Apache

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 8.1HighOct 8, 2026Apache Struts Code / command injectionCVE-2016-3081Apache Struts framework. An attacker gains remote code execution. Update to Struts 2.5.10.1 or later.Added to KEV Oct 8, 2026Exploited96% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 7.5HighAug 4, 2026Apache Tomcat Crypto / certificateCVE-2026-34486Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.Added to KEV Aug 4, 2026Exploited99% likelyExploit codeNucleiDetection
• 8.8HighApr 16, 2026Apache ActiveMQCVE-2026-34197Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.Added to KEV Apr 16, 2026Exploited98% likelyExploit codeMetasploit · NucleiDetection
• 9.1CriticalJul 1, 2024Apache HTTP ServerCVE-2024-38475Apache HTTP Server, an attacker gains arbitrary code execution, patch to the latest version (2.4.54 or later) of Apache HTTP Server.Added to KEV May 1, 2025 · 303 days after publicationExploited100% likelyExploit codeNucleiDetection
• 10.0CriticalMar 10, 2025Apache TomcatCVE-2025-24813Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.Added to KEV Apr 1, 2025 · 21 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.8CriticalSep 4, 2024Apache OFBiz Auth bypass / access controlCVE-2024-45195Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.Added to KEV Feb 4, 2025 · 153 days after publicationExploited100% likelyExploit codeNucleiDetection
• 9.8CriticalApr 22, 2024Apache HugeGraph-Server Auth bypass / access controlCVE-2024-27348Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.Added to KEV Sep 18, 2024 · 148 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.1HighAug 5, 2024Apache OFBiz Auth bypass / access controlCVE-2024-38856Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.Added to KEV Aug 27, 2024 · 22 days after publicationExploited99% likelyExploit codeMetasploit · NucleiDetection
• 9.1CriticalMay 8, 2024Apache OFBiz Path traversal / file handlingCVE-2024-32113Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.Added to KEV Aug 7, 2024 · 90 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.1CriticalJan 5, 2021Apache Flink Path traversal / file handlingCVE-2020-17519Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.Added to KEV May 23, 2024 · 1,234 days after publicationExploited98% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.9HighApr 24, 2023Apache SupersetCVE-2023-27524Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.Added to KEV Jan 8, 2024 · 258 days after publicationExploited98% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 10.0CriticalOct 27, 2023Apache ActiveMQ DeserializationCVE-2023-46604Apache ActiveMQ is affected. An attacker gains remote code execution. Update to the latest version of Apache ActiveMQ and disable deserialization of untrusted data.Added to KEV Nov 2, 2023 · 5 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
• 9.8CriticalMay 24, 2023Apache RocketMQ Code / command injectionCVE-2023-33246Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.Added to KEV Sep 6, 2023 · 104 days after publicationExploited97% likelyExploit codeMetasploit · NucleiDetection
• 9.8CriticalApr 6, 2017Apache Tomcat Auth bypass / access controlCVE-2016-8735Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.Added to KEV May 12, 2023 · 2,226 days after publicationExploited90% likelyExploit code
• 9.0CriticalDec 14, 2021Apache Log4j2 Code / command injectionCVE-2021-45046Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.Added to KEV May 1, 2023 · 502 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
• 8.8HighJul 18, 2022Apache Spark Code / command injectionCVE-2022-33891Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.Added to KEV Mar 7, 2023 · 232 days after publicationExploited93% likelyExploit codeMetasploit · NucleiDetection
• 9.8CriticalFeb 11, 2022Apache APISIX Auth bypass / access controlCVE-2022-24112Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.Added to KEV Aug 25, 2022 · 194 days after publicationExploited96% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.8CriticalApr 26, 2022Apache CouchDBCVE-2022-24706Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.Added to KEV Aug 25, 2022 · 121 days after publicationExploited93% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.8CriticalJul 18, 2013Apache StrutsCVE-2013-2251Affected: Apache Struts 2.0.0 to 2.3.34 and 2.5.0 to 2.5.10. Attacker gains: Remote code execution. Recommended action: Upgrade to Apache Struts 2.3.35 or later, or 2.5.11 or later.Added to KEV Mar 25, 2022 · 3,172 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.1HighSep 19, 2017Apache Tomcat Path traversal / file handlingCVE-2017-12615When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.Added to KEV Mar 25, 2022 · 1,647 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
• 8.1HighOct 3, 2017Apache Tomcat Path traversal / file handlingCVE-2017-12617When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.Added to KEV Mar 25, 2022 · 1,633 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 8.8HighMay 22, 2020Apache Kylin Code / command injectionCVE-2020-1956Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.Added to KEV Mar 25, 2022 · 671 days after publicationExploited97% likelyExploit codeNucleiDetection
• 9.8CriticalFeb 24, 2020Apache Tomcat Privilege escalationCVE-2020-1938Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.Added to KEV Mar 3, 2022 · 737 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.8CriticalJun 1, 2016Apache ActiveMQCVE-2016-3088The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE requestAdded to KEV Feb 10, 2022 · 2,079 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.8CriticalJul 10, 2017Apache Struts 1CVE-2017-9791Apache Struts 1, An attacker gains remote code execution, Update to a fixed version of Apache Struts 1 or migrate to a supported version of Apache Struts 2.Added to KEV Feb 10, 2022 · 1,675 days after publicationExploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• –UnscoredOct 29, 2026Apache Memory corruptionCVE-2026-115942A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
• –UnscoredOct 29, 2026Apache Auth bypass / access controlCVE-2026-114230When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
• –UnscoredOct 29, 2026Apache Denial of serviceCVE-2026-105042A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
