Patchfirst: Apache vulnerabilities

Patchfirst: Apache vulnerabilitieshttps://patchfirst.co/vendor/apache/New and newly exploited Apache CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 22:22:55 GMTCVE-2026-118636: **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…https://patchfirst.co/cve/CVE-2026-118636/CVE-2026-118636Sat, 31 Oct 2026 00:00:00 GMTApache Software Foundation · Apache MINA. Not in CISA KEV. No EPSS score. CVSS 9.8 CRITICAL. Priority 6.9 of 100.CVE-2026-56388: The Redis server command parser in Apache bRPC accepts an empty RESP array as a command headerhttps://patchfirst.co/cve/CVE-2026-56388/CVE-2026-56388Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 1.0% (higher than 61.4% of CVEs). CVSS 9.1 CRITICAL. Priority 20.6 of 100.CVE-2026-105944: Apache Pulsar Manager is a web console for administering Apache Pulsar clustershttps://patchfirst.co/cve/CVE-2026-105944/CVE-2026-105944Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Pulsar Manager. Not in CISA KEV. EPSS 0.7% (higher than 53.3% of CVEs). CVSS 10.0 CRITICAL. Priority 19.6 of 100.CVE-2026-78334: Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote…https://patchfirst.co/cve/CVE-2026-78334/CVE-2026-78334Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 0.7% (higher than 51.7% of CVEs). CVSS 9.1 CRITICAL. Priority 18.6 of 100.CVE-2026-59562: Missing authentication for critical function vulnerability in Apache IoTDBhttps://patchfirst.co/cve/CVE-2026-59562/CVE-2026-59562Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache IoTDB. Not in CISA KEV. EPSS 0.6% (higher than 47.1% of CVEs). CVSS 9.8 CRITICAL. Priority 18.2 of 100.CVE-2026-58663: An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB…https://patchfirst.co/cve/CVE-2026-58663/CVE-2026-58663Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache IoTDB. Not in CISA KEV. EPSS 0.6% (higher than 46.6% of CVEs). CVSS 9.8 CRITICAL. Priority 18.1 of 100.CVE-2026-86249: On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service…https://patchfirst.co/cve/CVE-2026-86249/CVE-2026-86249Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 0.6% (higher than 46.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.6 of 100.CVE-2026-48830: Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass…https://patchfirst.co/cve/CVE-2026-48830/CVE-2026-48830Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 0.6% (higher than 46.4% of CVEs). CVSS 9.1 CRITICAL. Priority 17.6 of 100.CVE-2026-111813: Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert…https://patchfirst.co/cve/CVE-2026-111813/CVE-2026-111813Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.5% (higher than 42.1% of CVEs). CVSS 10.0 CRITICAL. Priority 17.3 of 100.CVE-2026-111812: Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…https://patchfirst.co/cve/CVE-2026-111812/CVE-2026-111812Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.4% (higher than 29.9% of CVEs). CVSS 10.0 CRITICAL. Priority 14.9 of 100.CVE-2026-111816: Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the…https://patchfirst.co/cve/CVE-2026-111816/CVE-2026-111816Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.3% (higher than 23.7% of CVEs). CVSS 9.3 CRITICAL. Priority 13.2 of 100.CVE-2026-105869: Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON…https://patchfirst.co/cve/CVE-2026-105869/CVE-2026-105869Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Pulsar. Not in CISA KEV. EPSS 0.3% (higher than 23.1% of CVEs). CVSS 9.2 CRITICAL. Priority 13.0 of 100.CVE-2026-111815: Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…https://patchfirst.co/cve/CVE-2026-111815/CVE-2026-111815Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.2% (higher than 14.5% of CVEs). CVSS 10.0 CRITICAL. Priority 11.8 of 100.CVE-2026-111814: Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one…https://patchfirst.co/cve/CVE-2026-111814/CVE-2026-111814Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.2% (higher than 14.5% of CVEs). CVSS 10.0 CRITICAL. Priority 11.8 of 100.CVE-2026-111809: Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encodinghttps://patchfirst.co/cve/CVE-2026-111809/CVE-2026-111809Wed, 21 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.2% (higher than 12.4% of CVEs). CVSS 9.3 CRITICAL. Priority 10.9 of 100.CVE-2026-101296: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…https://patchfirst.co/cve/CVE-2026-101296/CVE-2026-101296Tue, 20 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Tomcat. Not in CISA KEV. EPSS 0.6% (higher than 50.1% of CVEs). CVSS 9.1 CRITICAL. Priority 18.3 of 100.CVE-2026-86471: An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server…https://patchfirst.co/cve/CVE-2026-86471/CVE-2026-86471Tue, 20 Oct 2026 00:00:00 GMTApache Software Foundation · Apache CouchDB. Not in CISA KEV. EPSS 0.6% (higher than 49% of CVEs). CVSS 9.3 CRITICAL. Priority 18.2 of 