Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

11 records in Fory · all components

TI-2025-38065 CVE-2025-61622 · GHSA-538v-3wq9-4h3r

Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory

HIGH 73

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.47777 Published 2025-10-01 Fixed in 0.12.3 CWE-502

TI-2026-50130 CVE-2026-71558 · GHSA-rwv5-p9fv-c8fp

Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization

MEDIUM 51

Heap type confusion vulnerability in Apache Fory C++ deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0099 Published 2026-08-07 Fixed in 1.5.0 CWE-502

TI-2026-46171 CVE-2026-64608 · GHSA-wh2x-66qr-23v8

Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths

MEDIUM 50

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00806 Published 2026-07-21 Fixed in 1.4.0 CWE-502

TI-2026-46169 CVE-2026-64606 · GHSA-qwm7-r3rv-3hw8

Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface

MEDIUM 50

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00782 Published 2026-07-21 Fixed in 1.4.0, 0.11.0 CWE-502

TI-2026-35617 CVE-2026-48207 · GHSA-m5gw-83w2-7749

Apache Fory: PyFory ReduceSerializer Incomplete Policy Enforcement

MEDIUM 50

Deserialization of untrusted data in Apache Fory PyFory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00574 Published 2026-05-21 Fixed in 1.0.0 CWE-502

TI-2026-50132 CVE-2026-71560 · GHSA-r6vj-r3jc-f9gp

Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path

MEDIUM 49

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00767 Published 2026-08-07 Fixed in 1.5.0 CWE-502

TI-2026-36874 CVE-2026-50076 · GHSA-8f39-v287-78jf

Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

MEDIUM 48

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedLi…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0052 Published 2026-06-04 Fixed in 1.1.0 CWE-502

TI-2026-46172 CVE-2026-64609 · GHSA-8w3v-jcfp-ffw5

Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization

MEDIUM 47

Out-of-bounds read via sun.misc.Unsafe in Apache Fory.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00777 Published 2026-07-21 Fixed in 1.4.0, 0.11.0 CWE-125

TI-2026-50131 CVE-2026-71559 · GHSA-63m9-m4r7-4qjg

Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata

MEDIUM 40

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an unca…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00799 Published 2026-08-07 Fixed in 1.5.0 CWE-502

TI-2026-42810 CVE-2026-60080 · GHSA-8g3p-5q43-955w

Apache Fory: Rust MetaString heap use-after-free

LOW 39

Use After Free vulnerability in the Rust deserialization logic of Apache Fory.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00684 Published 2026-07-21 No fix listed CWE-416

TI-2025-36891 CVE-2025-59328 · GHSA-5hmf-8wx5-4qq3

Apache Fory: Denial of Service (DoS) due to Deserialization of Untrusted malicious large Data

LOW 30

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00685 Published 2025-09-15 Fixed in 0.12.2 CWE-502

Open these records in search →

Critical	776
High	1543
Medium	1572
Low	112
No CVSS	51