Feed live

apache CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

703

Newly disclosed

Feed last synced

13 hrs ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-34479	medium	6.9/10	Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters	Apr 10, 2026 2mo ago
CVE-2026-34478	medium	6.9/10	Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility	Apr 10, 2026 2mo ago
CVE-2026-34477	medium	6.3/10	Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass	Apr 10, 2026 2mo ago
CVE-2026-39304	—	—	Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM	Apr 10, 2026 2mo ago
CVE-2026-34500	—	—	Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled	Apr 9, 2026 2mo ago
CVE-2026-34487	—	—	Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token	Apr 9, 2026 2mo ago
CVE-2026-34486	—	—	Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor	Apr 9, 2026 2mo ago
CVE-2026-34483	—	—	Apache Tomcat: Incomplete escaping of JSON access logs	Apr 9, 2026 2mo ago
CVE-2026-32990	—	—	Apache Tomcat: Fix for CVE-2025-66614 is incomplete	Apr 9, 2026 2mo ago
CVE-2026-29146	—	—	Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default	Apr 9, 2026 2mo ago
CVE-2026-29145	—	—	Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled	Apr 9, 2026 2mo ago
CVE-2026-29129	—	—	Apache Tomcat: TLS cipher order is not preserved	Apr 9, 2026 2mo ago
CVE-2026-25854	—	—	Apache Tomcat: Occasionally open redirect	Apr 9, 2026 2mo ago
CVE-2026-24880	—	—	Apache Tomcat: Request smuggling via invalid chunk extension	Apr 9, 2026 2mo ago
CVE-2026-39962	high	8.8/10	LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable	Apr 9, 2026 2mo ago
CVE-2026-40046	—	—	Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated	Apr 9, 2026 2mo ago
CVE-2026-33005	—	—	Apache OpenMeetings: Insufficient checks in FileWebService	Apr 9, 2026 2mo ago
CVE-2026-33266	—	—	Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt	Apr 9, 2026 2mo ago
CVE-2026-34020	—	—	Apache OpenMeetings: Login Credentials Passed via GET Query Parameters	Apr 9, 2026 2mo ago
CVE-2025-57735	—	—	Apache Airflow: Airflow Logout Not Invalidating JWT	Apr 9, 2026 2mo ago
CVE-2025-62188	—	—	Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.	Apr 9, 2026 2mo ago
CVE-2026-34538	—	—	Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)	Apr 9, 2026 2mo ago
CVE-2026-32588	—	—	Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing	Apr 7, 2026 2mo ago
CVE-2026-27315	—	—	Apache Cassandra: cqlsh history sensitive information leak	Apr 7, 2026 2mo ago
CVE-2026-27314	—	—	Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass	Apr 7, 2026 2mo ago
CVE-2026-35554	—	—	Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition	Apr 7, 2026 2mo ago
CVE-2026-33227	—	—	Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory	Apr 7, 2026 2mo ago
CVE-2026-34197	—	—	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans	Apr 7, 2026 2mo ago
CVE-2025-65114	—	—	Apache Traffic Server: Malformed chunked message body allows request smuggling	Apr 2, 2026 2mo ago
CVE-2025-58136	—	—	Apache Traffic Server: A simple legitimate POST request causes a crash	Apr 2, 2026 2mo ago