Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

348,009

All time

Critical · Active

12,076

CVSS ≥ 9.0

New · 14 days

2,669

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 751–780 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2025-24859	low	2.1/10	Apache Roller: Insufficient Session Expiration on Password Change	Apr 14, 2025 1y ago
CVE-2025-31672	—	—	Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names	Apr 9, 2025 1y ago
CVE-2025-30677	medium	6.3/10	Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors	Apr 9, 2025 1y ago
CVE-2025-30473	—	—	Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection	Apr 7, 2025 1y ago
CVE-2024-53868	—	—	Apache Traffic Server: Malformed chunked message body allows request smuggling	Apr 3, 2025 1y ago
CVE-2025-30676	—	—	Apache OFBiz: Stored XSS Vulnerability	Apr 1, 2025 1y ago
CVE-2025-30177	—	—	Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering	Apr 1, 2025 1y ago
CVE-2024-56325	—	—	Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required	Apr 1, 2025 1y ago
CVE-2025-29868	—	—	Apache Answer: Using externally referenced images can leak user privacy.	Apr 1, 2025 1y ago
CVE-2025-30065	critical	10.0/10	Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata	Apr 1, 2025 1y ago
CVE-2025-30067	—	—	Apache Kylin: The remote code execution via jdbc url	Mar 27, 2025 1y ago
CVE-2024-48944	—	—	Apache Kylin: SSRF vulnerability in the diagnosis api	Mar 27, 2025 1y ago
CVE-2024-53679	high	8.4/10	Apache VCL: XSS vulnerability in User Lookup impacting user privileges	Mar 25, 2025 1y ago
CVE-2024-53678	medium	5.1/10	Apache VCL: SQL injection vulnerability in New Block Allocation form	Mar 25, 2025 1y ago
CVE-2025-30474	—	—	Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message	Mar 23, 2025 1y ago
CVE-2025-26796	—	—	Apache Oozie: XSS in Oozie Web Console	Mar 22, 2025 1y ago
CVE-2025-27888	medium	5.8/10	Apache Druid: Server-Side Request Forgery and Cross-Site Scripting	Mar 20, 2025 1y ago
CVE-2024-54016	—	—	compression bomb attack in Apache Seata Server	Mar 20, 2025 1y ago
CVE-2024-47552	—	—	Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server	Mar 20, 2025 1y ago
CVE-2025-27018	—	—	Apache Airflow MySQL Provider: SQL injection in MySQL provider core function	Mar 19, 2025 1y ago
CVE-2025-27017	medium	6.9/10	Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record	Mar 12, 2025 1y ago
CVE-2025-27867	—	—	Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin	Mar 12, 2025 1y ago
CVE-2025-29891	—	—	Apache Camel: Camel Message Header Injection through request parameters	Mar 12, 2025 1y ago
CVE-2025-24813	—	—	Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT	Mar 10, 2025 1y ago
CVE-2025-26865	—	—	Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE	Mar 10, 2025 1y ago
CVE-2024-38311	—	—	Apache Traffic Server: Request smuggling via pipelining after a chunked message body	Mar 6, 2025 1y ago
CVE-2024-56195	—	—	Apache Traffic Server: Intercept plugins are not access controlled	Mar 6, 2025 1y ago
CVE-2024-56196	—	—	Apache Traffic Server: ACL is not fully compatible with older versions	Mar 6, 2025 1y ago
CVE-2024-56202	—	—	Apache Traffic Server: Expect header field can unreasonably retain resource	Mar 6, 2025 1y ago
CVE-2024-55532	—	—	Apache Ranger: Improper Neutralization of Formula Elements in a CSV File	Mar 3, 2025 1y ago