Vendor
Apache Software Foundation
2,679 known vulnerabilities in products by Apache Software Foundation, 29 of them actively exploited (CISA KEV).
Key figures
2,679
Vulnerabilities
29
Actively exploited (KEV)
8
Used by ransomware
596
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-41773 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2021-40438 | mod_proxy SSRF In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2017-12615 | Apache Tomcat on Windows Remote Code Execution Vulnerability In CISA KEVRansomware | 8.1 | |
| Critical | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2024-38856 | Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code In CISA KEV | 9.8 | |
| Critical | CVE-2024-32113 | Apache OFBiz: Path traversal leading to RCE In CISA KEV | 9.8 | |
| Critical | CVE-2024-27348 | Apache HugeGraph-Server: Command execution in gremlin In CISA KEV | 9.8 | |
| Critical | CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-38475 | Apache HTTP Server Improper Escaping of Output Vulnerability In CISA KEV | 9.1 | |
| Critical | CVE-2022-24706 | Remote Code Execution Vulnerability in Packaging In CISA KEV | 9.8 | |
| Critical | CVE-2022-24112 | apisix/batch-requests plugin allows overwriting the X-REAL-IP header In CISA KEV | 9.8 | |
| Critical | CVE-2017-9791 | Apache Struts 1 Improper Input Validation Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2020-17530 | Apache Struts Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2016-8735 | Apache Tomcat Remote Code Execution Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-27524 | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY In CISA KEV | 8.9 | |
| Critical | CVE-2022-33891 | Apache Spark shell command injection vulnerability via Spark UI In CISA KEV | 8.8 | |
| Critical | CVE-2026-34486 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor In CISA KEV | 7.5 | |
| Critical | CVE-2020-11978 | Apache Airflow Command Injection In CISA KEV | 8.8 | |
| Critical | CVE-2024-45195 | Apache OFBiz: Confused controller-view authorization logic (forced browsing) In CISA KEV | 7.5 |
News
- NCSC-2026-0377 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Enterprise Managerncsc-nl,
- NCSC-2026-0375 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Communicationsncsc-nl,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- Nucleus wants to get ahead of scanners on new vulnerabilitiescsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,