Apache: exploited vulnerabilities
- 41exploited vulnerabilities
- 8used by ransomware
- Oct 8, 2026latest one added
- Struts 6
- Tomcat 6
- HTTP Server 4
- ActiveMQ 3
- OFBiz 3
- Log4j2 2
- Struts 1 2
- Solr 2
- HugeGraph-Server 1
- Flink 1
- Superset 1
- RocketMQ 1
- Spark 1
- CouchDB 1
- APISIX 1
- Kylin 1
- Struts 2 1
- Airflow's Experimental API 1
- Airflow 1
- Apache 1
- Shiro 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 8, 2026 | Command Injection | Struts | High 8.1 | 97% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
| Apr 1, 2025 | Path Equivalence | Tomcat | Critical 10.0 | 99.9% |
| Feb 4, 2025 | Forced Browsing | OFBiz | Critical 9.8 | >99.9% |
| Sep 18, 2024 | Improper Access Control | HugeGraph-Server | Critical 9.8 | 99.2% |
| Aug 27, 2024 | Incorrect Authorization | OFBiz | High 8.1 | 99.4% |
| Aug 7, 2024 | Path Traversal | OFBiz | Critical 9.1 | 99.9% |
| May 23, 2024 | Improper Access Control | Flink | Critical 9.1 | 98% |
| Jan 8, 2024 | Insecure Default Initialization of Resource | Superset | High 8.9 | 98% |
| Nov 2, 2023 | Deserialization of Untrusted Data | ActiveMQ | Critical 10.0 | 99.9% |
| Sep 6, 2023 | Command Execution | RocketMQ | Critical 9.8 | 97% |
| May 12, 2023 | Remote Code Execution | Tomcat | Critical 9.8 | 90% |
| May 1, 2023 | Deserialization of Untrusted Data | Log4j2 | Critical 9.0 | >99.9% |
| Mar 7, 2023 | Command Injection | Spark | High 8.8 | 93% |
| Aug 25, 2022 | Insecure Default Initialization of Resource | CouchDB | Critical 9.8 | 93% |
| Aug 25, 2022 | Authentication Bypass | APISIX | Critical 9.8 | 96% |
| Mar 25, 2022 | OS Command Injection | Kylin | High 8.8 | 97% |
| Mar 25, 2022 | Remote Code Execution | Tomcat | High 8.1 | >99.9% |
| Mar 25, 2022 | on Windows Remote Code Execution | Tomcat | High 8.1 | 99.7% |
| Mar 25, 2022 | Improper Input Validation | Struts | Critical 9.8 | >99.9% |
| Mar 3, 2022 | Improper Privilege Management | Tomcat | Critical 9.8 | 99.3% |
| Feb 10, 2022 | Improper Input Validation | Struts 1 | Critical 9.8 | 99% |
| Feb 10, 2022 | Improper Input Validation | ActiveMQ | Critical 9.8 | 99% |
| Jan 21, 2022 | Improper Input Validation | Struts 2 | Critical 9.8 | 76% |
| Jan 21, 2022 | ActionForm Denial-of-Service | Struts 1 | High 7.5 | 55% |
| Jan 18, 2022 | Authentication Bypass | Airflow's Experimental API | Critical 9.8 | 99.8% |
| Jan 18, 2022 | Command Injection | Airflow | High 8.8 | 99.2% |
| Dec 10, 2021 | Remote Code Execution | Log4j2 | Critical 10.0 | >99.9% |
| Dec 10, 2021 | DataImportHandler Code Injection | Solr | High 7.2 | 84% |
| Dec 1, 2021 | HTTP Server-Side Request Forgery (SSRF) | Apache | Critical 9.0 | >99.9% |
| Nov 3, 2021 | Path Traversal | HTTP Server | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Path Traversal | HTTP Server | High 7.5 | >99.9% |
| Nov 3, 2021 | Remote Code Execution | Struts | Critical 9.8 | 96% |
| Nov 3, 2021 | VelocityResponseWriter Plug-In Remote Code Execution | Solr | High 7.5 | 99% |
| Nov 3, 2021 | Privilege Escalation | HTTP Server | High 7.8 | 65% |
| Nov 3, 2021 | Remote Code Execution | Struts | High 8.1 | >99.9% |
| Nov 3, 2021 | Deserialization of Untrusted Data | Struts | High 8.1 | 99.4% |
| Nov 3, 2021 | Remote Code Execution | Struts | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Code Execution | Shiro | Critical 9.8 | 93% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.