Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

12 records in Druid · all components

TI-2021-14874 CVE-2021-36749 · GHSA-9p5g-vg43-mj5r

Incorrect authorization in Apache Druid

Priority HIGH 69

In the Druid ingestion system, the InputSource is used for reading data from a certain data source.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.80907 Published 2021-09-24 Fixed in 0.22.0 CWE-863
TI-2026-19261 CVE-2026-23906 · GHSA-q672-hfc7-g833

Apache Druid: Authentication Bypass via LDAP Anonymous Bind

Priority MEDIUM 51

Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01066 Published 2026-02-10 Fixed in 36.0.0 CWE-287
TI-2020-01882 CVE-2020-1958 · GHSA-qh2g-7h5p-mxf4

Injection in Apache Druid

Priority LOW 36

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04565 Published 2020-04-01 Fixed in 0.17.1 CWE-74
TI-2021-20275 CVE-2021-44791 · GHSA-8rmv-98m4-g5c6

Reflected XSS on certain HTTP endpoints

Priority LOW 32

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02275 Published 2022-07-07 Fixed in 0.23.0 CWE-79
TI-2025-20620 CVE-2025-27888 · GHSA-2xcr-p767-f3rv

Apache Druid: Server-Side Request Forgery and Cross-Site Scripting

Priority LOW 30

Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerabili…

CVSS 4.0MEDIUM 5.8 Network Low privileges User interaction EPSS 0.01947 Published 2025-03-20 Fixed in 31.0.2, 32.0.1 CWE-601
TI-2022-11510 CVE-2022-28889 · GHSA-pgq7-jcj5-xx6h

Clickjacking in the web console

Priority LOW 24

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01918 Published 2022-07-07 Fixed in 0.23.0 CWE-1021
Open these records in search →