Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

705

Newly disclosed

Feed last synced

10 hrs ago

Data freshness

Showing 151–180 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-5081	—	—	Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure	May 6, 2026 1mo ago
CVE-2026-40010	—	—	Apache Wicket: possible session fixation using AuthenticatedWebSession	May 6, 2026 1mo ago
CVE-2026-42509	—	—	Apache Wicket: crafted strings can break out of the JavaScript sequence	May 6, 2026 1mo ago
CVE-2026-43646	—	—	Apache Wicket: crafted URLs can bypass PackageResourceGuard	May 6, 2026 1mo ago
CVE-2026-43975	—	—	Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager	May 6, 2026 1mo ago
CVE-2026-28780	—	—	Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()	May 5, 2026 1mo ago
CVE-2026-29168	—	—	Apache HTTP Server: mod_md unrestricted OCSP response	May 5, 2026 1mo ago
CVE-2026-43868	—	—	Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern	May 5, 2026 1mo ago
CVE-2026-43870	—	—	Apache Thrift: Node.js web_server.js multi-vulnerability	May 5, 2026 1mo ago
CVE-2026-43869	—	—	Apache Thrift: TSSLTransportFactory.java hostname verification	May 5, 2026 1mo ago
CVE-2026-40682	—	—	Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor	May 4, 2026 1mo ago
CVE-2026-42810	critical	9.4/10	Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names	May 4, 2026 1mo ago
CVE-2026-42027	—	—	Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader	May 4, 2026 1mo ago
CVE-2026-42440	—	—	Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader	May 4, 2026 1mo ago
CVE-2026-42811	critical	9.4/10	Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions	May 4, 2026 1mo ago
CVE-2026-42809	critical	9.4/10	Apache Polaris: staged table creation could vend storage credentials for unvalidated locations	May 4, 2026 1mo ago
CVE-2026-42812	critical	9.4/10	Apache Polaris: No protection on `write.metadata.path`	May 4, 2026 1mo ago
CVE-2026-40563	—	—	Apache Atlas: Script injection allows access to unintended data	May 4, 2026 1mo ago
CVE-2026-29169	—	—	Apache HTTP Server: mod_dav_lock indirect lock crash	May 4, 2026 1mo ago
CVE-2026-23918	—	—	Apache HTTP Server: http2: double free and possible RCE on early reset	May 4, 2026 1mo ago
CVE-2026-33006	—	—	Apache HTTP Server: mod_auth_digest timing attack	May 4, 2026 1mo ago
CVE-2026-33007	—	—	Apache HTTP Server: mod_authn_socache crash	May 4, 2026 1mo ago
CVE-2026-33523	—	—	Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line	May 4, 2026 1mo ago
CVE-2026-33857	—	—	Apache HTTP Server: Off-by-one OOB reads in AJP getter functions	May 4, 2026 1mo ago
CVE-2026-34032	—	—	Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)	May 4, 2026 1mo ago
CVE-2026-34059	—	—	Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()	May 4, 2026 1mo ago
CVE-2026-24072	—	—	Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr	May 4, 2026 1mo ago
CVE-2026-42778	critical	9.8/10	Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)	May 1, 2026 1mo ago
CVE-2026-42779	critical	9.8/10	Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)	May 1, 2026 1mo ago
CVE-2026-42404	medium	6.5/10	Apache Neethi: Unrestricted HTTP Redirect Following in Policy References	May 1, 2026 1mo ago