100.CVE-2026-103119: Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response…https://patchfirst.co/cve/CVE-2026-103119/CVE-2026-103119Tue, 20 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Tomcat. Not in CISA KEV. EPSS 0.6% (higher than 48% of CVEs). CVSS 9.1 CRITICAL. Priority 17.9 of 100.CVE-2026-101356: Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…https://patchfirst.co/cve/CVE-2026-101356/CVE-2026-101356Tue, 20 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Tomcat. Not in CISA KEV. EPSS 0.5% (higher than 42.8% of CVEs). CVSS 9.1 CRITICAL. Priority 16.8 of 100.CVE-2026-78162: Deserialization of Untrusted Data vulnerability in Apache Camelhttps://patchfirst.co/cve/CVE-2026-78162/CVE-2026-78162Mon, 19 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Camel. Not in CISA KEV. EPSS 0.9% (higher than 60.2% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 25.8 of 100.public-exploitCVE-2026-90910: Missing authentication for critical function vulnerability in Apache Answerhttps://patchfirst.co/cve/CVE-2026-90910/CVE-2026-90910Mon, 19 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Answer. Not in CISA KEV. EPSS 0.5% (higher than 41.4% of CVEs). CVSS 9.8 CRITICAL. Priority 16.9 of 100.CVE-2026-108771: Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylinhttps://patchfirst.co/cve/CVE-2026-108771/CVE-2026-108771Mon, 19 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.5% (higher than 40.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.8 of 100.CVE-2026-71253: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzonhttps://patchfirst.co/cve/CVE-2026-71253/CVE-2026-71253Mon, 19 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Johnzon. Not in CISA KEV. EPSS 0.4% (higher than 32% of CVEs). CVSS 9.8 CRITICAL. Priority 15.0 of 100.CVE-2026-68573: Improper Authentication vulnerability in Apache Kylinhttps://patchfirst.co/cve/CVE-2026-68573/CVE-2026-68573Fri, 16 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.5% (higher than 42.6% of CVEs). CVSS 9.8 CRITICAL. Priority 17.4 of 100.CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…https://patchfirst.co/cve/CVE-2026-64959/CVE-2026-64959Fri, 16 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.4% (higher than 36% of CVEs). CVSS 9.8 CRITICAL. Priority 16.1 of 100.CVE-2026-64610: Deserialization of Untrusted Data vulnerability in Apache Kylinhttps://patchfirst.co/cve/CVE-2026-64610/CVE-2026-64610Fri, 16 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.4% (higher than 35.8% of CVEs). CVSS 9.8 CRITICAL. Priority 16.1 of 100.CVE-2026-108709: Authentication bypass within in-house network in Apache Kylinhttps://patchfirst.co/cve/CVE-2026-108709/CVE-2026-108709Fri, 16 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Kylin. Not in CISA KEV. EPSS 0.4% (higher than 34.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-94134: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or…https://patchfirst.co/cve/CVE-2026-94134/CVE-2026-94134Thu, 15 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Airflow SSH provider. Not in CISA KEV. EPSS 0.6% (higher than 48.7% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. Priority 23.3 of 100.public-exploitCVE-2026-107460: Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating)…https://patchfirst.co/cve/CVE-2026-107460/CVE-2026-107460Tue, 13 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Fesod (Incubating). Not in CISA KEV. EPSS 0.4% (higher than 35% of CVEs). CVSS 9.1 CRITICAL. Priority 15.5 of 100.CVE-2026-103501: Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)https://patchfirst.co/cve/CVE-2026-103501/CVE-2026-103501Sat, 10 Oct 2026 00:00:00 GMTApache Software Foundation · Apache DataSketches. Not in CISA KEV. EPSS 0.6% (higher than 46.3% of CVEs). CVSS 9.8 CRITICAL. Priority 18.6 of 100.CVE-2026-103513: Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)https://patchfirst.co/cve/CVE-2026-103513/CVE-2026-103513Sat, 10 Oct 2026 00:00:00 GMTApache Software Foundation · Apache DataSketches. Not in CISA KEV. EPSS 0.4% (higher than 33.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.CVE-2026-103635: Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).…https://patchfirst.co/cve/CVE-2026-103635/CVE-2026-103635Sat, 10 Oct 2026 00:00:00 GMTApache Software Foundation · Apache DataSketches. Not in CISA KEV. EPSS 0.4% (higher than 33.6% of CVEs). CVSS 9.1 CRITICAL. Priority 15.5 of 100.CVE-2026-71575: The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a…https://patchfirst.co/cve/CVE-2026-71575/CVE-2026-71575Fri, 09 Oct 2026 00:00:00 GMTApache Software Foundation · Apache CXF. Not in CISA KEV. EPSS 0.4% (higher than 29.4% of CVEs). CVSS 9.1 CRITICAL. Priority 14.7 of 100.