Vulnerabilities in Apache Software Foundation

1,896 results
Vexday analysis

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2025-33042HIGHApache Avro Java SDK: Code injection on Java generated codeEPSS 0.6%CVE-2026-45361HIGHApache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)EPSS 0.6%CVE-2025-66249MEDIUMApache Livy: Unauthorized directory accessEPSS 0.6%CVE-2025-59390CRITICALApache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.EPSS 0.6%CVE-2024-47249MEDIUMApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerEPSS 0.6%CVE-2025-26521HIGHApache CloudStack: CKS cluster in project exposes user API keysEPSS 0.6%CVE-2017-12618—Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functioEPSS 0.6%CVE-2023-39441—Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationEPSS 0.6%CVE-2026-29169HIGHApache HTTP Server: mod_dav_lock indirect lock crashEPSS 0.6%CVE-2026-41603HIGHApache Thrift: Java TSSLTransportFactory hostname verificationEPSS 0.6%CVE-2025-50213CRITICALApache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorEPSS 0.6%CVE-2022-38170—Overly permissive umask for daemonsEPSS 0.6%CVE-2026-33858HIGHApache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APIEPSS 0.6%CVE-2025-59328MEDIUMApache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large DataEPSS 0.6%CVE-2025-48208HIGHApache HertzBeat (incubating): Jmx JNDI injection vulnerabilityEPSS 0.6%CVE-2026-31379MEDIUMApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog ManagerEPSS 0.6%CVE-2025-68438HIGHApache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncatedEPSS 0.6%CVE-2024-45772MEDIUMApache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization IssueEPSS 0.6%CVE-2026-24015CRITICALApache IoTDB: Insecure Default Configuration VulnerabilityEPSS 0.6%CVE-2026-44185HIGHApache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`EPSS 0.6%