Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,892

All time

Critical · Active

12,057

CVSS ≥ 9.0

New · 14 days

2,559

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 661–690 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-40933	—	—	Apache::AuthAny::Cookie v0.201 or earlier for Perl generates session ids insecurely	Sep 17, 2025 11mo ago
CVE-2025-59328	—	—	Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data	Sep 15, 2025 11mo ago
CVE-2025-48208	—	—	Apache HertzBeat (incubating): Jmx JNDI injection vulnerability	Sep 9, 2025 11mo ago
CVE-2025-24404	—	—	Apache HertzBeat (incubating): RCE by parse http sitemap xml response	Sep 9, 2025 11mo ago
CVE-2025-58782	—	—	Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory	Sep 8, 2025 11mo ago
CVE-2024-43115	—	—	Apache DolphinScheduler: Alert Script Attack	Sep 3, 2025 11mo ago
CVE-2025-30057	critical	9.4/10	Authenticated RCE with uhcapache privileges in ConvertToPDF	Aug 27, 2025 12mo ago
CVE-2025-26467	—	—	Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)	Aug 25, 2025 1y ago
CVE-2025-54812	low	2.1/10	Apache Log4cxx: Improper HTML escaping in HTMLLayout	Aug 22, 2025 1y ago
CVE-2025-54813	medium	6.3/10	Apache Log4cxx: Improper escaping with JSONLayout	Aug 22, 2025 1y ago
CVE-2024-48988	—	—	Apache StreamPark: SQL injection vulnerability	Aug 22, 2025 1y ago
CVE-2025-54988	high	8.4/10	Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA	Aug 20, 2025 1y ago
CVE-2024-39954	—	—	Apache EventMesh Runtime: SSRF	Aug 20, 2025 1y ago
CVE-2025-53192	—	—	Apache Commons OGNL: Expression Injection leading to RCE	Aug 18, 2025 1y ago
CVE-2025-54466	—	—	Apache OFBiz: RCE Vulnerability in scrum plugin	Aug 15, 2025 1y ago
CVE-2025-55675	medium	5.3/10	Apache Superset: Incorrect datasource authorization on REST API	Aug 14, 2025 1y ago
CVE-2025-55674	medium	5.3/10	Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions	Aug 14, 2025 1y ago
CVE-2025-55672	medium	5.3/10	Apache Superset: Stored XSS on charts metadata	Aug 14, 2025 1y ago
CVE-2025-55673	medium	5.3/10	Apache Superset: Metadata exposure in embedded charts	Aug 14, 2025 1y ago
CVE-2025-54472	—	—	Apache bRPC: Redis Parser Remote Denial of Service	Aug 14, 2025 1y ago
CVE-2025-55668	—	—	Apache Tomcat: session fixation via rewrite valve	Aug 13, 2025 1y ago
CVE-2025-48989	—	—	Apache Tomcat: h2 DoS - Made You Reset	Aug 13, 2025 1y ago
CVE-2025-53606	—	—	Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server	Aug 8, 2025 1y ago
CVE-2025-48913	—	—	Apache CXF: Untrusted JMS configuration can lead to RCE	Aug 8, 2025 1y ago
CVE-2024-51775	—	—	Apache Zeppelin: Command Injection via CSWSH	Aug 3, 2025 1y ago
CVE-2024-41177	—	—	Apache Zeppelin: XSS in the Helium module	Aug 3, 2025 1y ago
CVE-2024-52279	—	—	Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string	Aug 3, 2025 1y ago
CVE-2025-24854	—	—	Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin	Jul 31, 2025 1y ago
CVE-2025-24853	—	—	Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing	Jul 31, 2025 1y ago
CVE-2025-54656	—	—	Apache Struts Extras: Improper Output Neutralization for Logs	Jul 30, 2025 1y ago