Login Request a demo
KA
Product
Karaf
by Apache · last CVE Sep 29, 2026
18
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 4High 7Medium 7Low 0
Severity
All severities18Critical4High7Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Karaf to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-92142
8.8
1%
Sep 29
Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Affected: before 4.4.12
CVE-2026-91006
8.8
1%
Sep 28
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Affected: before 4.4.12
CVE-2018-11786
8.8
2%
Sep 18
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can…
Affected: before 4.2.0
CVE-2021-41766
8.1
2%
Jan 26
Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX)
Affected: before 4.3.6
CVE-2020-28052
8.1
7%
Dec 18
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66
Affected: 4.3.2
CVE-2018-11787
8.1
3%
Sep 18
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to…
Affected: before 3.0.9; 4.0.0 before 4.0.9; 4.1.0 before 4.1.1; 4.0.0; 4.0.0; 4.0.0
CVE-2026-90979
7.3
0%
Sep 28
Apache Karaf: LDAP filter injection in JAAS LDAP login modules
Affected: before 4.4.12
Showing 7