Apache Software Foundation

Products

Exploited and recent CVEs

• CVE-2026-34486 High 7.5 Exploited Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 98.5%
• CVE-2026-34197 High 8.8 Exploited Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans 98.3%
• CVE-2026-34197 High 8.8 Exploited Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans 98.3%
• CVE-2026-34197 High 8.8 Exploited Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans 98.3%
• CVE-2025-24813 Critical 10.0 Exploited Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT 99.9%
• CVE-2024-45195 Critical 9.8 Exploited Apache OFBiz: Confused controller-view authorization logic (forced browsing) 100.0%
• CVE-2024-38856 High 8.1 Exploited Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code 99.4%
• CVE-2024-38475 Critical 9.1 Exploited Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. 100.0%
• CVE-2024-32113 Critical 9.1 Exploited Apache OFBiz: Path traversal leading to RCE 99.9%
• CVE-2024-27348 Critical 9.8 Exploited Apache HugeGraph-Server: Command execution in gremlin 99.2%
• CVE-2023-46604 Critical 10.0 Exploited Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack 100.0%
• CVE-2023-46604 Critical 10.0 Exploited Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack 100.0%
• CVE-2023-33246 Critical 9.8 Exploited Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function 96.6%
• CVE-2023-27524 High 8.9 Exploited Apache Superset: Session validation vulnerability when using provided default SECRET_KEY 98.1%
• CVE-2022-33891 High 8.8 Exploited Apache Spark shell command injection vulnerability via Spark UI 93.2%
• CVE-2022-24706 Critical 9.8 Exploited Remote Code Execution Vulnerability in Packaging 92.5%
• CVE-2022-24112 Critical 9.8 Exploited apisix/batch-requests plugin allows overwriting the X-REAL-IP header 96.1%
• CVE-2021-45046 Critical 9.0 Exploited Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack 100.0%
• CVE-2021-44228 Critical 10.0 Exploited Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints 100.0%
• CVE-2021-42013 Critical 9.8 Exploited Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) 100.0%
• CVE-2021-41773 High 7.5 Exploited Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 100.0%
• CVE-2021-40438 Critical 9.0 Exploited mod_proxy SSRF 100.0%
• CVE-2020-17519 Critical 9.1 Exploited Apache Flink directory traversal attack: reading remote files through the REST API 98.0%
• CVE-2020-17530 Critical 9.8 Exploited Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25. 96.3%
• CVE-2020-11978 High 8.8 Exploited An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any auth 99.2%
• CVE-2018-11776 High 8.1 Exploited Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: r 100.0%
• CVE-2017-12617 High 8.1 Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the De 100.0%
• CVE-2017-12615 High 8.1 Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to th 99.7%
• CVE-2017-9805 High 8.1 Exploited The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can 99.4%
• CVE-2017-9791 Critical 9.8 Exploited The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. 98.9%