Vulnerabilities in Apache Software Foundation

1,884 results
Vexday analysis

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2017-15696—When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configurEPSS 2.0%CVE-2022-26477—Denial of service in readExternal methodEPSS 2.0%CVE-2022-40955HIGHDeserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBCEPSS 2.0%CVE-2021-41766—Insecure Java Deserialization in Apache KarafEPSS 2.0%CVE-2022-25169—Apache Tika BPGParser Memory Usage DoSEPSS 2.0%CVE-2025-54539CRITICALApache ActiveMQ NMS AMQP Client: Deserialization of Untrusted DataEPSS 2.0%CVE-2024-52317MEDIUMApache Tomcat: Request/response mix-up with HTTP/2EPSS 2.0%CVE-2023-30631—Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't workEPSS 2.0%CVE-2016-8648HIGHIt was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via EPSS 2.0%CVE-2017-12614—It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS atteEPSS 2.0%CVE-2018-8031—The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a maliciousEPSS 2.0%CVE-2017-5660—There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can EPSS 2.0%CVE-2016-8742—The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit tEPSS 2.0%CVE-2023-27602CRITICALApache Linkis publicsercice module unrestricted upload of fileEPSS 2.0%CVE-2022-23974—Pinot segment push endpoint has a vulnerability in unprotected environmentsEPSS 2.0%CVE-2017-7683—Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.EPSS 2.0%CVE-2018-1314—In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a queryEPSS 2.0%CVE-2018-1338—A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.EPSS 2.0%CVE-2023-25696CRITICALApache Airflow Hive Provider Beeline RCEEPSS 2.0%CVE-2025-68675HIGHApache Airflow: proxy credentials for various providers might leak in task logsEPSS 2.0%