Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
- CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
- CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)
- CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
- CVE-2024-32113Apache OFBiz: Path traversal leading to RCE
- CVE-2024-27348Apache HugeGraph-Server: Command execution in gremlin
- CVE-2023-46604Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UI
- CVE-2022-24706Remote Code Execution Vulnerability in Packaging
- CVE-2022-24112apisix/batch-requests plugin allows overwriting the X-REAL-IP header
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
- CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
- CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
- CVE-2021-40438mod_proxy SSRF
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST API
- CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
- CVE-2020-11978An issue was found in Apache Airflow versions 1.10.10 and below.
- CVE-2020-1956Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a
- CVE-2020-1938When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi
- CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or
- CVE-2018-11776Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei
- CVE-2017-12617When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
- CVE-2017-12615When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.
- CVE-2017-9805The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea