Vulnerabilidades em Apache Software Foundation

2.378 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2024-39863HIGHApache Airflow: Potential XSS VulnerabilityEPSS 1.0%CVE-2024-27347MEDIUMApache HugeGraph-Hubble: SSRF in Hubble connection pageEPSS 1.0%CVE-2019-10084—In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sEPSS 1.0%CVE-2026-49297HIGHApache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)EPSS 1.0%CVE-2025-50151HIGHApache Jena: Configuration files uploaded by administrative users are not check properlyEPSS 1.0%CVE-2026-71558CRITICALApache Fory: Heap type confusion in C++ polymorphic smart-pointer deserializationEPSS 1.0%CVE-2026-33006MEDIUMApache HTTP Server: mod_auth_digest timing attackEPSS 1.0%CVE-2023-38522HIGHApache Traffic Server: Incomplete field name check allows request smugglingEPSS 1.0%CVE-2018-11781—Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.EPSS 1.0%CVE-2026-43865HIGHApache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionEPSS 1.0%CVE-2024-41151HIGHApache HertzBeat: RCE by notice template injection vulnerabilityEPSS 1.0%CVE-2023-25195HIGHApache Fineract: SSRF template type vulnerability in certain authenticated usersEPSS 1.0%CVE-2026-40021MEDIUMApache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden charactersEPSS 1.0%CVE-2026-40023MEDIUMApache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden charactersEPSS 1.0%CVE-2026-55971CRITICALApache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()EPSS 1.0%CVE-2023-50944MEDIUMApache Airflow: Bypass permission verification to read code of other dagsEPSS 1.0%CVE-2024-27315MEDIUMApache Superset: Improper error handling on alertsEPSS 1.0%CVE-2026-76187CRITICALApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTEPSS 1.0%CVE-2026-82311CRITICALApache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseEPSS 1.0%CVE-2024-42222MEDIUMApache CloudStack: Unauthorised Network List AccessEPSS 1.0%