Filtered by vendor Apache Software Foundation Subscriptions
Total 135 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-114277 2 Apache, Apache Software Foundation 2 Ofbiz, Apache Ofbiz 2026-11-05 N/A
Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
CVE-2026-109928 2 Apache, Apache Software Foundation 2 Ofbiz, Apache Ofbiz 2026-11-05 N/A
Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative access if the targeted account is an administrator, by submitting the token directly to the login endpoint instead of the intended password-change flow. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-108833 2 Apache, Apache Software Foundation 2 Apache Kylin, Apache Kylin 2026-11-04 7.5 High
Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2024-38472 4 Apache, Apache Software Foundation, Netapp and 1 more 4 Http Server, Apache Http Server, Ontap and 1 more 2026-11-04 7.5 High
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
CVE-2024-36104 2 Apache, Apache Software Foundation 2 Ofbiz, Apache Ofbiz 2026-11-04 9.1 Critical
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
CVE-2026-79633 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 8.1 High
vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-79624 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 9.8 Critical
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-79620 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 4.3 Medium
Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-79613 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 5.3 Medium
vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content through public user profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-76994 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-64945 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 7.5 High
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-64944 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-11-04 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers (including privileged users) as stored XSS. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-108837 2 Apache, Apache Software Foundation 2 Apache Kylin, Apache Kylin 2026-11-04 7.5 High
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-108823 2 Apache, Apache Software Foundation 2 Apache Kylin, Apache Kylin 2026-11-04 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-45434 2 Apache, Apache Software Foundation 2 Ofbiz, Apache Ofbiz 2026-11-04 9.8 Critical
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
CVE-2026-68482 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-10-30 5.3 Medium
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-86589 2 Apache, Apache Software Foundation 2 Answer, Apache Answer 2026-10-30 5.4 Medium
Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
CVE-2026-108780 2 Apache, Apache Software Foundation 2 Apache Kylin, Apache Kylin 2026-10-30 6.5 Medium
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-108776 2 Apache, Apache Software Foundation 2 Apache Kylin, Apache Kylin 2026-10-30 5.3 Medium
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.
CVE-2026-108771 2 Apache, Apache Software Foundation 2 Apache Kylin, Apache Kylin 2026-10-30 9.8 Critical
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.