[ Vendor · 49 CVEs ]
Apache
CVEs affecting Apache published in the last 30 days, plus any Apache CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-34486 | 9 Apr 2026 | CVSS 7.5 | Apache Tomcat Missing Encryption of Sensitive DataMissing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor… | Exploited |
| CVE-2026-34197 | 7 Apr 2026 | CVSS 8.8 | Apache ActiveMQ Improper Input ValidationImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache… | Exploited |
| CVE-2025-24813 | 10 Mar 2025 | CVSS 9.8 | Apache Tomcat Path EquivalencePath Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to… | Exploited |
| CVE-2024-45195 | 4 Sep 2024 | CVSS 7.5 | Apache OFBiz Forced BrowsingDirect Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade… | Exploited |
| CVE-2024-45195 | 4 Sep 2024 | CVSS 7.5 | Apache OFBiz Forced BrowsingDirect Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade… | Exploited |
| CVE-2024-38856 | 5 Aug 2024 | CVSS 9.8 | Apache OFBiz Incorrect AuthorizationIncorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version… | ExploitedFix |
| CVE-2024-38856 | 5 Aug 2024 | CVSS 9.8 | Apache OFBiz Incorrect AuthorizationIncorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version… | ExploitedFix |
| CVE-2024-38475 | 1 Jul 2024 | CVSS 9.1 | Apache HTTP Server Improper Escaping of OutputImproper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are… | ExploitedFix |
| CVE-2024-38475 | 1 Jul 2024 | CVSS 9.1 | Apache HTTP Server Improper Escaping of OutputImproper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are… | ExploitedFix |
| CVE-2024-32113 | 8 May 2024 | CVSS 9.8 | Apache OFBiz Path TraversalImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before… | ExploitedFix |
| CVE-2024-32113 | 8 May 2024 | CVSS 9.8 | Apache OFBiz Path TraversalImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before… | ExploitedFix |
| CVE-2024-27348 | 22 Apr 2024 | CVSS 9.8 | Apache HugeGraph-Server Improper Access ControlRCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 &… | Exploited |
| CVE-2024-27348 | 22 Apr 2024 | CVSS 9.8 | Apache HugeGraph-Server Improper Access ControlRCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 &… | Exploited |
| CVE-2023-46604 | 27 Oct 2023 | CVSS 9.8 | Apache ActiveMQ Deserialization of Untrusted DataThe Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to… | Exploited |
| CVE-2023-33246 | 24 May 2023 | CVSS 9.8 | Apache RocketMQ Command ExecutionFor RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ… | Exploited |
| CVE-2023-27524 | 24 Apr 2023 | CVSS 9.8 | Apache Superset Insecure Default Initialization of ResourceSession Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured… | Exploited |
| CVE-2022-33891 | 18 Jul 2022 | CVSS 8.8 | Apache Spark Command InjectionThe Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks… | Exploited |
| CVE-2022-24706 | 26 Apr 2022 | CVSS 9.8 | Apache CouchDB Insecure Default Initialization of ResourceIn Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges… | ExploitedFix |
| CVE-2022-24112 | 11 Feb 2022 | CVSS 9.8 | Apache APISIX Authentication BypassAn attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX… | Exploited |
| CVE-2021-45046 | 14 Dec 2021 | CVSS 9.0 | Apache Log4j2 Deserialization of Untrusted DataIt was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows… | ExploitedFix |
| CVE-2021-44228 | 10 Dec 2021 | CVSS 10.0 | Apache Log4j2 Remote Code ExecutionApache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and… | ExploitedFix |
| CVE-2021-42013 | 7 Oct 2021 | CVSS 9.8 | Apache HTTP Server Path TraversalIt was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs… | ExploitedFix |
| CVE-2021-41773 | 5 Oct 2021 | CVSS 9.8 | Apache HTTP Server Path TraversalA flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to… | ExploitedFix |
| CVE-2021-40438 | 16 Sep 2021 | CVSS 9.0 | Apache HTTP Server-Side Request Forgery (SSRF)A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP… | ExploitedFix |
