Vendor
Apache Software Foundation
3,000 known vulnerabilities.
Products
954 results · Clear filters · Feed
-
Medium 4.8CVE-2026-85312 Public exploit
Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belo…
-
Medium 5.5CVE-2026-85300 Public exploit
Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the proces…
-
Medium 4.8CVE-2026-85301 Public exploit
Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim
Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection r…
-
Medium 6.5CVE-2026-85296 Public exploit
Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared…
-
Medium 5.5CVE-2026-85260 Public exploit
Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payl…
-
Medium 5.3CVE-2026-85257 Public exploit
Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exception th…
-
Medium 6.5CVE-2026-85254 Public exploit
Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the response compa…
-
Medium 6.5CVE-2026-85249 Public exploit
Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as…
-
Medium 5.9CVE-2026-85248 Public exploit
Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.sec…
-
Medium 5.9CVE-2026-85247 Public exploit
Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, the client…
-
Medium 5.3CVE-2026-85246 Public exploit
Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote exc…
-
Medium 5.9CVE-2026-85245 Public exploit
Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance o…
-
Medium 5.9CVE-2026-85243 Public exploit
Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure
Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal() verified the modification detection code only when the message w…
-
Medium 5.9CVE-2026-84181 Public exploit
Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse
Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Shiro security processor skipped credential verification when the subject already bound to the cur…
-
Medium 5.3CVE-2026-84180 Public exploit
Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer side, the…
-
Medium 6.1CVE-2026-84178 Public exploit
Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authoriza…
-
Medium 6.5CVE-2026-84176 Public exploit
Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Credentials: …
-
Medium 5.9CVE-2026-78163 Public exploit
Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component. This issue affects Apache Camel:…
-
Medium 5.4
Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, al…
-
Medium 4.3
Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public q…
-
Medium 5.3
Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content through public user profiles. Users are recommended to upgrade to version 2.0.3, which fixes th…
-
Medium 4.3
Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pendi…
-
Medium 5.3
Apache Answer: Improper Authorization in Question Invite User Lookup
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization che…
-
Medium 5.4
Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommende…
-
Medium 5.4
Apache Answer: Stored XSS via unsanitized HTML in imported question content
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the nor…
-
Medium 6.5
Apache Kylin: Potential JDBC source configuration validation issue
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to ver…
-
Medium 5.3
Apache Kylin: tables/names SparkSQL injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from…
-
Medium 6.5
Apache Kylin: missing JDBC-config authorization
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4…
-
Medium 6.5
Apache Kylin: job-driver UI proxy SSRF
Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from …
-
Medium 4.3
Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or o…
-
Medium 5.8
Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the …
-
Medium 6.5
Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are aff…
-
Medium 6.1
Apache CXF: OIDC RP Open Redirect
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating tha…
-
Medium 6.5
Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessa…
-
Medium 6.5
Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against …
-
Medium 6.9
Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies
— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr…
-
Medium 4.8
Apache YuniKorn: Admission control bypass via system label forgery
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify th…
-
Medium 5.4
Apache Impala: Stored XSS in Impala query plans
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are…
-
Medium 6.5
Apache Impala: Path traversal executes JARs outside trusted paths
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The startup flag 'trusted_jar_paths' references URIs for loading files f…
-
Medium 5.3
Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs di…