Vendor
Apache vulnerabilities under active attack
40 Apache vulnerabilities have confirmed evidence of exploitation in the wild, and 8 are used in ransomware campaigns.
40
confirmed exploited
8
used in ransomware
40
past fix deadline
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Apache · Tomcat
- CVE-2026-34197 Apache ActiveMQ Improper Input Validation Vulnerability Apache · ActiveMQ
- CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability Apache · HTTP Server
- CVE-2025-24813 Apache Tomcat Path Equivalence Vulnerability Apache · Tomcat
- CVE-2024-45195 Apache OFBiz Forced Browsing Vulnerability Apache · OFBiz
- CVE-2024-27348 Apache HugeGraph-Server Improper Access Control Vulnerability Apache · HugeGraph-Server
- CVE-2024-38856 Apache OFBiz Incorrect Authorization Vulnerability Apache · OFBiz
- CVE-2024-32113 Apache OFBiz Path Traversal Vulnerability Apache · OFBiz
- CVE-2020-17519 Apache Flink Improper Access Control Vulnerability Apache · Flink
- CVE-2023-27524 Apache Superset Insecure Default Initialization of Resource Vulnerability Apache · Superset
- CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted Data Vulnerability Apache · ActiveMQ
- CVE-2023-33246 Apache RocketMQ Command Execution Vulnerability Apache · RocketMQ
- CVE-2016-8735 Apache Tomcat Remote Code Execution Vulnerability Apache · Tomcat
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Vulnerability Apache · Log4j2
- CVE-2022-33891 Apache Spark Command Injection Vulnerability Apache · Spark
- CVE-2022-24706 Apache CouchDB Insecure Default Initialization of Resource Vulnerability Apache · CouchDB
- CVE-2022-24112 Apache APISIX Authentication Bypass Vulnerability Apache · APISIX
- CVE-2020-1956 Apache Kylin OS Command Injection Vulnerability Apache · Kylin
- CVE-2017-12617 Apache Tomcat Remote Code Execution Vulnerability Apache · Tomcat
- CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Vulnerability Apache · Tomcat
- CVE-2013-2251 Apache Struts Improper Input Validation Vulnerability Apache · Struts
- CVE-2020-1938 Apache Tomcat Improper Privilege Management Vulnerability Apache · Tomcat
- CVE-2017-9791 Apache Struts 1 Improper Input Validation Vulnerability Apache · Struts 1
- CVE-2016-3088 Apache ActiveMQ Improper Input Validation Vulnerability Apache · ActiveMQ
- CVE-2006-1547 Apache Struts 1 ActionForm Denial-of-Service Vulnerability Apache · Struts 1
- CVE-2012-0391 Apache Struts 2 Improper Input Validation Vulnerability Apache · Struts 2
- CVE-2020-11978 Apache Airflow Command Injection Apache · Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass Apache · Airflow's Experimental API
- CVE-2019-0193 Apache Solr DataImportHandler Code Injection Vulnerability Apache · Solr
- CVE-2021-44228 Apache Log4j2 Remote Code Execution Vulnerability Apache · Log4j2
- CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF) Apache · Apache
- CVE-2017-9805 Apache Struts Deserialization of Untrusted Data Vulnerability Apache · Struts
- CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability Apache · HTTP Server
- CVE-2021-41773 Apache HTTP Server Path Traversal Vulnerability Apache · HTTP Server
- CVE-2019-0211 Apache HTTP Server Privilege Escalation Vulnerability Apache · HTTP Server
- CVE-2016-4437 Apache Shiro Code Execution Vulnerability Apache · Shiro
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability Apache · Solr
- CVE-2020-17530 Apache Struts Remote Code Execution Vulnerability Apache · Struts
- CVE-2017-5638 Apache Struts Remote Code Execution Vulnerability Apache · Struts
- CVE-2018-11776 Apache Struts Remote Code Execution Vulnerability Apache · Struts