[KEV] CVE-2016-3081: Apache Struts Command Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2016-3081/CVE-2016-3081#kevThu, 08 Oct 2026 00:00:00 GMTApache · Struts. In CISA KEV since 2026-10-08. ENISA EUVD lists it as exploited. EPSS 96.5% (higher than 99.88% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.kevpublic-exploitT1190T1059CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbithttps://patchfirst.co/cve/CVE-2026-92414/CVE-2026-92414Wed, 07 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Jackrabbit. Not in CISA KEV. EPSS 0.7% (higher than 54.1% of CVEs). CVSS 9.1 CRITICAL. Priority 19.4 of 100.CVE-2026-104711: Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…https://patchfirst.co/cve/CVE-2026-104711/CVE-2026-104711Mon, 05 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Struts. Not in CISA KEV. EPSS 1.4% (higher than 72.4% of CVEs). CVSS 9.8 CRITICAL. Priority 23.5 of 100.CVE-2026-103877: Deserialization of Untrusted Data vulnerability in Apache Directory LDAP APIhttps://patchfirst.co/cve/CVE-2026-103877/CVE-2026-103877Fri, 02 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Directory LDAP API. Not in CISA KEV. EPSS 0.5% (higher than 40.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.8 of 100.CVE-2026-91135: Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransporthttps://patchfirst.co/cve/CVE-2026-91135/CVE-2026-91135Fri, 02 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Thrift. Not in CISA KEV. EPSS 0.3% (higher than 27.3% of CVEs). CVSS 9.2 CRITICAL. Priority 13.7 of 100.CVE-2026-83632: Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow…https://patchfirst.co/cve/CVE-2026-83632/CVE-2026-83632Fri, 02 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Thrift. Not in CISA KEV. EPSS 0.3% (higher than 22.3% of CVEs). CVSS 9.2 CRITICAL. Priority 12.7 of 100.CVE-2026-102795: Improper Access Control vulnerability in Apache Traffic Serverhttps://patchfirst.co/cve/CVE-2026-102795/CVE-2026-102795Fri, 02 Oct 2026 00:00:00 GMTApache Software Foundation · Apache Traffic Server. Not in CISA KEV. EPSS 0.3% (higher than 20.9% of CVEs). CVSS 9.3 CRITICAL. Priority 12.5 of 100.CVE-2026-57941: Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue…https://patchfirst.co/cve/CVE-2026-57941/CVE-2026-57941Thu, 01 Oct 2026 00:00:00 GMTApache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 0.6% (higher than 47.3% of CVEs). CVSS 9.8 CRITICAL. Priority 17.9 of 100.CVE-2026-56154: Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue…https://patchfirst.co/cve/CVE-2026-56154/CVE-2026-56154Thu, 01 Oct 2026 00:00:00 GMTApache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 0.5% (higher than 45.2% of CVEs). CVSS 9.8 CRITICAL. Priority 17.5 of 100.CVE-2026-59797: Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressionshttps://patchfirst.co/cve/CVE-2026-59797/CVE-2026-59797Thu, 01 Oct 2026 00:00:00 GMTApache Software Foundation · Apache HTTP Server. Not in CISA KEV. EPSS 0.5% (higher than 41.8% of CVEs). CVSS 9.8 CRITICAL. Priority 16.8 of 100.[KEV] CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-34486/CVE-2026-34486#kevTue, 04 Aug 2026 00:00:00 GMTApache · Tomcat. In CISA KEV since 2026-08-04. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1040 Network Sniffing; T1557 Adversary-in-the-Middle. Priority 73.2 of 100.kevpublic-exploitT1040T1557CVE-2026-44825: Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure usershttps://patchfirst.co/cve/CVE-2026-44825/CVE-2026-44825Mon, 01 Jun 2026 00:00:00 GMTApache Software Foundation · Apache Solr. Not in CISA KEV. EPSS 3.9% (higher than 90.3% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 71.1 of 100.public-exploitCVE-2026-33453: Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote…https://patchfirst.co/cve/CVE-2026-33453/CVE-2026-33453Mon, 27 Apr 2026 00:00:00 GMTApache Software Foundation · Apache Camel. Not in CISA KEV. EPSS 9.2% (higher than 95.3% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 78.3 of 100.public-exploitCVE-2026-40466: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery…https://patchfirst.co/cve/CVE-2026-40466/CVE-2026-40466Fri, 24 Apr 2026 00:00:00 GMTApache Software Foundation · Apache ActiveMQ Broker. Not in CISA KEV. EPSS 4.8% (higher than 91.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 71.8 of 100.public-exploit[KEV] CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-34197/CVE-2026-34197#kevThu, 16 Apr 2026 00:00:00 GMTApache · ActiveMQ. In CISA KEV since 2026-04-16. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.1 of 100.kevpublic-exploitT1190T1059CVE-2016-15057: Apache Continuum: Command injection leading to RCEhttps://patchfirst.co/cve/CVE-2016-15057/CVE-2016-15057Mon, 26 Jan 2026 00:00:00 GMTApache Software Foundation · Apache Continuum. Not in CISA KEV. EPSS 3.9% (higher than 90.2% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 73.0 of 100.public-exploitCVE-2025-60021: Apache bRPC: Remote command injection vulnerability in heap builtin servicehttps://patchfirst.co/cve/CVE-2025-60021/CVE-2025-60021Fri, 16 Jan 2026 00:00:00 GMTApache Software Foundation · Apache bRPC. Not in CISA KEV. EPSS 25.5% (higher than 98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 81.5 of 100.public-exploit