Apache vulnerabilities attackers have used

Every Apache entry in CISA KEV

1. CVE-2016-3081

   Added Oct 8, 2026 · due Oct 11, 2026

   Apache Struts Command Injection Vulnerability

   Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.

2. CVE-2026-34486

   Added Aug 4, 2026 · due Aug 7, 2026

   Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

   Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

3. CVE-2026-34197

   Added Apr 16, 2026 · due Apr 30, 2026

   Apache ActiveMQ Improper Input Validation Vulnerability

   Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.

4. CVE-2024-38475

   Added May 1, 2025 · due May 22, 2025

   Apache HTTP Server Improper Escaping of Output Vulnerability

   Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable…

5. CVE-2025-24813

   Added Apr 1, 2025 · due Apr 22, 2025

   Apache Tomcat Path Equivalence Vulnerability

   Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.

6. CVE-2024-45195

   Added Feb 4, 2025 · due Feb 25, 2025

   Apache OFBiz Forced Browsing Vulnerability

   Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

7. CVE-2024-27348

   Added Sep 18, 2024 · due Oct 9, 2024

   Apache HugeGraph-Server Improper Access Control Vulnerability

   Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.

8. CVE-2024-38856

   Added Aug 27, 2024 · due Sep 17, 2024

   Apache OFBiz Incorrect Authorization Vulnerability

   Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

9. CVE-2024-32113

   Added Aug 7, 2024 · due Aug 28, 2024

   Apache OFBiz Path Traversal Vulnerability

   Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

10. CVE-2020-17519

    Added May 23, 2024 · due Jun 13, 2024

    Apache Flink Improper Access Control Vulnerability

    Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.

11. CVE-2023-27524

    Added Jan 8, 2024 · due Jan 29, 2024

    Apache Superset Insecure Default Initialization of Resource Vulnerability

    Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY…

12. CVE-2023-46604

    RansomwareAdded Nov 2, 2023 · due Nov 23, 2023

    Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

    Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the…

13. CVE-2023-33246

    Added Sep 6, 2023 · due Sep 27, 2023

    Apache RocketMQ Command Execution Vulnerability

    Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to…

14. CVE-2016-8735

    Added May 12, 2023 · due Jun 2, 2023

    Apache Tomcat Remote Code Execution Vulnerability

    Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't…

15. CVE-2021-45046

    RansomwareAdded May 1, 2023 · due May 22, 2023

    Apache Log4j2 Deserialization of Untrusted Data Vulnerability

    Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.

16. CVE-2022-33891

    Added Mar 7, 2023 · due Mar 28, 2023

    Apache Spark Command Injection Vulnerability

    Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.

17. CVE-2022-24706

    Added Aug 25, 2022 · due Sep 15, 2022

    Apache CouchDB Insecure Default Initialization of Resource Vulnerability

    Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.

18. CVE-2022-24112

    Added Aug 25, 2022 · due Sep 15, 2022

    Apache APISIX Authentication Bypass Vulnerability

    Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

19. CVE-2020-1956

    Added Mar 25, 2022 · due Apr 15, 2022

    Apache Kylin OS Command Injection Vulnerability

    Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.

20. CVE-2017-12617

    Added Mar 25, 2022 · due Apr 15, 2022

    Apache Tomcat Remote Code Execution Vulnerability

    When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

21. CVE-2017-12615

    RansomwareAdded Mar 25, 2022 · due Apr 15, 2022

    Apache Tomcat on Windows Remote Code Execution Vulnerability

    When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

22. CVE-2013-2251

    Added Mar 25, 2022 · due Apr 15, 2022

    Apache Struts Improper Input Validation Vulnerability

    Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.

23. CVE-2020-1938

    Added Mar 3, 2022 · due Mar 17, 2022

    Apache Tomcat Improper Privilege Management Vulnerability

    Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.

24. CVE-2017-9791

    Added Feb 10, 2022 · due Aug 10, 2022

    Apache Struts 1 Improper Input Validation Vulnerability

    The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

25. CVE-2016-3088

    Added Feb 10, 2022 · due Aug 10, 2022

    Apache ActiveMQ Improper Input Validation Vulnerability

    The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

26. CVE-2012-0391

    Added Jan 21, 2022 · due Jul 21, 2022

    Apache Struts 2 Improper Input Validation Vulnerability

    The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.

27. CVE-2006-1547

    Added Jan 21, 2022 · due Jul 21, 2022

    Apache Struts 1 ActionForm Denial-of-Service Vulnerability

    ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).

28. CVE-2020-13927

    Added Jan 18, 2022 · due Jul 18, 2022

    Apache Airflow's Experimental API Authentication Bypass

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.

29. CVE-2020-11978

    Added Jan 18, 2022 · due Jul 18, 2022

    Apache Airflow Command Injection

    A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.

30. CVE-2021-44228

    RansomwareAdded Dec 10, 2021 · due Dec 24, 2021

    Apache Log4j2 Remote Code Execution Vulnerability

    Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

31. CVE-2019-0193

    Added Dec 10, 2021 · due Jun 10, 2022

    Apache Solr DataImportHandler Code Injection Vulnerability

    The optional Apache Solr module DataImportHandler contains a code injection vulnerability.

32. CVE-2021-40438

    RansomwareAdded Dec 1, 2021 · due Dec 15, 2021

    Apache HTTP Server-Side Request Forgery (SSRF)

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

33. CVE-2021-42013

    RansomwareAdded Nov 3, 2021 · due Nov 17, 2021

    Apache HTTP Server Path Traversal Vulnerability

    Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts…

34. CVE-2021-41773

    RansomwareAdded Nov 3, 2021 · due Nov 17, 2021

    Apache HTTP Server Path Traversal Vulnerability

    Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI…

35. CVE-2020-17530

    Added Nov 3, 2021 · due May 3, 2022

    Apache Struts Remote Code Execution Vulnerability

    Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.

36. CVE-2019-17558

    Added Nov 3, 2021 · due May 3, 2022

    Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

    The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.

37. CVE-2019-0211

    Added Nov 3, 2021 · due May 3, 2022

    Apache HTTP Server Privilege Escalation Vulnerability

    Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent…

38. CVE-2018-11776

    Added Nov 3, 2021 · due May 3, 2022

    Apache Struts Remote Code Execution Vulnerability

    Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in…

39. CVE-2017-9805

    Added Nov 3, 2021 · due May 3, 2022

    Apache Struts Deserialization of Untrusted Data Vulnerability

    Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

40. CVE-2017-5638

    RansomwareAdded Nov 3, 2021 · due May 3, 2022

    Apache Struts Remote Code Execution Vulnerability

    Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

41. CVE-2016-4437

    Added Nov 3, 2021 · due May 3, 2022

    Apache Shiro Code Execution Vulnerability

    Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

Related

• All vendors in CISA KEV

  Ranked by how many exploited vulnerabilities each has.

• Latest CVEs this week

  Critical and High CVEs from the last 7 days, with KEV and EPSS.

• Vulnerability watch

  A briefing and a fix pull request when an advisory hits your dependencies.