Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

5 hrs ago

Data freshness

Showing 31–60 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-50223	—	—	Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution	Jun 10, 2026 16d ago
CVE-2026-25700	—	—	Apache Answer: AdminToken not invalidated after admin deactivation	Jun 10, 2026 16d ago
CVE-2026-41732	high	8.1/10	In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization	Jun 9, 2026 17d ago
CVE-2026-41731	high	8.1/10	In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization	Jun 9, 2026 17d ago
CVE-2026-41727	medium	6.5/10	In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior	Jun 9, 2026 17d ago
CVE-2026-41726	medium	6.5/10	In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header	Jun 9, 2026 17d ago
CVE-2026-49818	—	—	Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names	Jun 9, 2026 18d ago
CVE-2026-34905	—	—	Apache Answer: Unlisted Questions Accessible via Direct API Access	Jun 9, 2026 18d ago
CVE-2026-34033	—	—	Apache Answer: HTML Content Injection in Email	Jun 9, 2026 18d ago
CVE-2026-34031	—	—	Apache Answer: The custom avatar was not properly validated	Jun 9, 2026 18d ago
CVE-2026-33582	—	—	Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error	Jun 9, 2026 18d ago
CVE-2026-25699	—	—	Apache Answer: Authorization Bypass in Timeline API	Jun 9, 2026 18d ago
CVE-2026-25688	—	—	Apache Answer: XSS in AI Answer Rendering	Jun 9, 2026 18d ago
CVE-2026-49975	—	—	Apache HTTP Server: mod_http2 denial of service	Jun 8, 2026 18d ago
CVE-2026-48913	—	—	Apache HTTP Server: mod_http2 memory corruption when file handles exhausted	Jun 8, 2026 18d ago
CVE-2026-42536	—	—	Apache HTTP Server: mod_xml2enc heap overflow	Jun 8, 2026 18d ago
CVE-2026-44185	—	—	Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`	Jun 8, 2026 18d ago
CVE-2026-34355	—	—	Apache HTTP Server: mod_proxy_html buffer overflow	Jun 8, 2026 18d ago
CVE-2026-44631	—	—	Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow	Jun 8, 2026 18d ago
CVE-2026-44119	—	—	Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules	Jun 8, 2026 18d ago
CVE-2026-43951	—	—	Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash	Jun 8, 2026 18d ago
CVE-2026-42535	—	—	Apache HTTP Server: mod_dav_fs protected directory access	Jun 8, 2026 18d ago
CVE-2026-34356	—	—	Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow	Jun 8, 2026 18d ago
CVE-2026-44186	—	—	Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp	Jun 8, 2026 18d ago
CVE-2026-29170	—	—	Apache HTTP Server: mod_proxy_ftp XSS	Jun 8, 2026 18d ago
CVE-2026-29167	—	—	Apache HTTP Server: mod_ldap per-dir use-after-free	Jun 8, 2026 18d ago
CVE-2026-50076	—	—	Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass	Jun 4, 2026 22d ago
CVE-2026-47065	critical	9.8/10	Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232	Jun 3, 2026 24d ago
CVE-2026-46718	—	—	Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution	Jun 2, 2026 25d ago
CVE-2026-41115	—	—	Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API	Jun 2, 2026 25d ago