Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

704

Newly disclosed

Feed last synced

11 hrs ago

Data freshness

Showing 181–210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42402	high	7.5/10	Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS	May 1, 2026 1mo ago
CVE-2026-42403	high	7.5/10	Apache Neethi: Circular Policy Reference Infinite Loop	May 1, 2026 1mo ago
CVE-2026-41016	—	—	Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider	Apr 30, 2026 1mo ago
CVE-2026-41636	high	8.7/10	Apache Thrift: Node.js skip() recursion	Apr 28, 2026 2mo ago
CVE-2026-41607	—	—	Apache Thrift: C++ JSON OOB read	Apr 28, 2026 2mo ago
CVE-2026-41606	—	—	Apache Thrift: c_glib dispatch stack overflow	Apr 28, 2026 2mo ago
CVE-2026-41605	—	—	Apache Thrift: Swift Compact Protocol integer overflow	Apr 28, 2026 2mo ago
CVE-2026-41604	—	—	Apache Thrift: Swift Range crash in skip()	Apr 28, 2026 2mo ago
CVE-2026-41603	—	—	Apache Thrift: Java TSSLTransportFactory hostname verification	Apr 28, 2026 2mo ago
CVE-2026-41602	—	—	Apache Thrift: Go TFramedTransport uint32 overflow	Apr 28, 2026 2mo ago
CVE-2025-48431	—	—	Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.	Apr 28, 2026 2mo ago
CVE-2026-40557	—	—	Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections	Apr 27, 2026 2mo ago
CVE-2026-41081	—	—	Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure	Apr 27, 2026 2mo ago
CVE-2026-27172	—	—	Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store	Apr 27, 2026 2mo ago
CVE-2026-33453	—	—	Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution	Apr 27, 2026 2mo ago
CVE-2026-33454	—	—	Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)	Apr 27, 2026 2mo ago
CVE-2026-40022	—	—	Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime	Apr 27, 2026 2mo ago
CVE-2026-40858	—	—	Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository	Apr 27, 2026 2mo ago
CVE-2026-41409	critical	9.8/10	Apache MINA: CWE-502 Deserialization of Untrusted Data	Apr 27, 2026 2mo ago
CVE-2026-41635	critical	9.8/10	Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE	Apr 27, 2026 2mo ago
CVE-2026-40453	—	—	Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection	Apr 27, 2026 2mo ago
CVE-2026-40860	—	—	Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp	Apr 27, 2026 2mo ago
CVE-2026-40048	—	—	Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager	Apr 27, 2026 2mo ago
CVE-2026-40473	—	—	Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP	Apr 27, 2026 2mo ago
CVE-2026-39920	critical	9.3/10	BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE	Apr 24, 2026 2mo ago
CVE-2026-38743	—	—	Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities	Apr 24, 2026 2mo ago
CVE-2026-40690	—	—	Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users	Apr 24, 2026 2mo ago
CVE-2026-23902	—	—	Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.	Apr 24, 2026 2mo ago
CVE-2025-62233	—	—	Apache DolphinScheduler: Deserialization of untrusted data in RPC	Apr 24, 2026 2mo ago
CVE-2026-41044	—	—	Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia	Apr 24, 2026 2mo ago