Apache

CVE-2024-27348 is a critical RCE vulnerability in Apache HugeGraph-Server (<= 3.7.1) that allows attackers to execute arbitrary Java code via the /gremlin endpoint, facilitating the deployment of web shells.

The camel-azure-files component in Apache Camel is vulnerable to path traversal (CVE-2026-79986) due to insufficient validation of filenames returned during Azure File share listing, allowing unauthorized file access, deletion, or renaming.

Apache Ranger versions 2.8.0 and earlier are vulnerable to OS command injection via the UnixUserGroupBuilder component when processing crafted usernames containing shell metacharacters.

Multiple vulnerabilities in Apache Traffic Server allow a remote, unauthenticated attacker to execute arbitrary code, bypass security controls, perform data manipulation, or trigger a denial-of-service condition.

CVE-2026-85260 is an information disclosure vulnerability in the Apache Camel MLLP component where sensitive HL7 clinical messages are written to application logs by default, exposing protected health information.

CVE-2024-34693 is an arbitrary file read vulnerability in Apache Superset (versions < 3.1.3 and 4.0.1) that allows authenticated attackers to leverage rogue MariaDB servers and the LOAD DATA LOCAL INFILE command to exfiltrate sensitive files.

Apache Answer versions 2.0.2 and earlier contain an authentication bypass vulnerability in the reaction API that allows unauthorized users to access restricted metadata and manipulate content reactions.

CVE-2026-85251 allows for unauthorized credential exposure when the camel-http component follows HTTP redirects to attacker-controlled hosts.

An XML External Entity (XXE) vulnerability in the Apache Camel camel-xpath component allows attackers to trigger local file disclosure or server-side request forgery when documentType is set to InputSource.

Vulnerabilities in Apache Camel HTTP producers allow unauthenticated users to trigger arbitrary property resolution and bean method invocation via manipulated CamelHttpUri or CamelRestHttpUri headers.

An insecure installation directory permission flaw in Apache Lounge allows local users to achieve SYSTEM-level privilege escalation via DLL search order hijacking.

CVE-2022-42889, or Text4Shell, is a critical remote code execution vulnerability in Apache Commons Text versions 1.5-1.9 that allows attackers to execute arbitrary code via malicious string lookups.

Apache Tika-server versions prior to 1.18 are susceptible to unauthenticated remote command injection via malicious HTTP headers in PUT requests, allowing arbitrary code execution.

The InstaWP Connect WordPress plugin (<= 0.1.3.6) is vulnerable to remote code execution due to insecure configuration file storage and missing access controls on Apache servers with directory listing enabled.

Apache Qpid Broker-J versions through 10.0.1 are vulnerable to a pre-authentication denial of service attack where an attacker triggers a StackOverflowError through crafted type nesting.

A vulnerability in Apache Tomcat allows a remote, anonymous attacker to perform a Denial of Service attack, potentially disrupting service availability for applications hosted on the affected server.

Multiple vulnerabilities in Apache Traffic Server can be exploited by a remote, anonymous attacker to bypass security measures, disclose or manipulate data, trigger a denial-of-service, and potentially achieve code execution.

An anonymous, remote attacker can exploit a vulnerability in Apache Axis2 to execute arbitrary program code. This flaw allows for critical remote code execution without authentication, posing a significant risk to systems running the affected software.

Multiple vulnerabilities, including decompression bombs (CVE-2026-48586, CVE-2026-49158), an integer overflow (CVE-2026-55969), and a heap out-of-bounds read (CVE-2026-58023), affect Apache Thrift prior to version 0.24.0, potentially leading to denial of service, memory corruption, or arbitrary code execution, and require immediate patching.

An unauthenticated, remote attacker can exploit a vulnerability in Apache Airflow FAB provider to bypass security measures and escalate privileges to gain administrator rights, allowing full control of the affected system.

Multiple vulnerabilities, including CVE-2026-59083 and CVE-2026-59084, have been discovered in Apache Tomcat versions 10.1.x prior to 10.1.57, 11.0.x prior to 11.0.24, and 9.0.x prior to 9.0.120, allowing an attacker to bypass security policies and cause an unspecified security issue.

A remote, authenticated attacker can exploit a Cross-Site Scripting (XSS) vulnerability in Apache ActiveMQ to execute malicious scripts within a victim's browser.

An attacker can exploit multiple vulnerabilities in Apache Airflow to bypass security controls and escalate their privileges, as reported by CERT-Bund.

Multiple vulnerabilities exist in Apache Camel that an attacker can exploit to bypass security controls and execute arbitrary program code, potentially leading to system compromise and unauthorized operations.

cPanel released security advisories addressing CVE-2026-33278 in cPanel & WebHost Manager (WHM) software and EasyApache4, prompting users to apply necessary updates.

A remote, anonymous attacker can exploit a vulnerability in Apache Tomcat to bypass security measures.

A public exploit has been released for CVE-2019-0227, a Server-Side Request Forgery vulnerability in Apache Axis 1.4 and earlier, allowing unauthenticated remote command execution when `enableRemoteAdmin` is true via deployment of a malicious webservice and webshell.

A local attacker can exploit a vulnerability in Apache Cassandra to execute arbitrary program code, potentially leading to complete system compromise.

A remote, authenticated attacker can exploit multiple vulnerabilities in Apache Airflow Providers OpenSearch and Elasticsearch to disclose sensitive information.

A vulnerability in Apache HTTP Server's HTTP/2 protocol can lead to denial of service by crashing worker processes, and in specific configurations (APR with mmap), remote code execution.

Multiple vulnerabilities in Apache HTTP Server can be exploited by an attacker to gain elevated privileges, execute arbitrary code, bypass security measures, disclose sensitive information, or cause a denial-of-service condition.

Multiple vulnerabilities in Apache HTTP Server versions prior to 2.4.67 can allow remote attackers to execute arbitrary code, escalate privileges, or cause a denial of service.

An authenticated remote attacker can exploit multiple vulnerabilities in Apache ActiveMQ to execute arbitrary program code or perform cross-site scripting attacks.

A remote attacker can exploit multiple vulnerabilities in Apache Traffic Server to conduct a denial of service or request smuggling attack.

A remote, anonymous attacker can exploit a vulnerability in Apache Commons FileUpload to perform a denial of service attack.

Critical vulnerabilities, CVE-2026-27636 and CVE-2026-27637, exist in FreeScout Help Desk that could be exploited to achieve remote code execution, potentially leading to data exfiltration and system compromise.

Mod_gnutls versions prior to 0.12.3 and 0.13.0 are vulnerable to a certificate chain overflow when verifying client certificates, potentially leading to a segfault or stack corruption.