Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

75 records in Activemq · all components

TI-2023-25106 CVE-2023-46604 · GHSA-crg9-44h2-xw35

Deserialization of untrusted data in Apache ActiveMQ

Priority CRITICAL 100KEV

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.99992 Published 2023-10-27 Partial fix · 5.18.3, 5.17.6 +2 CWE-502
TI-2013-05951 CVE-2013-7285 · GHSA-f554-x222-wgf7

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not…

Priority CRITICAL 90

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarsh…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84362 Published 2019-05-15 Partial fix · 1.4.7, 1.4.11 CWE-78
TI-2020-16038 CVE-2020-26217 · GHSA-mw36-7c6c-q4q2

Remote Code Execution in XStream

Priority CRITICAL 87

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.84968 Published 2020-11-16 Partial fix · 1.4.14, 1.4.14-java7 CWE-78
TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

Priority HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400
TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

Priority HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

Priority HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2020-09657 CVE-2020-11998 · GHSA-wqfh-9m4g-7x6x

Code injection in Apache ActiveMQ

Priority HIGH 73

A regression has been introduced in the commit preventing JMX re-bind.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.48885 Published 2020-09-10 Fixed in 5.15.13 CWE-94
TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

Priority HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502
TI-2015-04413 CVE-2015-5254 · GHSA-q9hr-3pg4-3jp4

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in…

Priority HIGH 69

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMess…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.38191 Published 2016-01-08 Partial fix · 5.11.3, 5.12.2 CWE-20
TI-2020-10923 CVE-2020-13947 · GHSA-66gw-ch5v-74v8

Cross-site scripting in Apache ActiveMQ

Priority HIGH 67

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.79179 Published 2021-02-08 Fixed in 5.16.1, 5.15.14 CWE-79
TI-2015-01643 CVE-2015-1830 · GHSA-3v63-f83x-37x4

Directory traversal vulnerability in the fileserver upload/download functionality for…

Priority MEDIUM 64

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories vi…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.84408 Published 2015-08-19 Fixed in 5.11.2 CWE-22
TI-2010-01531 CVE-2010-1587 · GHSA-v2c9-9m8v-8jjm

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0…

Priority MEDIUM 62

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/qu…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.78018 Published 2010-04-28 Fixed in 5.3.2 CWE-20
TI-2018-05783 CVE-2018-8006 · GHSA-hvwm-2624-rp9x

Cross-site scripting in Apache ActiveMQ

Priority MEDIUM 60

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.55695 Published 2018-10-10 Partial fix · 5.15.6 CWE-79
Load more
Open these records in search →