Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

348,051

All time

Critical · Active

12,083

CVSS ≥ 9.0

New · 14 days

2,709

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 871–900 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2024-47561	critical	9.2/10	Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)	Oct 3, 2024 1y ago
CVE-2024-45772	medium	5.1/10	Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue	Sep 30, 2024 1y ago
CVE-2024-23454	—	—	Apache Hadoop: Temporary File Local Information Disclosure	Sep 25, 2024 1y ago
CVE-2024-40761	—	—	Apache Answer: Avatar URL leaked user email addresses	Sep 25, 2024 1y ago
CVE-2024-39928	—	—	Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability	Sep 24, 2024 1y ago
CVE-2024-46544	—	—	Apache Tomcat Connectors: mod_jk: local users can view and modify configuration	Sep 23, 2024 1y ago
CVE-2024-42323	—	—	Apache HertzBeat: RCE by snakeYaml deser load malicious xml	Sep 21, 2024 1y ago
CVE-2024-45537	—	—	Apache Druid: Users can provide MySQL JDBC properties not on allow list	Sep 17, 2024 1y ago
CVE-2024-45384	—	—	Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack	Sep 17, 2024 1y ago
CVE-2024-22399	—	—	Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server	Sep 16, 2024 1y ago
CVE-2024-45034	—	—	Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes	Sep 7, 2024 1y ago
CVE-2024-45498	—	—	Apache Airflow: Command Injection in an example DAG	Sep 7, 2024 1y ago
CVE-2024-45195	—	—	Apache OFBiz: Confused controller-view authorization logic (forced browsing)	Sep 4, 2024 1y ago
CVE-2024-45507	—	—	Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE	Sep 4, 2024 1y ago
CVE-2023-49582	—	—	Apache Portable Runtime (APR): Unexpected lax shared memory permissions	Aug 26, 2024 2y ago
CVE-2024-41937	—	—	Apache Airflow: Stored XSS Vulnerability on provider link	Aug 21, 2024 2y ago
CVE-2023-49198	—	—	Apache SeaTunnel Web: Arbitrary file read vulnerability	Aug 21, 2024 2y ago
CVE-2024-22281	—	—	Apache Helix Front (UI): Helix front hard-coded secret in the express-session	Aug 20, 2024 2y ago
CVE-2024-38175	critical	9.6/10	Azure Managed Instance for Apache Cassandra Elevation of Privilege Vulnerability	Aug 20, 2024 2y ago
CVE-2024-43202	—	—	Apache DolphinScheduler: Remote Code Execution Vulnerability	Aug 20, 2024 2y ago
CVE-2024-41909	—	—	Apache MINA SSHD: integrity check bypass	Aug 12, 2024 2y ago
CVE-2024-41888	—	—	Apache Answer: The link for resetting user password is not Single-Use	Aug 9, 2024 2y ago
CVE-2024-41890	—	—	Apache Answer: The link to reset the user's password will remain valid after sending a new link	Aug 9, 2024 2y ago
CVE-2024-30188	—	—	Apache DolphinScheduler: Resource File Read And Write Vulnerability	Aug 9, 2024 2y ago
CVE-2024-29831	—	—	Apache DolphinScheduler: RCE by arbitrary js execution	Aug 9, 2024 2y ago
CVE-2024-42062	—	—	Apache CloudStack: User Key Exposure to Domain Admins	Aug 7, 2024 2y ago
CVE-2024-42222	—	—	Apache CloudStack: Unauthorised Network List Access	Aug 7, 2024 2y ago
CVE-2024-36448	—	—	Apache IoTDB Workbench: SSRF Vulnerability (EOL)	Aug 5, 2024 2y ago
CVE-2024-38856	—	—	Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code	Aug 5, 2024 2y ago
CVE-2024-42447	—	—	Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow	Aug 5, 2024 2y ago