• –UnscoredOct 29, 2026Apache Crypto / certificateCVE-2026-105031When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Us
• 4.8MediumOct 29, 2026Apache Camel SSRFCVE-2026-71569Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an IP literal was matched against a li
• –UnscoredOct 28, 2026Apache Kafka Denial of serviceCVE-2026-114349When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer of that size before validating it against the bytes available or any configured limit. The size is attacker-controlled, and the batch CRC does not constrain it, so a small (around 90-byte), CRC-valid compressed produce request can declare a body size of up to about 2 GiB and force the broker to attempt that allocation, raising OutOfMemoryError. Th
• –UnscoredOct 28, 2026Apache Kafka Auth bypass / access controlCVE-2026-112375An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the broker host and return its contents. An IncrementalAlterConfigs (or AlterConfigs) request targeting a BROKER resource reaches the broker's configuration validation before any authorization check is applied to that path. Validation resolves configuration variables such as ${file:/path:key} or ${env:VAR} using a ConfigProvider named in the request
• –UnscoredOct 28, 2026Apache KafkaCVE-2026-116593Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.  An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade
• –UnscoredOct 28, 2026Apache Kafka Auth bypass / access controlCVE-2026-115644Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring the "admin.listeners" property, REST extensions specified via rest.extension.classes (such as BasicAuthSecurityRestExtension) are not registered or applied to the admin resource configuration. While the primary REST API listener (configur
• –UnscoredOct 28, 2026Apache Kafka Denial of serviceCVE-2026-111551Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext (header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length, which could also produce a negative
• –UnscoredOct 28, 2026Apache Kafka Memory corruptionCVE-2026-111496Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to that value, so the next stream-time punctuation overflows to a negative time. PunctuationQueue then re-queues that time and loops on it indefinitely while holding a lock, stalling the StreamThread. Impact: A single reco
• –UnscoredOct 28, 2026Apache KafkaCVE-2026-111115Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size (socket.request.max.bytes); it was not checked against the remaining buffer bytes or capped. Because each entry can be encoded in as little as two bytes (unknown tag 0, size 0), a modest request can declare tens of millions of tagged fields and force one object a
• –UnscoredOct 28, 2026Apache Kafka Denial of serviceCVE-2026-111108Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request can declare far more elements than the buffer holds and still pass. For a keyed array the reader then allocates an ImplicitLinkedHashCollection of capacity (2 * count +1), so a request of a few tens of m
• –UnscoredOct 28, 2026Apache KafkaCVE-2026-111073The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decompressing it. ClientTelemetryUtils.decompress() then decompresses the payload with no limit on the decompressed output size, growing a heap buffer until the compressed input is exhausted. A small, highly compressible payload (for example gzip-compressed zeros) can therefore expand to hundreds of megabytes of broker heap. Impact: An
• –UnscoredOct 28, 2026Apache Kafka Auth bypass / access controlCVE-2026-110985A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset (the default) and no verification key resolver is supplied, DefaultJwtValidator silently falls back to ClientJwtValidator, which does not verify the JWT signature, algorithm, or issuer - and the broker starts with no
• –UnscoredOct 28, 2026Apache Kafka Auth bypass / access controlCVE-2026-110952A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer (iss) claim is verified only when sasl.oauthbearer.expected.issuer is set. When it is unset, a validly-signed token carrying the expected audience is accepted regardless of which issuer minted it. - An audience (aud) claim is required only when sasl.oauthbearer.expected.audien
• –UnscoredOct 28, 2026Apache Kafka Denial of serviceCVE-2026-83525Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER_ACTION privilege to cause a denial of service (controller process termination) via a crafted FetchSnapshot
• 8.8HighOct 26, 2026Apache Airflow SSH provider Code / command injectionCVE-2026-111422In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as `params` or `dag_run.conf` into `environment`, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connect
• 8.8HighOct 26, 2026Apache Vysper Auth bypass / access controlCVE-2026-115748**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this p
• 7.5HighOct 26, 2026Apache Vysper Denial of serviceCVE-2026-115721**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release
• 7.5HighOct 26, 2026Apache CamelCVE-2026-90885Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,
• 5.4MediumOct 26, 2026Apache camel Code / command injectionCVE-2026-95664Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName option configured on the endpoint only when that header is absent. Since 4.8.0, AWS2S3
• 4.8MediumOct 26, 2026Apache CamelCVE-2026-95663Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, and accepts the token while the response reports it as active. The introspection en
• 5.4MediumOct 26, 2026Apache Camel Path traversal / file handlingCVE-2026-95629Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells it where to write the converted document through the --output flag. When the CamelDoclingOutputFilePath header was set, addOutputDirectoryArguments handed its value to that flag verbatim: the valu
• 5.4MediumOct 26, 2026Apache Camel Path traversal / file handlingCVE-2026-95628Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose flags the fix for CVE-2026-40047 restricted to an allowlist. That fix also introduced validateP
• 5.3MediumOct 26, 2026Apache Camel Information disclosureCVE-2026-101259Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Internal Server Error response. The typical case is a type conversion failure: the consumer converts
• 5.3MediumOct 22, 2026Apache DataSketches Memory corruptionCVE-2026-103634Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialize
