Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,892

All time

Critical · Active

12,057

CVSS ≥ 9.0

New · 14 days

2,559

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 631–660 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-64405	—	—	Apache OpenOffice: Remote documents loaded without prompt via DDE function	Nov 12, 2025 9mo ago
CVE-2025-64404	—	—	Apache OpenOffice: Remote documents loaded without prompt via background and bullet images	Nov 12, 2025 9mo ago
CVE-2025-64403	—	—	Apache OpenOffice: Remote documents loaded without prompt via "external data sources" in Calc	Nov 12, 2025 9mo ago
CVE-2025-64402	—	—	Apache OpenOffice: Remote documents loaded without prompt via OLE objects	Nov 12, 2025 9mo ago
CVE-2025-64401	—	—	Apache OpenOffice: Remote documents loaded without prompt via IFrame	Nov 12, 2025 9mo ago
CVE-2025-58337	—	—	Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server	Nov 5, 2025 9mo ago
CVE-2025-62232	—	—	Apache APISIX: basic-auth logs plaintext credentials at info level	Oct 31, 2025 9mo ago
CVE-2024-58273	high	8.5/10	Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root	Oct 30, 2025 10mo ago
CVE-2025-54941	—	—	Apache Airflow: Command injection in "example_dag_decorator"	Oct 30, 2025 10mo ago
CVE-2025-62402	—	—	Apache Airflow: Airflow 3 API: /api/v2/dagReports executes DAG Python in API	Oct 30, 2025 10mo ago
CVE-2025-62503	—	—	Apache Airflow: Privilege boundary bypass in bulk APIs (create action can upsert existing Pools/Connections/Variables)	Oct 30, 2025 10mo ago
CVE-2025-61795	—	—	Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS	Oct 27, 2025 10mo ago
CVE-2025-55752	—	—	Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled	Oct 27, 2025 10mo ago
CVE-2025-55754	—	—	Apache Tomcat: console manipulation via escape sequences in log messages	Oct 27, 2025 10mo ago
CVE-2025-57738	—	—	Apache Syncope: Remote Code Execution by delegated administrators	Oct 20, 2025 10mo ago
CVE-2025-47410	—	—	Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system	Oct 18, 2025 10mo ago
CVE-2025-61581	—	—	Apache Traffic Control: ReDoS issue in Traffic Router configuration	Oct 16, 2025 10mo ago
CVE-2025-54539	—	—	Apache ActiveMQ NMS AMQP Client: Deserialization of Untrusted Data	Oct 16, 2025 10mo ago
CVE-2025-55039	—	—	Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks	Oct 15, 2025 10mo ago
CVE-2024-44088	—	—	Apache Geode: Reflected XSS	Oct 14, 2025 10mo ago
CVE-2025-30001	—	—	Apache StreamPark: Authenticated users can trigger remote command execution	Oct 10, 2025 10mo ago
CVE-2025-62228	medium	5.1/10	Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers	Oct 9, 2025 10mo ago
CVE-2025-61735	—	—	Apache Kylin: Server-Side Request Forgery	Oct 2, 2025 10mo ago
CVE-2025-61733	—	—	Apache Kylin: Authentication bypass	Oct 2, 2025 10mo ago
CVE-2025-61734	—	—	Apache Kylin: improper restriction of file read	Oct 2, 2025 10mo ago
CVE-2025-61622	—	—	Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory	Oct 1, 2025 10mo ago
CVE-2025-54831	—	—	Apache Airflow: Connection sensitive details exposed to users with READ permissions	Sep 26, 2025 11mo ago
CVE-2025-58457	—	—	Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands	Sep 24, 2025 11mo ago
CVE-2025-48392	—	—	Apache IoTDB: DoS Vulnerability	Sep 24, 2025 11mo ago
CVE-2025-48459	—	—	Apache IoTDB: Deserialization of untrusted Data	Sep 24, 2025 11mo ago