Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,612

All time

Critical · Active

12,039

CVSS ≥ 9.0

New · 14 days

2,351

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-49432	—	—	Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service	Jun 30, 2026 1mo ago
CVE-2026-49877	—	—	Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console	Jun 30, 2026 1mo ago
CVE-2026-50734	—	—	Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation	Jun 30, 2026 1mo ago
CVE-2026-50750	—	—	Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270	Jun 30, 2026 1mo ago
CVE-2026-52760	—	—	Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console	Jun 30, 2026 1mo ago
CVE-2026-53916	—	—	Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec	Jun 30, 2026 1mo ago
CVE-2026-53917	—	—	Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling	Jun 30, 2026 1mo ago
CVE-2026-54475	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover	Jun 30, 2026 1mo ago
CVE-2026-55957	—	—	Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind	Jun 29, 2026 1mo ago
CVE-2026-55956	—	—	Apache Tomcat: Security constraints for default servlet ignored method	Jun 29, 2026 1mo ago
CVE-2026-55955	—	—	Apache Tomcat: EncryptInterceptor not protected against replay attacks	Jun 29, 2026 1mo ago
CVE-2026-57915	—	—	Apache Kerby: Kerberos Pre-Authentication Bypass	Jun 26, 2026 2mo ago
CVE-2026-56091	high	8.2/10	Apache Shiro: Authentication bypass in Guice-Web integration	Jun 25, 2026 2mo ago
CVE-2026-56130	low	2.0/10	Apache Shiro: Remember-me cookie isn't checked for expiry on the server	Jun 25, 2026 2mo ago
CVE-2026-41566	critical	9.4/10	Apache Kvrocks: Improper permission for the APPLYBATCH command	Jun 25, 2026 2mo ago
CVE-2026-45188	low	2.4/10	Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling	Jun 25, 2026 2mo ago
CVE-2026-46751	medium	5.5/10	Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.	Jun 25, 2026 2mo ago
CVE-2026-46752	critical	10.0/10	Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()	Jun 25, 2026 2mo ago
CVE-2026-54226	medium	6.4/10	Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS	Jun 25, 2026 2mo ago
CVE-2025-62198	—	—	Apache Atlas: Stored XSS in Create Entity page	Jun 22, 2026 2mo ago
CVE-2026-44914	high	7.5/10	Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents	Jun 22, 2026 2mo ago
CVE-2026-44911	low	2.3/10	Apache NiFi: Incorrect Authorization for Configuration Verification Requests	Jun 22, 2026 2mo ago
CVE-2026-44913	medium	5.2/10	Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL	Jun 22, 2026 2mo ago
CVE-2026-54665	medium	6.3/10	Apache NiFi: Missing Validation for Proxy Host Headers	Jun 22, 2026 2mo ago
CVE-2025-66336	—	—	Apache Doris MCP Server: SQL injection leading the authentication bypass	Jun 22, 2026 2mo ago
CVE-2026-47340	—	—	Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.	Jun 17, 2026 2mo ago
CVE-2026-32967	—	—	Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks	Jun 17, 2026 2mo ago
CVE-2026-42357	—	—	Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.	Jun 17, 2026 2mo ago
CVE-2026-41280	—	—	Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects	Jun 17, 2026 2mo ago
CVE-2026-32966	—	—	Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure	Jun 17, 2026 2mo ago