• 5.9MediumOct 21, 2026Apache Traffic Server Memory corruptionCVE-2026-112381Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 5.3MediumOct 21, 2026Apache Traffic Server Denial of serviceCVE-2026-111817Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. User
• 10.0CriticalOct 21, 2026Apache Traffic Server Crypto / certificateCVE-2026-111815Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 10.0CriticalOct 21, 2026Apache Traffic Server Crypto / certificateCVE-2026-111814Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 10.0CriticalOct 21, 2026Apache Traffic Server Auth bypass / access controlCVE-2026-111812Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 9.0CriticalOct 21, 2026Apache Traffic Server Auth bypass / access controlCVE-2026-111811Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 7.5HighOct 21, 2026Apache Traffic Server Denial of serviceCVE-2026-111810Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 9.3CriticalOct 21, 2026Apache Traffic ServerCVE-2026-111809Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 8.6HighOct 21, 2026Apache Traffic Server Memory corruptionCVE-2026-111808Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 8.6HighOct 21, 2026Apache Traffic Server Denial of serviceCVE-2026-111805Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 9.3CriticalOct 21, 2026Apache Traffic ServerCVE-2026-111816Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16
• 10.0CriticalOct 21, 2026Apache Traffic Server Code / command injectionCVE-2026-111813Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
• 8.2HighOct 21, 2026Apache Traffic Server Memory corruptionCVE-2026-111804Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
• 7.7HighOct 21, 2026Apache Pulsar Path traversal / file handlingCVE-2026-105945The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and pare
• 10.0CriticalOct 21, 2026Apache Pulsar Manager Auth bypass / access controlCVE-2026-105944Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues: - The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. An
• 7.7HighOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105942When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check. First, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the function
• 2.3LowOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105938Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, such as consuming, skipping messages, resetting a cursor or deleting a subscription, apply these subscription policies. Several admin REST API operations that act on subscriptions did not apply them: - th
• 8.7HighOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105937Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE. The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated. It does not authorize the caller
• 5.3MediumOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105936The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors). When authorization is enabled, the worker connectors endpoint requires super-user access. The functions connectors endpoint, served both by the functions worker and by a broker r
• 4.9MediumOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105935The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured broker-client credentials rather than the credentials of the API caller. When authorization is enabled, in Apache Pulsar 2.4.0 and later versions, the trigger endpoint checks only that the caller is author
• 7.2HighOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105934The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a parti
• 2.3LowOct 21, 2026Apache PulsarCVE-2026-105933Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it reads the namespace policies and the topic-level policies as part of topic initialization. If a step of this initialization fails, for example because of an error reading from the metadata store, a fa
• 2.3LowOct 21, 2026Apache Pulsar Auth bypass / access controlCVE-2026-105932The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent topics (/admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters) do not perform this authorization check. The only authorization check these endpoints perform is an indirect lookup permission

See every Apache entry on the dashboard.

Top products

• Apache Traffic Server15 CVEs in the last year, 7 critical
• Apache Tomcat13 CVEs in the last year, 1 critical
• Apache Kafka12 CVEs in the last year
• Apache Pulsar10 CVEs in the last year
• Apache bRPC9 CVEs in the last year
• http server7 CVEs in the last year
• Apache Camel6 CVEs in the last year
• kylin3 CVEs in the last year, 2 critical
• Apache Struts3 CVEs in the last year
• Tomcat2 CVEs in the last year, 1 critical, 1 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• oss-security · Oct 28, 2026CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow readCVE-2026-115942
• oss-security · Oct 28, 2026CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL framesCVE-2026-114230
• oss-security · Oct 28, 2026CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crashCVE-2026-105042
• oss-security · Oct 28, 2026CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.CVE-2026-105031
• oss-security · Oct 28, 2026CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batchesCVE-2026-114349
• oss-security · Oct 28, 2026CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigsCVE-2026-112375
• oss-security · Oct 28, 2026CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpointCVE-2026-116593
• oss-security · Oct 28, 2026CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST ExtensionsCVE-2026-115644
• oss-security · Oct 28, 2026CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuationCVE-2026-111496
• oss-security · Oct 28, 2026CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocationCVE-2026-111551
• oss-security · Oct 28, 2026CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsingCVE-2026-111115
• oss-security · Oct 28, 2026CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of serviceCVE-2026-111073
• oss-security · Oct 28, 2026CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readersCVE-2026-111108
• oss-security · Oct 28, 2026CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredCVE-2026-110985
• oss-security · Oct 28, 2026CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaultCVE-2026-110952