Apache

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbeare

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context han

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `s

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by th

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate t

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to f

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing t

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to up

The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. Thi

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. Th

The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xco

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plain

Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in o

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-au

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing t

Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate

Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalk

Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6

Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When p

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLa

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions u

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to an

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standa

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostna

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. A

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Ap

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apach

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypas

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apach

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apac

Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDraini

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via inva

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint us

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set

Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web se

When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of t

Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vul

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repe

Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently del

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Br