Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

707

Newly disclosed

Feed last synced

6 hrs ago

Data freshness

Showing 61–90 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-49328	—	—	Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF	Jun 1, 2026 26d ago
CVE-2026-48827	high	7.1/10	Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git	Jun 1, 2026 26d ago
CVE-2026-44825	high	8.1/10	Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users	Jun 1, 2026 26d ago
CVE-2026-49361	—	—	Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability	Jun 1, 2026 26d ago
CVE-2026-40861	—	—	Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler	Jun 1, 2026 26d ago
CVE-2026-40961	—	—	Apache Airflow: Open Redirect Bypass Vulnerability	Jun 1, 2026 26d ago
CVE-2026-40963	—	—	Apache Airflow: DAG authorization bypass on /ui/structure/structure_data	Jun 1, 2026 26d ago
CVE-2026-41014	—	—	Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints	Jun 1, 2026 26d ago
CVE-2026-49267	—	—	Apache Airflow: No certificate validation on SMTP STARTTLS connections	Jun 1, 2026 26d ago
CVE-2026-41017	—	—	Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy	Jun 1, 2026 26d ago
CVE-2026-41084	—	—	Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation	Jun 1, 2026 26d ago
CVE-2026-42252	—	—	Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern	Jun 1, 2026 26d ago
CVE-2026-42360	—	—	Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking	Jun 1, 2026 26d ago
CVE-2026-42358	—	—	Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets	Jun 1, 2026 26d ago
CVE-2026-42359	—	—	Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator	Jun 1, 2026 26d ago
CVE-2026-45360	—	—	Apache Airflow: Arbitrary import in custom deadline-reference deserialization	Jun 1, 2026 26d ago
CVE-2026-45426	—	—	Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access	Jun 1, 2026 26d ago
CVE-2026-46764	—	—	Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter	Jun 1, 2026 26d ago
CVE-2026-48726	—	—	Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path	Jun 1, 2026 26d ago
CVE-2026-49298	—	—	Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments	Jun 1, 2026 26d ago
CVE-2026-42253	—	—	Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties	Jun 1, 2026 26d ago
CVE-2026-42588	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector	Jun 1, 2026 26d ago
CVE-2026-45505	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass	Jun 1, 2026 26d ago
CVE-2026-46605	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal	Jun 1, 2026 26d ago
CVE-2026-49157	—	—	Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default	Jun 1, 2026 26d ago
CVE-2026-49270	—	—	Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)	Jun 1, 2026 26d ago
CVE-2026-35563	high	8.8/10	Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname	Jun 1, 2026 26d ago
CVE-2026-45192	—	—	Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response	Jun 1, 2026 26d ago
CVE-2026-40914	—	—	Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission	May 28, 2026 1mo ago
CVE-2025-48977	high	8.5/10	Apache Ignite: REST HTTP arbitrary file read vulnerability	May 28, 2026 1mo ago