Apache
41 CVEs in CISA KEV — 8 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2023-46604 |
ActiveMQ | — | 0.9999 | 2023-11-02 | 2023-11-23 | RW | Apache ActiveMQ contains a deserialization of untrusted data vulnerability that |
CVE-2024-45195 |
OFBiz | — | 0.9998 | 2025-02-04 | 2025-02-25 | Apache OFBiz contains a forced browsing vulnerability that allows a remote attac | |
CVE-2024-38475 |
HTTP Server | — | 0.9996 | 2025-05-01 | 2025-05-22 | Apache HTTP Server contains an improper escaping of output vulnerability in mod_ | |
CVE-2025-24813 |
Tomcat | — | 0.9994 | 2025-04-01 | 2025-04-22 | Apache Tomcat contains a path equivalence vulnerability that allows a remote att | |
CVE-2024-32113 |
OFBiz | — | 0.9992 | 2024-08-07 | 2024-08-28 | Apache OFBiz contains a path traversal vulnerability that could allow for remote | |
CVE-2024-38856 |
OFBiz | — | 0.9943 | 2024-08-27 | 2024-09-17 | Apache OFBiz contains an incorrect authorization vulnerability that could allow | |
CVE-2024-27348 |
HugeGraph-Server | — | 0.9921 | 2024-09-18 | 2024-10-09 | Apache HugeGraph-Server contains an improper access control vulnerability that c | |
CVE-2026-34486 |
Tomcat | — | 0.9850 | 2026-08-04 | 2026-08-07 | Apache Tomcat contains a missing encryption of sensitive data vulnerability that | |
CVE-2026-34197 |
ActiveMQ | — | 0.9826 | 2026-04-16 | 2026-04-30 | Apache ActiveMQ contains an improper input validation vulnerability that allows | |
CVE-2023-27524 |
Superset | — | 0.9815 | 2024-01-08 | 2024-01-29 | Apache Superset contains an insecure default initialization of a resource vulner | |
CVE-2023-33246 |
RocketMQ | — | 0.9657 | 2023-09-06 | 2023-09-27 | Several components of Apache RocketMQ, including NameServer, Broker, and Control | |
CVE-2022-33891 |
Spark | — | 0.9324 | 2023-03-07 | 2023-03-28 | Apache Spark contains a command injection vulnerability via Spark User Interface | |
CVE-2016-3081 |
Struts | — | — | 2026-10-08 | 2026-10-11 | Apache Struts contains a command injection vulnerability that could allow remote | |
CVE-2020-17519 |
Flink | — | — | 2024-05-23 | 2024-06-13 | Apache Flink contains an improper access control vulnerability that allows an at | |
CVE-2016-8735 |
Tomcat | — | — | 2023-05-12 | 2023-06-02 | Apache Tomcat contains an unspecified vulnerability that allows for remote code | |
CVE-2021-45046 |
Log4j2 | — | — | 2023-05-01 | 2023-05-22 | RW | Apache Log4j2 contains a deserialization of untrusted data vulnerability due to |
CVE-2022-24706 |
CouchDB | — | — | 2022-08-25 | 2022-09-15 | Apache CouchDB contains an insecure default initialization of resource vulnerabi | |
CVE-2022-24112 |
APISIX | — | — | 2022-08-25 | 2022-09-15 | Apache APISIX contains an authentication bypass vulnerability that allows for re | |
CVE-2020-1956 |
Kylin | — | — | 2022-03-25 | 2022-04-15 | Apache Kylin contains an OS command injection vulnerability which could permit a | |
CVE-2017-12617 |
Tomcat | — | — | 2022-03-25 | 2022-04-15 | When running Apache Tomcat, it is possible to upload a JSP file to the server vi | |
CVE-2017-12615 |
Tomcat | — | — | 2022-03-25 | 2022-04-15 | RW | When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to |
CVE-2013-2251 |
Struts | — | — | 2022-03-25 | 2022-04-15 | Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigati | |
CVE-2020-1938 |
Tomcat | — | — | 2022-03-03 | 2022-03-17 | Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher tr | |
CVE-2017-9791 |
Struts 1 | — | — | 2022-02-10 | 2022-08-10 | The Struts 1 plugin in Apache Struts might allow remote code execution via a mal | |
CVE-2016-3088 |
ActiveMQ | — | — | 2022-02-10 | 2022-08-10 | The Fileserver web application in Apache ActiveMQ allows remote attackers to upl | |
CVE-2006-1547 |
Struts 1 | — | — | 2022-01-21 | 2022-07-21 | ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a | |
CVE-2012-0391 |
Struts 2 | — | — | 2022-01-21 | 2022-07-21 | The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an i | |
CVE-2020-11978 |
Airflow | — | — | 2022-01-18 | 2022-07-18 | A remote code/command injection vulnerability was discovered in one of the examp | |
CVE-2020-13927 |
Airflow's Experimental API | — | — | 2022-01-18 | 2022-07-18 | The previous default setting for Airflow's Experimental API was to allow all API | |
CVE-2019-0193 |
Solr | — | — | 2021-12-10 | 2022-06-10 | The optional Apache Solr module DataImportHandler contains a code injection vuln | |
CVE-2021-44228 |
Log4j2 | — | — | 2021-12-10 | 2021-12-24 | RW | Apache Log4j2 contains a vulnerability where JNDI features do not protect agains |
CVE-2021-40438 |
Apache | — | — | 2021-12-01 | 2021-12-15 | RW | A crafted request uri-path can cause mod_proxy to forward the request to an orig |
CVE-2017-9805 |
Struts | — | — | 2021-11-03 | 2022-05-03 | Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for | |
CVE-2021-42013 |
HTTP Server | — | — | 2021-11-03 | 2021-11-17 | RW | Apache HTTP Server contains a path traversal vulnerability that allows an attack |
CVE-2021-41773 |
HTTP Server | — | — | 2021-11-03 | 2021-11-17 | RW | Apache HTTP Server contains a path traversal vulnerability that allows an attack |
CVE-2019-0211 |
HTTP Server | — | — | 2021-11-03 | 2022-05-03 | Apache HTTP Server, with MPM event, worker or prefork, code executing in less-pr | |
CVE-2016-4437 |
Shiro | — | — | 2021-11-03 | 2022-05-03 | Apache Shiro contains a vulnerability which may allow remote attackers to execut | |
CVE-2019-17558 |
Solr | — | — | 2021-11-03 | 2022-05-03 | The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerabi | |
CVE-2020-17530 |
Struts | — | — | 2021-11-03 | 2022-05-03 | Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when | |
CVE-2017-5638 |
Struts | — | — | 2021-11-03 | 2022-05-03 | RW | Apache Struts Jakarta Multipart parser allows for malicious file upload using th |
CVE-2018-11776 |
Struts | — | — | 2021-11-03 | 2022-05-03 | Apache Struts contains a vulnerability that allows for remote code execution und |