Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,892

All time

Critical · Active

12,057

CVSS ≥ 9.0

New · 14 days

2,560

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 571–600 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-24098	—	—	Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors	Feb 9, 2026 6mo ago
CVE-2026-23903	—	—	Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems	Feb 9, 2026 6mo ago
CVE-2026-24735	—	—	Apache Answer: Revision API Improper Access Control leads to Information Disclosure	Feb 4, 2026 6mo ago
CVE-2026-23794	—	—	Apache Syncope: Reflected XSS on Enduser Login	Feb 3, 2026 6mo ago
CVE-2026-23795	—	—	Apache Syncope: Console XXE on Keymaster parameters	Feb 3, 2026 6mo ago
CVE-2016-15057	—	—	Apache Continuum: Command injection leading to RCE	Jan 26, 2026 7mo ago
CVE-2026-24656	—	—	Apache Karaf: Decanter log-socket collector has deserialization vulnerability	Jan 26, 2026 7mo ago
CVE-2026-22022	—	—	Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin	Jan 21, 2026 7mo ago
CVE-2026-22444	—	—	Apache Solr: Insufficient file-access checking in standalone core-creation requests	Jan 21, 2026 7mo ago
CVE-2025-59355	—	—	Apache Linkis: Password Exposure	Jan 19, 2026 7mo ago
CVE-2025-29847	—	—	Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass	Jan 19, 2026 7mo ago
CVE-2025-68675	—	—	Apache Airflow: proxy credentials for various providers might leak in task logs	Jan 16, 2026 7mo ago
CVE-2025-68438	—	—	Apache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated	Jan 16, 2026 7mo ago
CVE-2025-60021	—	—	Apache bRPC: Remote command injection vulnerability in heap builtin service	Jan 16, 2026 7mo ago
CVE-2025-66169	—	—	Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component	Jan 14, 2026 7mo ago
CVE-2025-68493	—	—	Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component	Jan 11, 2026 7mo ago
CVE-2025-52435	—	—	Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller	Jan 10, 2026 7mo ago
CVE-2025-53470	—	—	Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver	Jan 10, 2026 7mo ago
CVE-2025-53477	—	—	Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer	Jan 10, 2026 7mo ago
CVE-2025-62235	—	—	Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing	Jan 10, 2026 7mo ago
CVE-2025-68637	—	—	Apache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client	Jan 7, 2026 7mo ago
CVE-2025-68280	—	—	Apache SIS: XML External Entity (XXE) vulnerability	Jan 5, 2026 7mo ago
CVE-2025-66518	high	8.8/10	Apache Kyuubi: Unauthorized directory access due to missing path normalization	Jan 5, 2026 7mo ago
CVE-2025-47411	—	—	Apache StreamPipes: Leverage of User ID for Privilege Escalation	Jan 1, 2026 7mo ago
CVE-2025-48769	—	—	Apache NuttX RTOS: fs/vfs/fs_rename: use after free	Jan 1, 2026 7mo ago
CVE-2025-48768	—	—	Apache NuttX RTOS: fs/inode: fs_inoderemove root inode removal	Jan 1, 2026 7mo ago
CVE-2025-66524	high	7.5/10	Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor	Dec 19, 2025 8mo ago
CVE-2025-68161	medium	6.3/10	Apache Log4j Core: Missing TLS hostname verification in Socket appender	Dec 18, 2025 8mo ago
CVE-2025-66029	high	7.6/10	Open OnDemand affected by Apache proxy passing sensitive headers	Dec 17, 2025 8mo ago
CVE-2025-67895	—	—	Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2	Dec 17, 2025 8mo ago