Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how apache compares to other vendors in security performance

View Risk Score →

Software

apache http server
467
apache tomcat
250
apache airflow
204
apache traffic server
124
apache superset
103
apache activemq
97
apache ofbiz
97
apache cxf
84
apache camel
76
apache openoffice
75
apache nifi
62
apache struts 2
61
apache thrift
59
apache solr
49
apache cloudstack
46
apache dolphinscheduler
44
apache inlong
44
apache struts
44
apache iotdb
43
apache answer
40
apache tika
40
apache apisix
37
apache hadoop
37
apache ranger
33
apache ambari
32
apache openmeetings
32
apache syncope
31
apache wicket
31
apache zeppelin
31
apache fineract
29
apache jspwiki
29
apache shiro
29
apache apache airflow
28
apache kylin
26
apache log4j
26
apache nimble
26
apache apache cxf
25
apache archiva
24
apache linkis
24
apache kafka
23
apache spark
23
apache activemq all
22
apache james
22
apache streampark
22
apache activemq broker
21
apache apache camel
21
apache pulsar
21
apache qpid
20
apache qpid broker-j
20
apache cassandra
19

Apache StrutsApache Struts: Shared serialization state in the JSON plugin

Risk 27
First published (updated )
CVE-2026-73632

Apache Apache StrutsApache Struts: Shared parsing state in the JSON plugin

Risk 37
First published (updated )
CVE-2026-73631

Apache StrutsApache Struts: Unbounded growth of localized-text caches driven by the request locale

Risk 36
First published (updated )
CVE-2026-73635

Apache StrutsApache Struts: Unbounded read of a Content Security Policy violation report

Risk 28
First published (updated )
CVE-2026-73634

Apache StrutsApache Struts: Unbounded read of a JSON request body

Risk 43
Severity
7.5
First published (updated )
CVE-2026-73633
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache Shindig CommonApache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

Risk 70
Severity
7.2
Trending
Week
First published (updated )
CVE-2026-66256

oss-secCVE-2026-66256: Apache Shindig Common, Apache Shindig Social-Api: mote Code Execution via XStam deserialization (OpenSocial ST API)

First published (updated )
https://seclists.org/oss-sec/2026/q3/483

oss-secCVE-2026-71290: Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

First published (updated )
https://seclists.org/oss-sec/2026/q3/481

oss-secCVE-2026-64607: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

First published (updated )
https://seclists.org/oss-sec/2026/q3/490

Apache AlluraApache Allura: XSS in markdown pipeline

Risk 38
Severity
6.1
First published (updated )
CVE-2026-73237
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AlluraApache Allura: XSS in code display

Risk 38
Severity
6.1
First published (updated )
CVE-2026-73238

Apache AlluraApache Allura: Missing permission checks IDOR

Risk 38
Severity
6.5
First published (updated )
CVE-2026-73239

Apache AlluraApache Allura: Git command injection

Risk 86
Severity
9.8
First published (updated )
CVE-2026-73240

Apache AirflowApache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Risk 38
Severity
6.5
First published (updated )
CVE-2026-59244

apache-airflowApache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Risk 79
Severity
8.8
First published (updated )
CVE-2026-58076
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache Apache AirflowApache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Risk 34
Severity
5.4
First published (updated )
CVE-2026-59242

Apache Apache AirflowApache Airflow: Airflow Variables were not masked in the UI for authenticated users

Risk 22
Severity
4.3
First published (updated )
CVE-2026-54183

Apache AirflowApache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Risk 51
Severity
7.3
First published (updated )
CVE-2026-67260

Apache Apache AirflowApache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget

Risk 79
Severity
8.8
First published (updated )
CVE-2026-67587

Apache AirflowApache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Risk 38
Severity
6.5
First published (updated )
CVE-2026-65017
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache AirflowApache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id

Risk 43
Severity
7.5
First published (updated )
CVE-2026-68968

Apache AirflowApache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68969

Apache Apache AirflowApache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68970

Apache Apache AirflowApache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68971

Apache AirflowApache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Risk 34
Severity
5.4
First published (updated )
CVE-2026-68076
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache Airflow Google ProviderApache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68868

Apache HttpComponents ClientApache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)

Risk 70
Severity
9.1
Trending
Week
First published (updated )
CVE-2026-71290

Apache AlluraApache Allura: Server-side request forgery

Risk 66
Severity
9.1
First published (updated )
CVE-2026-69223

Apache Apache Airflow Amazon providerApache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

Risk 38
Severity
6.5
First published (updated )
CVE-2026-68872

Apache Apache TapestryApache Tapestry: Possible classpath file download through URL manipulation

Risk 43
Severity
7.5
First published (updated )
CVE-2026-61899
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203