Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

704

Newly disclosed

Feed last synced

12 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-41043	—	—	Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues	Apr 24, 2026 2mo ago
CVE-2026-40466	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI	Apr 24, 2026 2mo ago
CVE-2026-40542	—	—	Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification	Apr 22, 2026 2mo ago
CVE-2026-33557	—	—	Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication	Apr 20, 2026 2mo ago
CVE-2025-66335	—	—	Apache Doris MCP Server: MCP SQL inject	Apr 20, 2026 2mo ago
CVE-2026-33558	—	—	Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output	Apr 20, 2026 2mo ago
CVE-2026-40948	—	—	Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager	Apr 18, 2026 2mo ago
CVE-2026-32690	—	—	Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1	Apr 18, 2026 2mo ago
CVE-2026-30898	—	—	Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf	Apr 18, 2026 2mo ago
CVE-2026-30912	—	—	Apache Airflow: Exposing stack trace in case of constraint error	Apr 18, 2026 2mo ago
CVE-2026-25917	—	—	Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)	Apr 18, 2026 2mo ago
CVE-2026-32228	—	—	Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to	Apr 18, 2026 2mo ago
CVE-2026-31987	—	—	Apache Airflow: JWT token appearing in logs	Apr 16, 2026 2mo ago
CVE-2026-25219	—	—	Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access	Apr 15, 2026 2mo ago
CVE-2026-30778	—	—	Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.	Apr 15, 2026 2mo ago
CVE-2026-5088	—	—	Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts	Apr 15, 2026 2mo ago
CVE-2025-54550	—	—	Apache Airflow: RCE by race condition in example_xcom dag	Apr 15, 2026 2mo ago
CVE-2026-31923	—	—	Apache APISIX: Openid-connect `tls_verify` field is disabled by default	Apr 14, 2026 2mo ago
CVE-2026-33929	—	—	Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code	Apr 14, 2026 2mo ago
CVE-2026-31924	—	—	Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP	Apr 14, 2026 2mo ago
CVE-2026-31908	—	—	Apache APISIX: forward auth plugin allows header injection	Apr 14, 2026 2mo ago
CVE-2026-33858	—	—	Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API	Apr 13, 2026 2mo ago
CVE-2025-66236	—	—	Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI	Apr 13, 2026 2mo ago
CVE-2026-34476	—	—	Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server	Apr 13, 2026 2mo ago
CVE-2026-35337	—	—	Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling	Apr 13, 2026 2mo ago
CVE-2026-35565	—	—	Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI	Apr 13, 2026 2mo ago
CVE-2026-40023	medium	6.3/10	Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 2mo ago
CVE-2026-40021	medium	6.3/10	Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 2mo ago
CVE-2026-34481	medium	6.3/10	Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout	Apr 10, 2026 2mo ago
CVE-2026-34480	medium	6.9/10	Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 2mo ago