Apache Software Foundation vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-111422 New	AA Apache Airflow SSH provider Apache Software Foundation	–	0%	Oct 26	Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
CVE-2026-115748 New	AV Apache Vysper Apache Software Foundation	8.8	1%	Oct 26	Apache Vysper: Authorization bypass
CVE-2026-115721 New	AV Apache Vysper Apache Software Foundation	7.5	0%	Oct 26	Apache Vysper: Unbounded allocation
CVE-2026-90885 New	AC Apache Camel Apache Software Foundation	7.5	1%	Oct 26	Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
CVE-2026-94386 New	AC Apache Camel Apache Software Foundation	4.8	0%	Oct 26	Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
CVE-2026-110748 New	AS Apache SIS Apache Software Foundation	–	0%	Oct 26	Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
CVE-2026-110733 New	AS Apache SIS Apache Software Foundation	5.4	0%	Oct 26	Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
CVE-2026-95628 New	AC Apache Camel Apache Software Foundation	5.4	0%	Oct 26	Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
CVE-2026-95629 New	AC Apache Camel Apache Software Foundation	5.4	0%	Oct 26	Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
CVE-2026-95663 New	AC Apache Camel Apache Software Foundation	4.8	0%	Oct 26	Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
CVE-2026-95664 New	AC Apache Camel Apache Software Foundation	5.4	0%	Oct 26	Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-101259 New	AC Apache Camel Apache Software Foundation	5.3	0%	Oct 26	Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-113582 New	AA Apache Abdera Apache Software Foundation	7.5	0%	Oct 22	Apache Abdera: XML external entity expansion in Atom document parsing
CVE-2026-103634 New	AD Apache DataSketches Apache Software Foundation	5.3	0%	Oct 22	Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
CVE-2026-112381 New	AT Apache Traffic Server Apache Software Foundation	5.9	0%	Oct 21	Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
CVE-2026-111817 New	AT Apache Traffic Server Apache Software Foundation	5.3	0%	Oct 21	Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
CVE-2026-111812 New	AT Apache Traffic Server Apache Software Foundation	10.0	0%	Oct 21	Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
CVE-2026-111811 New	AT Apache Traffic Server Apache Software Foundation	9.0	0%	Oct 21	Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
CVE-2026-111809 New	AT Apache Traffic Server Apache Software Foundation	9.3	0%	Oct 21	Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
CVE-2026-111810 New	AT Apache Traffic Server Apache Software Foundation	7.5	0%	Oct 21	Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
CVE-2026-111815 New	AT Apache Traffic Server Apache Software Foundation	10.0	0%	Oct 21	Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
CVE-2026-111814 New	AT Apache Traffic Server Apache Software Foundation	10.0	0%	Oct 21	Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
CVE-2026-111808 New	AT Apache Traffic Server Apache Software Foundation	8.6	0%	Oct 21	Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
CVE-2026-111805 New	AT Apache Traffic Server Apache Software Foundation	8.6	0%	Oct 21	Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
CVE-2026-111816 New	AT Apache Traffic Server Apache Software Foundation	9.3	0%	Oct 21	Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
CVE-2025-55702 New	AT Apache Traffic Server Apache Software Foundation	8.7	0%	Oct 21	Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
CVE-2025-31699 New	AT Apache Traffic Server Apache Software Foundation	8.9	0%	Oct 21	Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
CVE-2026-111804 New	AT Apache Traffic Server Apache Software Foundation	8.2	0%	Oct 21	Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
CVE-2026-111813 New	AT Apache Traffic Server Apache Software Foundation	10.0	0%	Oct 21	Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
CVE-2026-105945 New	AP Apache Pulsar Apache Software Foundation	7.7	0%	Oct 21	Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
CVE-2026-105944 New	AP Apache Pulsar Manager Apache Software Foundation	10.0	1%	Oct 21	Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
CVE-2026-105942 New	AP Apache Pulsar Apache Software Foundation	7.7	0%	Oct 21	Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
CVE-2026-105938 New	AP Apache Pulsar Apache Software Foundation	2.3	1%	Oct 21	Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
CVE-2026-105937 New	AP Apache Pulsar Apache Software Foundation	8.7	0%	Oct 21	Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
CVE-2026-105936 New	AP Apache Pulsar Apache Software Foundation	5.3	1%	Oct 21	Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
CVE-2026-105935 New	AP Apache Pulsar Apache Software Foundation	4.9	0%	Oct 21	Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
CVE-2026-105934 New	AP Apache Pulsar Apache Software Foundation	7.2	0%	Oct 21	Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
CVE-2026-105933 New	AP Apache Pulsar Apache Software Foundation	2.3	0%	Oct 21	Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
CVE-2026-105932 New	AP Apache Pulsar Apache Software Foundation	2.3	1%	Oct 21	Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
CVE-2026-105931 New	AP Apache Pulsar Apache Software Foundation	2.3	1%	Oct 21	Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
CVE-2026-105930 New	AP Apache Pulsar Apache Software Foundation	6.0	0%	Oct 21	Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
CVE-2026-105927 New	AP Apache Pulsar Apache Software Foundation	2.3	0%	Oct 21	Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
CVE-2026-105926 New	AP Apache Pulsar Apache Software Foundation	5.3	0%	Oct 21	Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
CVE-2026-105869 New	AP Apache Pulsar Apache Software Foundation	9.2	0%	Oct 21	Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
CVE-2026-90484 New	AB Apache bRPC Apache Software Foundation	6.5	0%	Oct 21	Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
CVE-2026-87849 New	AB Apache bRPC Apache Software Foundation	4.3	0%	Oct 21	Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
CVE-2026-86249 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
CVE-2026-86147 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
CVE-2026-86146 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
CVE-2026-84748 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
CVE-2026-84747 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
CVE-2026-84727 New	AB Apache bRPC Apache Software Foundation	5.4	0%	Oct 21	Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message
CVE-2026-82953 New	AB Apache bRPC Apache Software Foundation	5.3	0%	Oct 21	Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
CVE-2026-82942 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
CVE-2026-82425 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
CVE-2026-82231 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
CVE-2026-82230 New	AB Apache bRPC Apache Software Foundation	7.5	1%	Oct 21	Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
CVE-2026-82210 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
CVE-2026-81755 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
CVE-2026-80463 New	AB Apache bRPC Apache Software Foundation	–	0%	Oct 21	Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly