Apache security advisories, July 2026

Every Apache Software Foundation security advisory published in July 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 180
Critical: 41
High: 82
In CISA KEV: 0

Apache advisories published in July 2026

Jul 20, 2026
High [CVE-2026-56452] Path traversal in the sshd-scp component of Apache MINA SSHD
High7.5
Jul 20, 2026
High [CVE-2026-62418] Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope
High8.1
Jul 20, 2026
Medium [CVE-2026-58624] Improper input validation in sshd-git in Apache MINA SSHD
Medium5.4
Jul 18, 2026
High [CVE-2026-59173] Uncontrolled Resource Consumption vulnerability in Apache Traffic Server
High7.5
Jul 17, 2026
Medium [CVE-2026-62764] Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo
Medium5.7
Jul 15, 2026
High [CVE-2024-32838 +1] SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to…
High8.1
Jul 15, 2026
High [CVE-2026-35152] Apache Fineract: SQL injection in runreports endpoint
High8.8
Jul 15, 2026
High [CVE-2026-56287] boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in…
High8.1
Jul 15, 2026
Medium [CVE-2026-26032] The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by…
Medium5.4
Jul 14, 2026
Critical [CVE-2026-62392] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin
Critical9.8
Jul 14, 2026
Critical [CVE-2026-62390] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin
Critical9.8
Jul 14, 2026
Critical [CVE-2026-58319] Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication
Critical9.1
Jul 14, 2026
Critical [CVE-2026-59084] Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the…
Critical9.1
Jul 14, 2026
Critical [CVE-2026-59083] Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security…
Critical9.1
Jul 14, 2026
Medium [CVE-2026-49488] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings
Medium6.5
Jul 14, 2026
Medium [CVE-2026-62393] Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kylin
Medium4.3
Jul 13, 2026
Critical [CVE-2026-41041] URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino
Critical9.1
Jul 13, 2026
High [CVE-2026-59245] Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name collision)
High8.1
Jul 13, 2026
High [CVE-2026-58065] Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification
High8.1
Jul 13, 2026
Medium [CVE-2026-49876] Apache Gravitino: Authenticated SSRF in Gravitino JobManager
Medium6.5
Jul 10, 2026
Critical [CVE-2026-40008] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB
Critical9.8
Jul 10, 2026
Critical [CVE-2026-40005] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB
Critical9.1
Jul 10, 2026
Critical [CVE-2026-28564] Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB
Critical9.8
Jul 10, 2026
High [CVE-2026-40454] Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client
High7.5
Jul 10, 2026
High [CVE-2026-40452] Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB
High7.5
Jul 10, 2026
High [CVE-2026-40007] Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB
High7.5
Jul 10, 2026
High [CVE-2026-40006] Apache IoTDB: Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing…
High7.5
Jul 10, 2026
Medium [CVE-2026-34481 +1] Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson
Medium6.3
Jul 10, 2026
Medium [CVE-2026-40009] Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB
Medium6.5
Jul 9, 2026
High [CVE-2026-57111] Apache Helix: Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest…
High7.5
Jul 8, 2026
Critical [CVE-2026-41042] Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API
Critical9.1
Jul 7, 2026
Critical [CVE-2026-33264] Apache Airflow: DAG author RCE on webserver via unrestricted import_string in BaseSerialization.deserialize
Critical9.8
Jul 7, 2026
Medium [CVE-2026-49487] Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs
Medium6.5
Jul 7, 2026
Medium [CVE-2026-49296] Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}
Medium6.5
Jul 7, 2026
Medium [CVE-2026-48892] Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
Medium6.5
Jul 7, 2026
Medium [CVE-2026-48891] Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target
Medium4.3
Jul 7, 2026
Medium [CVE-2026-48828] Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact called without the key
Medium6.5
Jul 6, 2026
Critical [CVE-2026-46456 +1] Improper Input Validation vulnerability in Apache Camel AWS SNS component
Critical9.8
Jul 6, 2026
Critical [CVE-2026-23552 +1] Apache Camel: Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open')…
Critical9.8
Jul 6, 2026
Critical [CVE-2026-48205] Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component
Critical9.1
Jul 6, 2026
Critical [CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component
Critical9.8
Jul 6, 2026
Critical [CVE-2026-48203] Apache Camel: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input…
Critical9.1
Jul 6, 2026
Critical [CVE-2026-46456] Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component
Critical9.8
Jul 6, 2026
Critical [CVE-2026-46455] Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component
Critical9.8
Jul 6, 2026
Critical [CVE-2026-46454] Improper Input Validation vulnerability in Apache Camel Cometd Component
Critical9.8
Jul 6, 2026
Critical [CVE-2026-40048 +2] Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component
Critical9.8
Jul 6, 2026
Critical [CVE-2026-40047] Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component
Critical9.1
Jul 6, 2026
Critical [CVE-2026-24014] Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file…
Critical9.8
Jul 6, 2026
Critical [CVE-2026-24013] Apache IoTDB: Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
Critical9.1
Jul 6, 2026
High [CVE-2026-43825] Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document…
High7.3
Jul 6, 2026
High [CVE-2026-49297] Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS…
High8.1
Jul 6, 2026
High [CVE-2026-49042] Improper Input Validation vulnerability in Apache Camel
High7.3
Jul 6, 2026
High [CVE-2026-46588] Improper Input Validation vulnerability in Apache Camel
High7.3
Jul 6, 2026
High [CVE-2026-55994] Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…
High7.5
Jul 6, 2026
High [CVE-2026-55993] Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…
High7.5
Jul 6, 2026
High [CVE-2026-46726] Apache Camel: Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery…
High7.5
Jul 6, 2026
High [CVE-2026-46592] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP…
High7.5
Jul 6, 2026
High [CVE-2025-66169 +1] Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component
High8.2
Jul 6, 2026
High [CVE-2026-40048 +1] Deserialization of Untrusted Data vulnerability in Apache Camel PQC component
High8.8
Jul 6, 2026
High [CVE-2026-46585] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene…
High7.5
Jul 6, 2026
High [CVE-2026-46457] Improper Input Validation vulnerability in Apache Camel NATS component
High7.5
Jul 6, 2026
High [CVE-2026-40860 +1] Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component
High7.3
Jul 6, 2026
High [CVE-2026-43865] Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component.
High8.1
Jul 6, 2026
High [CVE-2026-42527] Apache ActiveMQ: Deserialization of Untrusted Data vulnerability in Apache Camel.
High8.1
Jul 6, 2026
High [CVE-2026-40859] Apache Camel: Deserialization of Untrusted Data vulnerability in Apache Camel.
High8.1
Jul 6, 2026
High [CVE-2026-24012] Apache IoTDB: Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
High7.5
Jul 6, 2026
Medium [CVE-2026-56139] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component
Medium5.3
Jul 6, 2026
Medium [CVE-2026-49365] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component
Medium5.3
Jul 6, 2026
Medium [CVE-2026-49099] Apache Camel: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization…
Medium5.3
Jul 6, 2026
Medium [CVE-2026-49098] Apache Camel: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component…
Medium5.3
Jul 6, 2026
Medium [CVE-2026-49097] Apache Camel: Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component…
Medium6.5
Jul 6, 2026
Medium [CVE-2026-49086] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR…
Medium6.5
Jul 6, 2026
Medium [CVE-2026-48206] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component
Medium5.3
Jul 6, 2026
Medium [CVE-2026-46453] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel…
Medium5.3
Jul 6, 2026
Low [CVE-2026-46584] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel…
Low3.7
Jul 3, 2026
High [CVE-2026-47896] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene
High8.9
Jul 3, 2026
High [CVE-2026-47897] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene
High8.9
Jul 3, 2026
Medium [CVE-2026-47898] Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library)
Medium4.0
Jul 1, 2026
High [CVE-2026-54428] Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and…
High7.5
Jul 1, 2026
High [CVE-2026-54399] Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier…
High7.5

Page 2 of 2 · 80 of 180

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.