MavenPackage

org.apache.activemq:activemq-web-console

4 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Version timeline

CVE-2026-52760
Affects 4.1.1 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
CVE-2020-1941
Affects 5.0.0 to 5.15.11 (5.15.12 is outside it)
CVE-2018-8006
Affects 5.0.0 to 5.15.5 (5.15.6 is outside it)
CVE-2010-1587
Affects 5.0.0 to 5.3.1 (5.3.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-52760Medium 6.1
Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2020-1941Unrated
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
Affected: from 5.0.0, fixed in 5.15.12.
Fixed in 5.15.12 (released Mar 13, 2020, 62 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2018-8006Unrated
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp…
Affected: from 5.0.0, fixed in 5.15.6.
Fixed in 5.15.6 (released Sep 4, 2018, 36 days before disclosure).
The latest release, 6.4.0, is not affected.
CVE-2010-1587Unrated
The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a…
Affected: from 5.0.0, fixed in 5.3.2.
Fixed in 5.3.2 (released Apr 26, 2010, 2 days before disclosure).
The latest release, 6.4.0, is not affected.