Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

15 records in Atlas · all components

TI-2022-15183 CVE-2022-34271 · GHSA-p782-4j23-xqcg

Apache Atlas: zip path traversal in import functionality

Priority MEDIUM 43

A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01476 Published 2022-12-14 Fixed in 2.3.0 CWE-22
TI-2026-29304 CVE-2026-40563 · GHSA-35xx-9xrg-gwhf

Apache Atlas: Script injection allows access to unintended data

Priority LOW 38

Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00464 Published 2026-05-04 Fixed in 2.5.0 CWE-94
TI-2017-02370 CVE-2017-3154 · GHSA-fx92-wh72-8g9q

Information disclosure in Apache Atlas

Priority LOW 37

Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02053 Published 2017-08-29 Fixed in 0.7.1-incubating CWE-200
TI-2016-07209 CVE-2016-8752 · GHSA-m2rr-h6g4-9cm9

Improper access control in Apache Atlas

Priority LOW 37

Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02127 Published 2017-08-29 Fixed in 0.8-incubating CWE-284
TI-2020-10906 CVE-2020-13928 · GHSA-h6xq-3h62-99qx

Cross-site scripting in Apache Atlas

Priority LOW 32

Apache Atlas before 2.1.0 contain a XSS vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02587 Published 2020-09-16 Fixed in 2.1.0 CWE-79
TI-2017-02369 CVE-2017-3153 · GHSA-frqh-x6r7-h6mq

Cross-site scripting in Apache Atlas

Priority LOW 32

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02215 Published 2017-08-29 Fixed in 0.7.1-incubating CWE-79
TI-2017-02368 CVE-2017-3152 · GHSA-9xwq-72vp-5j3c

Cross-site scripting in Apache Atlas

Priority LOW 32

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02215 Published 2017-08-29 Fixed in 0.7.1-incubating CWE-79
TI-2017-02367 CVE-2017-3151 · GHSA-236h-r3w7-c85c

Cross-site scripting in Apache Atlas

Priority LOW 31

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02174 Published 2017-08-29 Fixed in 0.7.1-incubating CWE-79
Open these records in search →