Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

10 records in Batik · all components

TI-2018-05790 CVE-2018-8013 · GHSA-25gw-4pcc-45cf

Deserialization of untrusted data in Apache Batik

Priority MEDIUM 60

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.18591 Published 2018-05-24 Partial fix · 1.10 CWE-502
TI-2020-09647 CVE-2020-11987 · GHSA-2h63-qp69-fwvw

Improper input validation in Apache Batik

Priority MEDIUM 57

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.13635 Published 2021-02-24 Partial fix · 1.14 CWE-20
TI-2019-13109 CVE-2019-17566 · GHSA-cmx4-p4v5-hmr5

Server-side request forgery in Apache Batik

Priority MEDIUM 46

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10867 Published 2020-11-12 Partial fix · 1.13 CWE-918
TI-2015-00219 CVE-2015-0250 · GHSA-wfw6-mmmp-87xm

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion…

Priority MEDIUM 45

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG f…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.16564 Published 2015-03-24 Partial fix · 1.8 CWE-20
TI-2022-19036 CVE-2022-40146 · GHSA-h4qg-p7r2-cpg3

Jar url should be blocked by DefaultScriptSecurity

Priority MEDIUM 43

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07431 Published 2022-09-22 Partial fix · 1.15 CWE-918
TI-2022-20886 CVE-2022-42890 · GHSA-rwqr-m72q-v6cm

Apache Batik prior to 1.16 allows RCE via scripting

Priority LOW 39

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03355 Published 2022-10-25 Partial fix · 1.16 CWE-918
TI-2017-03662 CVE-2017-5662 · GHSA-qwgx-59jw-qfg9

XML external entity injection in Apache Batik

Priority LOW 39

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files.

CVSS 3.0HIGH 7.3 Network Low privileges User interaction EPSS 0.04118 Published 2017-04-18 Partial fix · 1.9 CWE-611
TI-2022-18181 CVE-2022-38648 · GHSA-53jm-3hc9-fqqc

PDFTranscoder does not block external resources

Priority LOW 29

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02425 Published 2022-09-22 Partial fix · 1.15 CWE-918
Open these records in search →