Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

9 records in Ignite · all components

TI-2018-01178 CVE-2018-1273 · GHSA-4fq3-mr56-cg6r

Code injection in Spring Framework

Priority CRITICAL 100KEV

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96956 Published 2018-04-11 Partial fix · 1.13.11, 2.0.6 CWE-94
TI-2018-05795 CVE-2018-8018 · GHSA-qcjv-wfcg-mmpr

Deserialization of untrusted data in Apache Ignite

Priority MEDIUM 52

In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party v…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06705 Published 2018-07-19 Partial fix · 2.5.3, 2.4.8 +1 CWE-502
TI-2018-01199 CVE-2018-1295 · GHSA-chp4-rv79-68j3

Deserialization of untrusted data in Apache Ignite

Priority MEDIUM 51

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06349 Published 2018-04-02 Partial fix · 2.4 CWE-502
TI-2020-01886 CVE-2020-1963 · GHSA-5wm5-8q42-rhxg

Missing authorization in Apache Ignite

Priority MEDIUM 47

Apache Ignite uses H2 database to build SQL distributed execution engine.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04983 Published 2020-06-03 Fixed in 2.8.1 CWE-862
TI-2017-05322 CVE-2017-7686 · GHSA-8p83-68cw-943f

Information disclosure in Apache Ignite

Priority LOW 38

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0297 Published 2017-06-28 Fixed in 2.1 CWE-200
TI-2021-09392 CVE-2021-28163 · GHSA-j6qj-j888-vvgq

Information disclosure in Eclipse Jetty

Priority LOW 21

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadverte…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.0418 Published 2021-04-01 Partial fix · 9.4.39, 10.0.2 +1 CWE-200
Open these records in search →