9/10	Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility	Apr 10, 2026 4mo ago
CVE-2026-34477	medium	6.3/10	Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass	Apr 10, 2026 4mo ago
CVE-2026-39304	—	—	Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM	Apr 10, 2026 4mo ago
CVE-2026-34500	—	—	Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled	Apr 9, 2026 4mo ago
CVE-2026-34487	—	—	Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token	Apr 9, 2026 4mo ago
CVE-2026-34486	—	—	Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor	Apr 9, 2026 4mo ago
CVE-2026-34483	—	—	Apache Tomcat: Incomplete escaping of JSON access logs	Apr 9, 2026 4mo ago
CVE-2026-32990	—	—	Apache Tomcat: Fix for CVE-2025-66614 is incomplete	Apr 9, 2026 4mo ago
CVE-2026-29146	—	—	Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default	Apr 9, 2026 4mo ago
CVE-2026-29145	—	—	Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled	Apr 9, 2026 4mo ago
CVE-2026-29129	—	—	Apache Tomcat: TLS cipher order is not preserved	Apr 9, 2026 4mo ago
CVE-2026-25854	—	—	Apache Tomcat: Occasionally open redirect	Apr 9, 2026 4mo ago
CVE-2026-24880	—	—	Apache Tomcat: Request smuggling via invalid chunk extension	Apr 9, 2026 4mo ago
CVE-2026-39962	high	8.8/10	LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable	Apr 9, 2026 4mo ago