Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,533

All time

Critical · Active

12,031

CVSS ≥ 9.0

New · 14 days

2,319

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 181–210 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-40452	—	—	Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users	Jul 10, 2026 1mo ago
CVE-2026-40009	—	—	Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor	Jul 10, 2026 1mo ago
CVE-2026-40008	—	—	Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC	Jul 10, 2026 1mo ago
CVE-2026-40007	—	—	Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError	Jul 10, 2026 1mo ago
CVE-2026-40006	—	—	Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver	Jul 10, 2026 1mo ago
CVE-2026-40005	—	—	Apache IoTDB: Path Traversal in Pipe File Transfer Receiver	Jul 10, 2026 1mo ago
CVE-2026-28564	—	—	Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials	Jul 10, 2026 1mo ago
CVE-2026-41042	—	—	Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter	Jul 8, 2026 1mo ago
CVE-2026-33264	—	—	Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()	Jul 7, 2026 1mo ago
CVE-2026-49487	—	—	Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs	Jul 7, 2026 1mo ago
CVE-2026-48828	—	—	Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key	Jul 7, 2026 1mo ago
CVE-2026-49296	—	—	Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}	Jul 7, 2026 1mo ago
CVE-2026-48891	—	—	Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target	Jul 7, 2026 1mo ago
CVE-2026-48892	—	—	Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options	Jul 7, 2026 1mo ago
CVE-2026-43825	—	—	Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel	Jul 6, 2026 1mo ago
CVE-2026-49297	—	—	Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)	Jul 6, 2026 1mo ago
CVE-2026-46588	—	—	Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input	Jul 6, 2026 1mo ago
CVE-2026-46587	—	—	Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input	Jul 6, 2026 1mo ago
CVE-2026-49042	—	—	Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters	Jul 6, 2026 1mo ago
CVE-2026-24013	—	—	Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC	Jul 6, 2026 1mo ago
CVE-2026-24012	—	—	Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query	Jul 6, 2026 1mo ago
CVE-2026-43866	—	—	Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder	Jul 6, 2026 1mo ago
CVE-2026-24014	—	—	Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write	Jul 6, 2026 1mo ago
CVE-2026-43867	—	—	Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter	Jul 6, 2026 1mo ago
CVE-2026-56140	—	—	Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components	Jul 6, 2026 1mo ago
CVE-2026-56139	—	—	Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients	Jul 6, 2026 1mo ago
CVE-2026-55994	—	—	Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour	Jul 6, 2026 1mo ago
CVE-2026-55993	—	—	Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour	Jul 6, 2026 1mo ago
CVE-2026-53913	—	—	Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted	Jul 6, 2026 1mo ago
CVE-2026-49365	—	—	Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients	Jul 6, 2026 1mo ago