Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,533

All time

Critical · Active

12,031

CVSS ≥ 9.0

New · 14 days

2,326

Newly disclosed

Feed last synced

50 mins ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-58023	medium	6.9/10	Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path	Jul 27, 2026 1mo ago
CVE-2026-55971	critical	9.3/10	Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()	Jul 27, 2026 1mo ago
CVE-2026-55970	medium	6.9/10	Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()	Jul 27, 2026 1mo ago
CVE-2026-55969	high	8.7/10	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()	Jul 27, 2026 1mo ago
CVE-2026-55968	high	8.7/10	Apache Thrift: Node.js quadratic-time DoS in server receive transports	Jul 27, 2026 1mo ago
CVE-2026-49158	high	7.5/10	Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb	Jul 27, 2026 1mo ago
CVE-2026-48586	high	8.7/10	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit	Jul 27, 2026 1mo ago
CVE-2026-48145	high	8.2/10	Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass	Jul 27, 2026 1mo ago
CVE-2026-48144	critical	9.1/10	Apache Thrift: c_glib TLS Client Missing Hostname Verification	Jul 27, 2026 1mo ago
CVE-2026-45112	medium	6.9/10	Apache Thrift: Unbounded Read Leading to Denial of Service	Jul 27, 2026 1mo ago
CVE-2026-43871	high	8.7/10	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit	Jul 27, 2026 1mo ago
CVE-2026-41608	—	—	Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport	Jul 27, 2026 1mo ago
CVE-2026-49326	—	—	Apache HBase: Missing scanner instance owner check in thrift delegation service	Jul 24, 2026 1mo ago
CVE-2026-60080	—	—	Apache Fory: Rust MetaString heap use-after-free	Jul 21, 2026 1mo ago
CVE-2026-64606	—	—	Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface	Jul 21, 2026 1mo ago
CVE-2026-64609	—	—	Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization	Jul 21, 2026 1mo ago
CVE-2026-64608	—	—	Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths	Jul 21, 2026 1mo ago
CVE-2026-56623	high	7.1/10	Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows	Jul 20, 2026 1mo ago
CVE-2026-56624	high	7.3/10	Apache MINA SSHD: SSH certificate options lack validations	Jul 20, 2026 1mo ago
CVE-2026-58624	medium	5.4/10	Apache MINA SSHD: Remote execution of JGit commands can write files on the server	Jul 20, 2026 1mo ago
CVE-2026-56452	high	7.5/10	Apache MINA SSHD: Path traversal in SCP file reception	Jul 20, 2026 1mo ago
CVE-2026-59173	—	—	Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions	Jul 18, 2026 1mo ago
CVE-2026-26032	—	—	Apache Ivy: PackagerResolver path traversal vulnerability	Jul 15, 2026 1mo ago
CVE-2026-35152	—	—	Apache Fineract: SQL injection in runreports endpoint	Jul 15, 2026 1mo ago
CVE-2026-58319	—	—	Apache Doris: Improper Authentication in Frontend HTTP API	Jul 14, 2026 1mo ago
CVE-2026-59245	—	—	Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)	Jul 13, 2026 1mo ago
CVE-2026-58065	—	—	Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification	Jul 13, 2026 1mo ago
CVE-2026-41041	—	—	Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.	Jul 13, 2026 1mo ago
CVE-2026-49876	—	—	Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs	Jul 13, 2026 1mo ago
CVE-2026-40454	—	—	Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data	Jul 10, 2026 1mo ago