Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

11 records in Apr-util · all components

TI-2009-01863 CVE-2009-1955 · GHSA-hfr6-pxvf-frf7

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util…

HIGH 65

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of ser…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.52988 Published 2009-06-06 Fixed CWE-776

TI-2009-02302 CVE-2009-2412 · GHSA-8g6v-29rv-3j6m

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache…

MEDIUM 58

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or po…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.13781 Published 2009-08-06 Fixed CWE-189

TI-2026-26488 CVE-2026-34191 · GHSA-39fj-527g-2hph

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

MEDIUM 48

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00587 Published 2026-08-06 No fix listed CWE-89

TI-2026-24855 CVE-2026-32327 · GHSA-qfxp-vc85-jg39

Apache Portable Runtime Utility: apr-util XML stack recursion crash

MEDIUM 46

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00458 Published 2026-08-06 Partial fix CWE-674

TI-2010-01567 CVE-2010-1623 · GHSA-2cc8-vf33-qm9m

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache…

MEDIUM 42

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.2033 Published 2010-10-04 Fixed CWE-119

TI-2009-01864 CVE-2009-1956 · GHSA-4wj9-j34x-wjxp

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on…

MEDIUM 42

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via cr…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.12042 Published 2009-06-06 Fixed CWE-189

TI-2026-26754 CVE-2026-34502 · GHSA-m2cw-c66m-j23g

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

LOW 39

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00508 Published 2026-08-06 Partial fix CWE-122

TI-2026-26753 CVE-2026-34501 · GHSA-m335-2qh4-r66x

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

LOW 39

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00508 Published 2026-08-06 Partial fix CWE-122

TI-2025-31532 CVE-2025-49506 · GHSA-73wm-47mq-62r5

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

LOW 39

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularl…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2026-08-06 Partial fix CWE-208

TI-2011-01700 CVE-2011-1928 · GHSA-9h43-8fmr-wxgx

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library…

LOW 33

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10322 Published 2011-05-24 Fixed CWE-399

TI-2009-00023 CVE-2009-0023 · GHSA-8jp8-5574-2q6q

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before…

LOW 31

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used wi…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0853 Published 2009-06-06 Fixed CWE-119

Open these records in search →

Critical	776
High	1543
Medium	1572
Low	112
No CVSS	51