Skip to content
THREATWIRE

CVE Tracker · Vendor

Apache CVEs

52 CVEs in the tracker, 41 in the CISA KEV catalogue.

All vendors · RSS feed for Apache · Tracker data last updated 18 Oct 2026.

Showing 50 of 52

  1. CVE-2026-92414CVSS 9.1 criticalEPSS 0.73%2026-10-07

    jackrabbit. : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server…

  2. CVE-2026-104714CVSS 8.8 highEPSS 0.68%2026-10-05

    struts. Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in…

  3. CVE-2026-104713CVSS 6.5 mediumEPSS 0.69%2026-10-05

    struts. Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A reques…

  4. CVE-2026-104712CVSS 7.5 highEPSS 0.95%2026-10-05

    struts. Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is b…

  5. CVE-2026-104711CVSS 9.8 criticalEPSS 1.19%2026-10-05

    struts. Improper neutralization of special elements used in an expression language statement ('Expression Language In…

  6. CVE-2026-34486CVSS 7.5 highEPSS 6.56%KEV2026-04-09

    Tomcat. Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

  7. CVE-2025-24813CVSS 9.8 criticalEPSS 100%KEV2025-03-10

    Tomcat. Apache Tomcat Path Equivalence Vulnerability

  8. CVE-2024-45195CVSS 7.5 highEPSS 100%KEV2024-09-04

    OFBiz. Apache OFBiz Forced Browsing Vulnerability

  9. CVE-2024-38856CVSS 9.8 criticalEPSS 99.4%KEV2024-08-05

    OFBiz. Apache OFBiz Incorrect Authorization Vulnerability

  10. CVE-2024-38475CVSS 9.1 criticalEPSS 100%KEV2024-07-01

    HTTP Server. Apache HTTP Server Improper Escaping of Output Vulnerability

  11. CVE-2024-32113CVSS 9.8 criticalEPSS 100%KEV2024-05-08

    OFBiz. Apache OFBiz Path Traversal Vulnerability

  12. CVE-2024-27348CVSS 9.8 criticalEPSS 99.2%KEV2024-04-22

    HugeGraph-Server. Apache HugeGraph-Server Improper Access Control Vulnerability

  13. CVE-2023-46604CVSS 9.8 criticalEPSS 100%KEV2023-10-27

    ActiveMQ. Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

  14. CVE-2022-42889CVSS 9.8 criticalEPSS 100%2022-10-13

    commons text. Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expa…

  15. CVE-2021-45105CVSS 5.9 mediumEPSS 100%2021-12-18

    log4j. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontroll…

  16. CVE-2021-45046CVSS 9.0 criticalEPSS 100%KEV2021-12-14

    Log4j2. Apache Log4j2 Deserialization of Untrusted Data Vulnerability

  17. CVE-2021-44228CVSS 10.0 criticalEPSS 100%KEV2021-12-10

    Log4j2. Apache Log4j2 Remote Code Execution Vulnerability

  18. CVE-2021-42013CVSS 9.8 criticalEPSS 100%KEV2021-10-07

    HTTP Server. Apache HTTP Server Path Traversal Vulnerability

  19. CVE-2021-41773CVSS 9.8 criticalEPSS 100%KEV2021-10-05

    HTTP Server. Apache HTTP Server Path Traversal Vulnerability

  20. CVE-2021-40438CVSS 9.0 criticalEPSS 100%KEV2021-09-16

    Apache. Apache HTTP Server-Side Request Forgery (SSRF)

  21. CVE-2021-25646CVSS 8.8 highEPSS 99.0%2021-01-29

    druid. Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of reque…

  22. CVE-2020-13927CVSS 9.8 criticalEPSS 100%KEV2020-11-10

    Airflow's Experimental API. Apache Airflow's Experimental API Authentication Bypass

