Vulnerabilidades em Apache Software Foundation

2.398 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2026-27315MEDIUMApache Cassandra: cqlsh history sensitive information leakEPSS 0.2%CVE-2026-92564—Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingEPSS 0.2%CVE-2025-27446HIGHApache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privilegesEPSS 0.2%CVE-2026-94251MEDIUMApache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resourceEPSS 0.2%CVE-2026-82381MEDIUMApache Roller: Stored cross-site scripting in the authoring UIEPSS 0.2%CVE-2026-82387MEDIUMApache Roller: Stored cross-site scripting via uploaded media content typeEPSS 0.2%CVE-2026-86247HIGHApache Tomcat Native: Client certificate requirements can be down-gradedEPSS 0.2%CVE-2026-91928MEDIUMApache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanismsEPSS 0.2%CVE-2026-73192MEDIUMApache Sling XSS: XSS possible through XSSAPI.getValidHref()EPSS 0.2%CVE-2026-92001MEDIUMApache Sling XSS: Missing parser resource limitsEPSS 0.2%CVE-2026-91999MEDIUMApache Sling XSS: Improper escaping in the XSS Webconsole pluginEPSS 0.2%CVE-2026-45188LOWApache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename HandlingEPSS 0.2%CVE-2026-82427HIGHApache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local NameEPSS 0.2%CVE-2026-82430HIGHApache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the TenantEPSS 0.1%CVE-2026-94243HIGHApache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidenceEPSS 0.1%CVE-2026-82429HIGHApache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker LauncherEPSS 0.1%CVE-2026-73581MEDIUMApache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystoreEPSS 0.1%CVE-2026-91006—Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)EPSS —