# org.apache.activemq:activemq-web-console (Maven) vulnerabilities

4 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 6.4.0 (Oct 22, 2026): no advisory affects it
- Newest unaffected release: 6.4.0 (Oct 22, 2026), the latest release
- Dependents: 5
- Releases: 125 since 4.1.1 (Apr 2, 2007)
- Registry: https://central.sonatype.com/artifact/org.apache.activemq/activemq-web-console
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-52760: 4.1.1 to 5.19.7 (5.19.8 is outside it); 6.0.0 to 6.2.6 (6.2.7 is outside it)
- CVE-2020-1941: 5.0.0 to 5.15.11 (5.15.12 is outside it)
- CVE-2018-8006: 5.0.0 to 5.15.5 (5.15.6 is outside it)
- CVE-2010-1587: 5.0.0 to 5.3.1 (5.3.2 is outside it)

## Advisories (4)

### [CVE-2026-52760](https://cve.now/CVE-2026-52760): Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console

- Severity: Medium 6.1
- Published: Jun 30, 2026
- Affected: fixed in 5.19.8; from 6.0.0, fixed in 6.2.7.
- Fixed in 5.19.8 (released Jun 25, 2026, 5 days before disclosure) and 6.2.7 (released Jun 25, 2026, 5 days before disclosure).
- The latest release, 6.4.0, is not affected.

### [CVE-2020-1941](https://cve.now/CVE-2020-1941): In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.

- Severity: Unrated
- Published: May 14, 2020
- Affected: from 5.0.0, fixed in 5.15.12.
- Fixed in 5.15.12 (released Mar 13, 2020, 62 days before disclosure).
- The latest release, 6.4.0, is not affected.

### [CVE-2018-8006](https://cve.now/CVE-2018-8006): An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp…

- Severity: Unrated
- Published: Oct 10, 2018
- Affected: from 5.0.0, fixed in 5.15.6.
- Fixed in 5.15.6 (released Sep 4, 2018, 36 days before disclosure).
- The latest release, 6.4.0, is not affected.

### [CVE-2010-1587](https://cve.now/CVE-2010-1587): The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a…

- Severity: Unrated
- Published: Apr 28, 2010
- Affected: from 5.0.0, fixed in 5.3.2.
- Fixed in 5.3.2 (released Apr 26, 2010, 2 days before disclosure).
- The latest release, 6.4.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.activemq:activemq-web-console
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.