Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how apache compares to other vendors in security performance

View Risk Score →

Software

apache http server
44
apache ofbiz
27
apache tomcat
23
apache camel
22
apache struts 2
22
apache openoffice
20
apache activemq
15
apache airflow
15
apache dubbo
13
apache inlong
13
apache iotdb
13
apache cxf
12
apache hadoop
12
apache traffic server
12
apache cloudstack
10
apache jmeter
10
apache log4j
10
apache shiro
9
apache kylin
8
apache dolphinscheduler
7
apache fineract
7
apache solr
7
apache syncope
7
apache mina
6
apache struts
6
apache apache camel
5
apache couchdb
5
apache geode
5
apache ignite
5
apache linkis
5
apache nuttx rtos
5
apache openmeetings
5
apache ranger
5
apache superset
5
apache james
4
apache polaris
4
apache portable runtime
4
apache pulsar
4
apache storm
4
apache submarine
4
apache tapestry
4
apache airflow hive provider
3
apache ambari
3
apache any23
3
apache apache mina
3
apache apisix
3
apache cassandra
3
apache doris
3
apache druid
3
apache flume
3

Apache Apache ForyApache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

Risk 90
Severity
9.8
First published (updated )
CVE-2026-64606

Apache ForyApache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

Risk 70
Severity
9.1
First published (updated )
CVE-2026-64609

Apache Fory (C++)Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

Risk 90
Severity
9.8
First published (updated )
CVE-2026-64608

Apache SyncopeApache Syncope: User self-service privilege escalation

Risk 90
Severity
9.8
First published (updated )
CVE-2026-62183

Apache SyncopeApache Syncope: SQL injection vulnerability in Audit Events search

Risk 90
Severity
9.8
First published (updated )
CVE-2026-57308
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache SyncopeApache Syncope: Remote Code Execution via Scripted Connector

Risk 90
Severity
9.8
First published (updated )
CVE-2026-53421

Apache SyncopeApache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask

Risk 90
Severity
9.8
First published (updated )
CVE-2026-53405

Apache SyncopeApache Syncope: RCE via Groovy Sandbox bypass

Risk 90
Severity
9.8
First published (updated )
CVE-2026-63071

Apache TomcatApache Tomcat: EncryptInterceptor requirements not clearly documented

Risk 70
Severity
9.1
First published (updated )
CVE-2026-59084

Apache TomcatApache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Risk 70
Severity
9.1
First published (updated )
CVE-2026-59083
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache KylinApache Kylin: OS Command Injection via Async Query API

Risk 90
Severity
9.8
First published (updated )
CVE-2026-62392

Apache KylinApache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API

Risk 90
Severity
9.8
First published (updated )
CVE-2026-62390

Apache DorisApache Doris: Improper Authentication in Frontend HTTP API

Risk 70
Severity
9.1
First published (updated )
CVE-2026-58319

Apache GravitinoApache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

Risk 70
Severity
9.1
First published (updated )
CVE-2026-41041

Apache IoTDBApache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC

Risk 90
Severity
9.8
First published (updated )
CVE-2026-40008
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache IoTDBApache IoTDB: Path Traversal in Pipe File Transfer Receiver

Risk 70
Severity
9.1
First published (updated )
CVE-2026-40005

Apache IoTDBApache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials

Risk 90
Severity
9.8
First published (updated )
CVE-2026-28564

Apache GravitinoApache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter

Risk 70
Severity
9.1
First published (updated )
CVE-2026-41042

Apache Apache AirflowApache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

Risk 90
Severity
9.8
First published (updated )
CVE-2026-33264

Apache IoTDBApache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC

Risk 70
Severity
9.1
First published (updated )
CVE-2026-24013
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache IoTDBApache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

Risk 90
Severity
9.8
First published (updated )
CVE-2026-24014

Apache CamelApache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

Risk 90
Severity
9.8
First published (updated )
CVE-2026-43867

Apache CamelApache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

Risk 89
Severity
9.8
First published (updated )
CVE-2026-46456

Apache CamelApache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Risk 86
Severity
9.8
First published (updated )
CVE-2026-46455

Apache CamelApache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Risk 86
Severity
9.8
First published (updated )
CVE-2026-46454
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache CamelApache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Risk 66
Severity
9.1
First published (updated )
CVE-2026-40047

Apache CamelApache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components

Risk 90
Severity
9.8
First published (updated )
CVE-2026-56140

Apache CamelApache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted

Risk 90
Severity
9.8
First published (updated )
CVE-2026-53913

Apache CamelApache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

Risk 70
Severity
9.1
First published (updated )
CVE-2026-48205

Apache CamelApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

Risk 90
Severity
9.8
First published (updated )
CVE-2026-48204
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203