  23. CVE-2020-11978CVSS 8.8 highEPSS 99.2%KEV2020-07-17

    Airflow. Apache Airflow Command Injection

  24. CVE-2020-9496CVSS 6.1 mediumEPSS 98.9%2020-07-15

    ofbiz. XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.1…

  25. CVE-2020-1938CVSS 9.8 criticalEPSS 99.3%KEV2020-02-24

    Tomcat. Apache Tomcat Improper Privilege Management Vulnerability

  26. CVE-2019-17558CVSS 7.5 highEPSS 98.6%KEV2019-12-30

    Solr. Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

  27. CVE-2019-0232CVSS 8.1 highEPSS 100%2019-04-15

    tomcat. When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0…

  28. CVE-2018-11776CVSS 8.1 highEPSS 100%KEV2018-08-22

    Struts. Apache Struts Remote Code Execution Vulnerability

  29. CVE-2017-12635CVSS 9.8 criticalEPSS 100%2017-11-14

    couchdb. Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache…

  30. CVE-2017-12617CVSS 8.1 highEPSS 100%KEV2017-10-04

    Tomcat. Apache Tomcat Remote Code Execution Vulnerability

  31. CVE-2017-12615CVSS 8.1 highEPSS 100%KEV2017-09-19

    Tomcat. Apache Tomcat on Windows Remote Code Execution Vulnerability

  32. CVE-2017-9805CVSS 8.1 highEPSS 99.4%KEV2017-09-15

    Struts. Apache Struts Deserialization of Untrusted Data Vulnerability

  33. CVE-2017-9791CVSS 9.8 criticalEPSS 98.9%KEV2017-07-10

    Struts 1. Apache Struts 1 Improper Input Validation Vulnerability

  34. CVE-2017-5638CVSS 9.8 criticalEPSS 100%KEV2017-03-11

    Struts. Apache Struts Remote Code Execution Vulnerability

  35. CVE-2016-3088CVSS 9.8 criticalEPSS 98.5%KEV2016-06-01

    ActiveMQ. Apache ActiveMQ Improper Input Validation Vulnerability

  36. CVE-2016-3081CVSS 8.1 highEPSS 96.1%KEV2016-04-26

    Struts. Apache Struts Command Injection Vulnerability

  37. CVE-2026-34197No CVSSEPSS 15.5%KEV

    ActiveMQ. Apache ActiveMQ Improper Input Validation Vulnerability

  38. CVE-2023-33246No CVSSEPSS 96.6%KEV

    RocketMQ. Apache RocketMQ Command Execution Vulnerability

  39. CVE-2023-27524No CVSSEPSS 97.4%KEV

    Superset. Apache Superset Insecure Default Initialization of Resource Vulnerability

  40. CVE-2022-33891No CVSSEPSS 93.2%KEV

    Spark. Apache Spark Command Injection Vulnerability

  41. CVE-2022-24706No CVSSEPSS 92.5%KEV

    CouchDB. Apache CouchDB Insecure Default Initialization of Resource Vulnerability

  42. CVE-2022-24112No CVSSEPSS 96.1%KEV

    APISIX. Apache APISIX Authentication Bypass Vulnerability

  43. CVE-2020-1956No CVSSEPSS 97.3%KEV

    Kylin. Apache Kylin OS Command Injection Vulnerability

  44. CVE-2020-17530No CVSSEPSS 95.9%KEV

    Struts. Apache Struts Remote Code Execution Vulnerability

  45. CVE-2020-17519No CVSSEPSS 97.8%KEV

    Flink. Apache Flink Improper Access Control Vulnerability

  46. CVE-2019-0211No CVSSEPSS 65.0%KEV

    HTTP Server. Apache HTTP Server Privilege Escalation Vulnerability

  47. CVE-2019-0193No CVSSEPSS 83.5%KEV

    Solr. Apache Solr DataImportHandler Code Injection Vulnerability

  48. CVE-2016-8735No CVSSEPSS 90.3%KEV

    Tomcat. Apache Tomcat Remote Code Execution Vulnerability

  49. CVE-2016-4437No CVSSEPSS 93.0%KEV

    Shiro. Apache Shiro Code Execution Vulnerability

  50. CVE-2013-2251No CVSSEPSS 100%KEV

    Struts. Apache Struts Improper Input Validation Vulnerability