| CVE-2020-17519 | 5 Jan 2021 | CVSS 7.5 | Apache Flink Improper Access ControlA change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of… | Exploited |
| CVE-2020-17519 | 5 Jan 2021 | CVSS 7.5 | Apache Flink Improper Access ControlA change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of… | Exploited |
| CVE-2020-17530 | 11 Dec 2020 | CVSS 9.8 | Apache Struts Remote Code ExecutionForced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts… | ExploitedFix |
| CVE-2020-13927 | 10 Nov 2020 | CVSS 9.8 | Apache Airflow's Experimental API Authentication BypassThe previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to… | Exploited |
| CVE-2020-13927 | 10 Nov 2020 | CVSS 9.8 | Apache Airflow's Experimental API Authentication BypassThe previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to… | Exploited |
| CVE-2020-11978 | 17 Jul 2020 | CVSS 8.8 | Apache Airflow Command InjectionAn issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example… | Exploited |
| CVE-2020-1956 | 22 May 2020 | CVSS 8.8 | Apache Kylin OS Command InjectionApache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is… | ExploitedFix |
| CVE-2020-1938 | 24 Feb 2020 | CVSS 9.8 | Apache Tomcat Improper Privilege ManagementWhen using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as… | ExploitedFix |
| CVE-2019-17558 | 30 Dec 2019 | CVSS 7.5 | Apache Solr VelocityResponseWriter Plug-In Remote Code ExecutionApache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be… | ExploitedFix |
| CVE-2019-15752 | 28 Aug 2019 | CVSS 7.8 | Docker Desktop Community Edition Privilege EscalationDocker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in… | Exploited |
| CVE-2019-0193 | 1 Aug 2019 | CVSS 7.2 | Apache Solr DataImportHandler Code InjectionIn Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the… | ExploitedFix |
| CVE-2019-0211 | 8 Apr 2019 | CVSS 7.8 | Apache HTTP Server Privilege EscalationIn Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads… | ExploitedFix |
| CVE-2018-11776 | 22 Aug 2018 | CVSS 8.1 | Apache Struts Remote Code ExecutionApache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by… | ExploitedFix |
| CVE-2017-12617 | 4 Oct 2017 | CVSS 8.1 | Apache Tomcat Remote Code ExecutionWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via… | ExploitedFix |
| CVE-2017-12615 | 19 Sep 2017 | CVSS 8.1 | Apache Tomcat on Windows Remote Code ExecutionWhen running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default… | ExploitedFix |
| CVE-2017-9805 | 15 Sep 2017 | CVSS 8.1 | Apache Struts Deserialization of Untrusted DataThe REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for… | ExploitedFix |
| CVE-2017-9791 | 10 Jul 2017 | CVSS 9.8 | Apache Struts 1 Improper Input ValidationThe Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the… | ExploitedFix |
| CVE-2016-8735 | 6 Apr 2017 | CVSS 9.8 | Apache Tomcat Remote Code ExecutionRemote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before… | ExploitedFix |
| CVE-2017-5638 | 11 Mar 2017 | CVSS 9.8 | Apache Struts Remote Code ExecutionThe Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message… | ExploitedFix |
| CVE-2016-4437 | 7 Jun 2016 | CVSS 9.8 | Apache Shiro Code ExecutionApache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code… | Exploited |
| CVE-2016-3088 | 1 Jun 2016 | CVSS 9.8 | Apache ActiveMQ Improper Input ValidationThe Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT… | ExploitedFix |
| CVE-2016-3081 | 26 Apr 2016 | CVSS 8.1 | Remote code execution in Apache Struts with Dynamic Method InvocationApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to… | ExploitedFix |
| CVE-2013-2251 | 20 Jul 2013 | CVSS 9.8 | Apache Struts Improper Input ValidationApache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2)… | ExploitedFix |
| CVE-2012-0391 | 8 Jan 2012 | CVSS 9.8 | Apache Struts 2 Improper Input ValidationThe ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling… | Exploited |
| CVE-2006-1547 | 30 Mar 2006 | CVSS 7.5 | Apache Struts 1 ActionForm Denial-of-ServiceActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a… | ExploitedFix |