Apache

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. Thi

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection ma

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker wi

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the mar

LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constru

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escap

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain s

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommende

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate pri

Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to ver

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to upd

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so

The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacke

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. T

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apach

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of serv

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This iss

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 t

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apach

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issu

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affec

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects A

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This is

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This iss

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue af

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue a

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affe

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affect

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects A

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This i

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoi

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A re

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the n

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affe

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affe

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting H

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apa