Apache Software Foundation Apache HTTP Server

• CVE-2024-38475 Critical 9.1 Exploited Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. 100.0%
• CVE-2021-42013 Critical 9.8 Exploited Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) 100.0%
• CVE-2021-41773 High 7.5 Exploited Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 100.0%
• CVE-2021-40438 Critical 9.0 Exploited mod_proxy SSRF 100.0%
• CVE-2026-63686 High 7.5 Apache HTTP Server: mod_xml2enc crash on charset conversion failure 0.5%
• CVE-2026-93546 High 8.8 Apache HTTP Server: mod_dav_fs namespace overflow 0.4%
• CVE-2026-79768 Medium 5.3 Apache HTTP Server: mod_userdir information disclosure 0.5%
• CVE-2026-73637 High 7.3 Apache HTTP Server: mod_auth_digest DoS attack 0.5%
• CVE-2026-73636 High 8.1 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack 0.4%
• CVE-2026-63718 High 7.5 Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling 0.4%
• CVE-2026-63292 High 7.5 Apache HTTP Server: mod_vhost_alias stack overflow 0.9%
• CVE-2026-63045 High 7.5 Apache HTTP Server: mod_proxy_ftp PASV address handling 0.4%
• CVE-2026-59797 Critical 9.8 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function 0.5%
• CVE-2026-59685 High 7.5 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM 0.5%
• CVE-2026-58415 Medium 5.3 Apache HTTP Server: mod_dav_fs property database read access 0.5%
• CVE-2026-57941 Critical 9.8 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy 0.6%
• CVE-2026-56449 High 7.5 Apache HTTP Server: mod_proxy_html: crash in dump_content 0.6%
• CVE-2026-56154 Critical 9.8 Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} 0.5%
• CVE-2026-56153 High 7.5 Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char 0.5%
• CVE-2026-48005 High 7.5 Apache HTTP Server: mod_auth_digest reauthentication attack 0.6%
• CVE-2026-47360 High 7.5 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect 0.4%
• CVE-2026-46729 High 7.5 Apache HTTP Server: mod_heartmonitor denial of service 0.5%
• CVE-2026-42356 Low 3.7 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories 0.4%
• CVE-2026-42528 Medium 4.3 Apache HTTP Server: mod_dav shared lock overflow 0.4%
• CVE-2026-49975 High 7.5 Apache HTTP Server: mod_http2 denial of service 33.0%
• CVE-2026-48913 High 7.3 Apache HTTP Server: mod_http2 memory corruption when file handles exhausted 0.5%
• CVE-2026-42536 High 7.5 Apache HTTP Server: mod_xml2enc heap overflow 1.0%
• CVE-2026-44185 High 7.3 Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` 0.7%
• CVE-2026-34355 High 7.5 Apache HTTP Server: mod_proxy_html buffer overflow 1.2%
• CVE-2026-44631 Critical 9.8 Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow 0.5%
• CVE-2026-44119 Medium 5.5 Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules 0.2%
• CVE-2026-43951 Medium 6.5 Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash 0.5%
• CVE-2026-42535 Critical 9.1 Apache HTTP Server: mod_dav_fs protected directory access 0.5%
• CVE-2026-34356 High 7.5 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow 0.7%
• CVE-2026-44186 High 7.3 Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp 0.6%
• CVE-2026-29170 Medium 6.1 Apache HTTP Server: mod_proxy_ftp XSS 0.5%
• CVE-2026-29167 Critical 9.8 Apache HTTP Server: mod_ldap per-dir use-after-free 0.7%
• CVE-2026-28780 Critical 9.8 Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() 1.4%
• CVE-2026-29168 High 7.3 Apache HTTP Server: mod_md unrestricted OCSP response 0.6%
• CVE-2026-29169 High 7.5 Apache HTTP Server: mod_dav_lock indirect lock crash 0.6%
• CVE-2026-23918 High 8.8 Apache HTTP Server: http2: double free and possible RCE on early reset 49.7%
• CVE-2026-33006 Medium 4.8 Apache HTTP Server: mod_auth_digest timing attack 0.6%
• CVE-2026-33007 Medium 5.3 Apache HTTP Server: mod_authn_socache crash 0.5%
• CVE-2026-33523 Medium 6.5 Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line 0.4%
• CVE-2026-33857 Medium 5.3 Apache HTTP Server: Off-by-one OOB reads in AJP getter functions 0.4%
• CVE-2026-34032 Medium 5.3 Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) 0.5%
• CVE-2026-34059 High 7.5 Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() 0.4%
• CVE-2026-24072 High 8.8 Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr 0.7%
• CVE-2025-58098 High 8.3 Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... 1.5%
• CVE-2025-66200 Medium 5.4 Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo 0.7%