Vulnerabilidades em Apache Software Foundation

2.378 resultados
Análise Vexday

O portfólio da Apache Software Foundation acumula 1.872 CVEs catalogadas, das quais 215 são de severidade crítica e 83 contam com prova de conceito pública — fatores que ampliam a superfície de risco operacional para equipes de segurança. A taxa de exploração ativa é especialmente preocupante: 28 vulnerabilidades constam no catálogo KEV da CISA, representando uma proporção 3,3 vezes acima da média geral do catálogo, o que indica atenção consistente de agentes maliciosos ao ecossistema Apache. A falha mais comum é CWE-20 (validação inadequada de entrada), padrão estrutural que tende a se manifestar em múltiplos produtos e versões, exigindo revisão ampla e não pontual. Destaque para CVE-2021-40438, a vulnerabilidade de maior risco ativo no momento, com EPSS máximo de 1,0 — probabilidade de exploração na prática praticamente certa —, o que a torna prioridade imediata de remediação para qualquer organização que opere componentes Apache afetados.

CVE-2026-68073HIGHApache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflowEPSS 0.8%CVE-2026-66257HIGHApache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67465HIGHApache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67589HIGHApache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2026-67588HIGHApache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-68074HIGHApache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-56452HIGHApache MINA SSHD: Path traversal in SCP file receptionEPSS 0.8%CVE-2024-45461MEDIUMApache CloudStack Quota plugin: Access checks not enforced in QuotaEPSS 0.8%CVE-2026-58188HIGHApache Traffic Server: Memory-safety and limit-bypass errors across experimental pluginsEPSS 0.8%CVE-2025-54090MEDIUMApache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64EPSS 0.8%CVE-2026-71560CRITICALApache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-pathEPSS 0.8%CVE-2026-82617CRITICALApache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsEPSS 0.8%CVE-2025-68161MEDIUMApache Log4j Core: Missing TLS hostname verification in Socket appenderEPSS 0.8%CVE-2026-48834HIGHApache Answer: Denial of service via crafted Accept-Language header parsingEPSS 0.8%CVE-2026-41084HIGHApache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutationEPSS 0.8%CVE-2026-42779CRITICALApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)EPSS 0.8%CVE-2023-51437HIGHApache Pulsar: Timing attack in SASL token signature verificationEPSS 0.8%CVE-2024-56196MEDIUMApache Traffic Server: ACL is not fully compatible with older versionsEPSS 0.8%CVE-2024-56195MEDIUMApache Traffic Server: Intercept plugins are not access controlledEPSS 0.8%CVE-2025-54057MEDIUMApache SkyWalking: Stored XSS vulnerabilityEPSS 0.8%