Apache Vulnerabilities
Comprehensive security vulnerability database for Apache products
24
7
18
6
Severity Distribution
| Description | Vendor / Product | Exploit Status | |||
|---|---|---|---|---|---|
| CVE-2023-27524 | 9.8 | An attacker can gain unauthorized access to sensitive resources in Apache Superset if the default SECRET_KEY hasn't been changed, allowing them to manipulate session cookies. This vulnerability only affects installations that haven't followed the setup instructions to configure a unique SECRET_KEY. | apachesuperset | Exploit Available | almost 3 years agoApr 24, 2023 |
| CVE-2022-36125 | 7.5 | An attacker can crash an application by sending it corrupted data when using the Apache Avro Rust SDK, which can disrupt services and lead to downtime. This vulnerability affects versions prior to 0.14.0, so users should upgrade to the latest version to protect against this issue. | apacheavro | Theoretical | over 3 years agoAug 9, 2022 |
| CVE-2021-41773 | 9.8 | This vulnerability allows an attacker to access files outside of the intended directories on an Apache HTTP Server, potentially leading to remote code execution if certain scripts are enabled. This can happen if the server is misconfigured and does not properly restrict access to these files. | apachehttp server | Exploit Available | over 4 years agoOct 5, 2021 |
| CVE-2015-6420 | 9.8 | This vulnerability allows attackers to remotely execute any command on affected Cisco products by sending a specially crafted Java object. It primarily affects systems that use the Apache Commons Collections library and can be exploited if the attacker can send data to the vulnerable service. | apachecommons collections | Exploit Available | over 10 years agoDec 15, 2015 |
About Apache Security
This page tracks all publicly disclosed security vulnerabilities (CVEs) affecting Apache products. Our database is updated in real-time from the National Vulnerability Database (NVD) and enriched with exploit information from GitHub and other security research sources.
Each CVE listing includes CVSS severity scores, exploit availability status, AI-powered vulnerability summaries, and links to official patches and security advisories.