https://vulnogram.org/ Most recent CVEs assigned by Apache Software Foundation (apache). https://vulnogram.org/seaview/icons/apache.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-107755 https://vulnogram.org/CVE-2026-107755 Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended… Medium Tue, 20 Oct 2026 15:41:22 GMT https://vulnogram.org/CVE-2026-90800 https://vulnogram.org/CVE-2026-90800 Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases… High Network Exploitable Tue, 20 Oct 2026 15:40:47 GMT https://vulnogram.org/CVE-2026-90799 https://vulnogram.org/CVE-2026-90799 Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue. Low Tue, 20 Oct 2026 15:40:16 GMT https://vulnogram.org/CVE-2026-90798 https://vulnogram.org/CVE-2026-90798 A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgra… Low Tue, 20 Oct 2026 15:39:52 GMT https://vulnogram.org/CVE-2026-90797 https://vulnogram.org/CVE-2026-90797 An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issu… High Network Exploitable Tue, 20 Oct 2026 15:39:23 GMT https://vulnogram.org/CVE-2026-86471 https://vulnogram.org/CVE-2026-86471 An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which… Critical Tue, 20 Oct 2026 15:38:09 GMT https://vulnogram.org/CVE-2026-103119 https://vulnogram.org/CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the se… Critical Network Exploitable Tue, 20 Oct 2026 13:54:13 GMT https://vulnogram.org/CVE-2026-101356 https://vulnogram.org/CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 1… Critical Network Exploitable Tue, 20 Oct 2026 13:46:50 GMT https://vulnogram.org/CVE-2026-101296 https://vulnogram.org/CVE-2026-101296 A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affe… Critical Network Exploitable Tue, 20 Oct 2026 13:45:39 GMT https://vulnogram.org/CVE-2026-93446 https://vulnogram.org/CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommen… Tue, 20 Oct 2026 13:44:35 GMT https://vulnogram.org/CVE-2026-88041 https://vulnogram.org/CVE-2026-88041 Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 t… Tue, 20 Oct 2026 13:43:28 GMT https://vulnogram.org/CVE-2026-80353 https://vulnogram.org/CVE-2026-80353 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addres… Tue, 20 Oct 2026 13:42:05 GMT https://vulnogram.org/CVE-2026-74049 https://vulnogram.org/CVE-2026-74049 Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was cr… Tue, 20 Oct 2026 13:37:43 GMT https://vulnogram.org/CVE-2026-74048 https://vulnogram.org/CVE-2026-74048 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configu… Tue, 20 Oct 2026 13:36:36 GMT https://vulnogram.org/CVE-2026-108089 https://vulnogram.org/CVE-2026-108089 ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of… High Network Exploitable Unsupported When Assigned Tue, 20 Oct 2026 10:25:54 GMT https://vulnogram.org/CVE-2026-108088 https://vulnogram.org/CVE-2026-108088 ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue… Unsupported When Assigned Tue, 20 Oct 2026 10:25:33 GMT https://vulnogram.org/CVE-2026-108087 https://vulnogram.org/CVE-2026-108087 ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL in… Unsupported When Assigned Tue, 20 Oct 2026 10:25:12 GMT https://vulnogram.org/CVE-2026-108086 https://vulnogram.org/CVE-2026-108086 ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, inc… Unsupported When Assigned Tue, 20 Oct 2026 10:24:53 GMT https://vulnogram.org/CVE-2026-92287 https://vulnogram.org/CVE-2026-92287 Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation. On the reader side,… Tue, 20 Oct 2026 08:15:13 GMT https://vulnogram.org/CVE-2026-86467 https://vulnogram.org/CVE-2026-86467 Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a… Tue, 20 Oct 2026 02:37:07 GMT https://vulnogram.org/CVE-2026-88900 https://vulnogram.org/CVE-2026-88900 Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls f… High Mon, 19 Oct 2026 11:07:34 GMT https://vulnogram.org/CVE-2026-91858 https://vulnogram.org/CVE-2026-91858 FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On t… Medium Network Exploitable Mon, 19 Oct 2026 10:47:48 GMT https://vulnogram.org/CVE-2026-88901 https://vulnogram.org/CVE-2026-88901 Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (… High Network Exploitable Mon, 19 Oct 2026 10:44:07 GMT https://vulnogram.org/CVE-2026-85317 https://vulnogram.org/CVE-2026-85317 Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted… Medium Network Exploitable Mon, 19 Oct 2026 10:43:39 GMT https://vulnogram.org/CVE-2026-85316 https://vulnogram.org/CVE-2026-85316 Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by tes… Medium Network Exploitable Mon, 19 Oct 2026 10:43:00 GMT https://vulnogram.org/CVE-2026-85315 https://vulnogram.org/CVE-2026-85315 Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception… Medium Network Exploitable Mon, 19 Oct 2026 10:42:10 GMT https://vulnogram.org/CVE-2026-85314 https://vulnogram.org/CVE-2026-85314 Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header… Medium Network Exploitable Mon, 19 Oct 2026 10:41:45 GMT https://vulnogram.org/CVE-2026-85313 https://vulnogram.org/CVE-2026-85313 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossO… Medium Network Exploitable Mon, 19 Oct 2026 10:40:58 GMT https://vulnogram.org/CVE-2026-85312 https://vulnogram.org/CVE-2026-85312 Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exch… Medium Network Exploitable Mon, 19 Oct 2026 10:40:26 GMT https://vulnogram.org/CVE-2026-85300 https://vulnogram.org/CVE-2026-85300 Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions t… Medium Mon, 19 Oct 2026 10:40:04 GMT https://vulnogram.org/CVE-2026-85301 https://vulnogram.org/CVE-2026-85301 Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the intros… Medium Network Exploitable Mon, 19 Oct 2026 10:39:46 GMT https://vulnogram.org/CVE-2026-85296 https://vulnogram.org/CVE-2026-85296 Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that… Medium Network Exploitable Mon, 19 Oct 2026 10:38:11 GMT https://vulnogram.org/CVE-2026-85260 https://vulnogram.org/CVE-2026-85260 Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether… Medium Mon, 19 Oct 2026 10:37:42 GMT https://vulnogram.org/CVE-2026-85257 https://vulnogram.org/CVE-2026-85257 Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a CXF SOAP consumer failed with an exc… Medium Network Exploitable Mon, 19 Oct 2026 10:37:14 GMT https://vulnogram.org/CVE-2026-85254 https://vulnogram.org/CVE-2026-85254 Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The guard that prevents a request header being reflected into the respo… Medium Network Exploitable Mon, 19 Oct 2026 10:36:46 GMT https://vulnogram.org/CVE-2026-71253 https://vulnogram.org/CVE-2026-71253 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 b… Critical Network Exploitable Mon, 19 Oct 2026 10:36:41 GMT https://vulnogram.org/CVE-2026-85251 https://vulnogram.org/CVE-2026-85251 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is… High Network Exploitable Mon, 19 Oct 2026 10:36:09 GMT https://vulnogram.org/CVE-2026-85250 https://vulnogram.org/CVE-2026-85250 Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the p… High Network Exploitable Mon, 19 Oct 2026 10:35:21 GMT https://vulnogram.org/CVE-2026-85249 https://vulnogram.org/CVE-2026-85249 Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Ex… Medium Network Exploitable Mon, 19 Oct 2026 10:34:39 GMT https://vulnogram.org/CVE-2026-85248 https://vulnogram.org/CVE-2026-85248 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single… Medium Network Exploitable Mon, 19 Oct 2026 10:34:16 GMT https://vulnogram.org/CVE-2026-85247 https://vulnogram.org/CVE-2026-85247 Improper Certificate Validation vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When SSL was enabled on the Knative HTTP client but no truststore was configured, t… Medium Network Exploitable Mon, 19 Oct 2026 10:33:39 GMT https://vulnogram.org/CVE-2026-85246 https://vulnogram.org/CVE-2026-85246 Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer… Medium Network Exploitable Mon, 19 Oct 2026 10:33:16 GMT https://vulnogram.org/CVE-2026-85245 https://vulnogram.org/CVE-2026-85245 Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultI… Medium Network Exploitable Mon, 19 Oct 2026 10:32:44 GMT https://vulnogram.org/CVE-2026-85243 https://vulnogram.org/CVE-2026-85243 Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal() verified the modification detection code only when the… Medium Network Exploitable Mon, 19 Oct 2026 10:32:21 GMT https://vulnogram.org/CVE-2026-84181 https://vulnogram.org/CVE-2026-84181 Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Shiro security processor skipped credential verification when the subject already bound t… Medium Network Exploitable Mon, 19 Oct 2026 10:31:41 GMT https://vulnogram.org/CVE-2026-84180 https://vulnogram.org/CVE-2026-84180 Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed on the consumer… Medium Network Exploitable Mon, 19 Oct 2026 10:31:08 GMT https://vulnogram.org/CVE-2026-84178 https://vulnogram.org/CVE-2026-84178 Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the… Medium Network Exploitable Mon, 19 Oct 2026 10:30:42 GMT https://vulnogram.org/CVE-2026-84176 https://vulnogram.org/CVE-2026-84176 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-Control-Allow-Cred… Medium Network Exploitable Mon, 19 Oct 2026 10:30:00 GMT https://vulnogram.org/CVE-2026-83531 https://vulnogram.org/CVE-2026-83531 Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4… High Mon, 19 Oct 2026 10:29:33 GMT https://vulnogram.org/CVE-2026-80344 https://vulnogram.org/CVE-2026-80344 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. In the AS2 protocol the sender of a message may request that the Message Disposition… High Network Exploitable Mon, 19 Oct 2026 10:28:48 GMT