Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

706

Newly disclosed

Feed last synced

7 hrs ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-40564	—	—	Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator	May 26, 2026 1mo ago
CVE-2026-48589	—	0.0/10	Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow	May 25, 2026 1mo ago
CVE-2026-44598	medium	5.1/10	Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)	May 25, 2026 1mo ago
CVE-2026-43828	medium	5.9/10	Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default	May 25, 2026 1mo ago
CVE-2026-43827	medium	5.9/10	Apache Shiro: Session fixation: new session is not created after login by default	May 25, 2026 1mo ago
CVE-2026-42797	—	—	Apache Syncope: JexlContextBuilder Information Disclosure	May 25, 2026 1mo ago
CVE-2026-42782	—	—	Apache Syncope: Post-auth RCE via Groovy static	May 25, 2026 1mo ago
CVE-2026-46745	—	—	Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token	May 25, 2026 1mo ago
CVE-2026-45361	—	—	Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)	May 25, 2026 1mo ago
CVE-2026-45249	—	—	Apache ECharts: XSS in Lines series tooltip rendering	May 25, 2026 1mo ago
CVE-2026-44417	—	—	Apache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)	May 22, 2026 1mo ago
CVE-2026-44618	—	—	Apache CXF: XXE vulnerability in WS-Transfer functionality	May 22, 2026 1mo ago
CVE-2026-44930	—	—	Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository	May 22, 2026 1mo ago
CVE-2026-48207	—	—	Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement	May 21, 2026 1mo ago
CVE-2026-45760	—	—	Apache Camel K: Camel K Cross-Namespace Build Deputy Attack	May 21, 2026 1mo ago
CVE-2026-27173	—	—	Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments	May 19, 2026 1mo ago
CVE-2026-42526	—	—	Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends	May 19, 2026 1mo ago
CVE-2026-47323	—	—	Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering	May 19, 2026 1mo ago
CVE-2026-46586	—	—	Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution	May 19, 2026 1mo ago
CVE-2026-45434	—	—	Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE	May 19, 2026 1mo ago
CVE-2026-45187	—	—	Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs	May 19, 2026 1mo ago
CVE-2026-41919	—	—	Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction	May 19, 2026 1mo ago
CVE-2026-35086	—	—	Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services	May 19, 2026 1mo ago
CVE-2026-31986	—	—	Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection	May 19, 2026 1mo ago
CVE-2026-31910	—	—	Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access	May 19, 2026 1mo ago
CVE-2026-31909	—	—	Apache OFBiz: Unauthenticated Shipment Label Image Disclosure	May 19, 2026 1mo ago
CVE-2026-31906	—	—	Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters	May 19, 2026 1mo ago
CVE-2026-31388	—	—	Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature	May 19, 2026 1mo ago
CVE-2026-31387	—	—	Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation	May 19, 2026 1mo ago
CVE-2026-31380	—	—	Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass	May 19, 2026 1mo ago