Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

25 records in Fineract · all components

TI-2026-82963 CVE-2026-64618 · GHSA-3536-74c2-mgrr

SQL injection in Apache Fineract Search API

Priority MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00624 Published 2026-10-30 No fix listed CWE-89
TI-2018-08455 CVE-2018-11801 · GHSA-p9jr-5339-4hvx

SQL injection in Apache Fineract

Priority MEDIUM 50

SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05217 Published 2019-06-11 No fix listed CWE-89
TI-2018-08454 CVE-2018-11800 · GHSA-2c85-r6w7-qf97

SQL injection in Apache Fineract

Priority MEDIUM 50

SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05217 Published 2019-06-11 No fix listed CWE-89
TI-2025-35952 CVE-2025-58130 · GHSA-rgjm-h5hc-fhwv

Apache Fineract: Server Key not masked

Priority MEDIUM 48

Insufficiently Protected Credentials vulnerability in Apache Fineract.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00428 Published 2025-12-12 Fixed in 1.12.1 CWE-522
TI-2018-01195 CVE-2018-1290 · GHSA-6f7f-7xqp-mrqg

SQL injection in Apache Fineract

Priority MEDIUM 48

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03234 Published 2018-04-20 No fix listed CWE-89
TI-2026-27309 CVE-2026-35152 · GHSA-9vv4-g2cx-75rq

Apache Fineract: SQL injection in runreports endpoint

Priority MEDIUM 46

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03281 Published 2026-07-15 No fix listed CWE-89
TI-2024-15579 CVE-2024-23539 · GHSA-p2vw-f9rr-2m2r

SQL injection in Apache Fineract

Priority MEDIUM 45

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01494 Published 2024-03-29 No fix listed CWE-89
TI-2024-15578 CVE-2024-23538 · GHSA-x73g-5x4f-9mqr

SQL injection in Apache Fineract

Priority MEDIUM 45

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01291 Published 2024-03-29 Fixed in 1.8.5 CWE-89
TI-2025-17175 CVE-2025-23408 · GHSA-6jvx-rr4c-j9j5

Apache Fineract: weak password policy

Priority MEDIUM 43

Weak Password Requirements vulnerability in Apache Fineract.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00515 Published 2025-12-12 Fixed in 1.11.0 CWE-521
TI-2018-01194 CVE-2018-1289 · GHSA-ffpg-cvcj-j959

SQL injection in Apache Fineract

Priority MEDIUM 43

In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' and 'sortOrder' whi…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02529 Published 2018-04-20 No fix listed CWE-89
TI-2024-15577 CVE-2024-23537 · GHSA-xcvp-xvv5-6298

Improper privilege management in Apache Fineract

Priority MEDIUM 42

Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01104 Published 2024-03-29 Fixed in 1.9.0 CWE-269
TI-2017-03663 CVE-2017-5663 · GHSA-432p-g7rx-g388

SQL injection in Apache Fineract

Priority MEDIUM 42

In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious SQL into SELECT queries.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02089 Published 2017-12-14 No fix listed CWE-89
TI-2018-01197 CVE-2018-1292 · GHSA-c8cf-c326-jmwf

SQL injection in Apache Fineract

Priority LOW 39

Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'r…

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.02045 Published 2018-04-20 No fix listed CWE-89
TI-2018-01196 CVE-2018-1291 · GHSA-7wqp-wr74-cqv2

SQL injection in Apache Fineract

Priority LOW 39

Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended directly with SQL statem…

CVSS 3.0HIGH 8.1 Network Low privileges No interaction EPSS 0.02003 Published 2018-04-20 No fix listed CWE-89
TI-2020-13263 CVE-2020-17514 · GHSA-qwv7-pm3r-wfcw

disabled hostname verificiation

Priority LOW 38

Apache Fineract prior to 1.5.0 disables HTTPS hostname verification in ProcessorHelper in the configureClient method.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.03401 Published 2021-05-27 Fixed in 1.5.0
TI-2018-14350 CVE-2018-20243 · GHSA-5f27-8j8c-cr98

Insufficiently protected credentials in Apache Fineract

Priority LOW 38

The implementation of POST with the username and password in the URL parameters exposed the credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02673 Published 2020-10-13 No fix listed CWE-522
TI-2025-35959 CVE-2025-58137 · GHSA-5rq6-3978-369w

Apache Fineract: IDOR via self-service API

Priority LOW 37

Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0039 Published 2025-12-12 Fixed in 1.12.1 CWE-639
TI-2023-10656 CVE-2023-25196 · GHSA-wvv8-m353-pjr5

Apache Fineract: SQL injection vulnerability

Priority LOW 23

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01297 Published 2023-03-28 No fix listed CWE-89
Open these records in search →