Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

12 records in Allura · all components

TI-2026-51377 CVE-2026-73240 · GHSA-29mg-2cr6-59xc

Apache Allura: Git command injection

Priority MEDIUM 51

Specifically crafted inputs may lead to git argument injection in Apache Allura.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01043 Published 2026-08-12 Fixed in 1.19.1 CWE-88
TI-2026-48566 CVE-2026-69223 · GHSA-q9jm-8x7q-2v2g

Apache Allura: Server-side request forgery

Priority MEDIUM 49

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00781 Published 2026-08-11 Fixed in 1.19.1 CWE-918
TI-2018-01203 CVE-2018-1299 · GHSA-693w-mp32-8pwq

Path traversal in Apache Allura

Priority LOW 38

In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03001 Published 2018-02-06 No fix listed CWE-22
TI-2019-07410 CVE-2019-10085 · GHSA-rx6m-v3fr-phmq

Cross-site scripting in Apache Allura

Priority LOW 35

In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0514 Published 2019-06-18 No fix listed CWE-79
TI-2026-52764 CVE-2026-75099 · GHSA-5xjj-33wr-w9j3

Apache Allura: Unauthenticated REST disclosure

Priority LOW 31

Unauthenticated REST disclosure of certain content items in Apache Allura.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00574 Published 2026-08-24 No fix listed CWE-200
TI-2018-01222 CVE-2018-1319 · GHSA-fcg7-7g94-695r

Injection in Apache Allura

Priority LOW 31

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02163 Published 2018-03-15 Fixed in 1.8.1 CWE-74
TI-2026-51376 CVE-2026-73239 · GHSA-mjpp-gw39-h7mj

Apache Allura: Missing permission checks IDOR

Priority LOW 30

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00622 Published 2026-08-12 Fixed in 1.19.1 CWE-280
TI-2026-51375 CVE-2026-73238 · GHSA-26cw-37ff-mmw4

Apache Allura: XSS in code display

Priority LOW 29

XSS vulnerability in code display in Apache Allura.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00794 Published 2026-08-12 Fixed in 1.19.1 CWE-80
TI-2026-51374 CVE-2026-73237 · GHSA-q6fp-vfv9-v477

Apache Allura: XSS in markdown pipeline

Priority LOW 29

XSS vulnerability in Markdown handling in Apache Allura.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00794 Published 2026-08-12 Fixed in 1.19.1 CWE-80
TI-2023-25310 CVE-2023-46851 · GHSA-7f2c-c54p-7m36

Apache Allura: sensitive information exposure via import

Priority LOW 26

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.01647 Published 2023-11-07 No fix listed CWE-20
TI-2024-25633 CVE-2024-38379 · GHSA-7p4c-c4rq-7g98

Apache Allura: Stored authenticated XSS

Priority LOW 23

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00692 Published 2024-06-22 No fix listed CWE-79
Open these records in search →