Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

42 records in Inlong · all components

TI-2023-28411 CVE-2023-51784 · GHSA-9xg9-hh45-xcm6

Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager

Priority MEDIUM 52

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0162 Published 2024-01-03 Fixed in 1.10.0 CWE-94
TI-2023-23393 CVE-2023-43668 · GHSA-rp6x-ggw6-8g56

Apache InLong: Jdbc Connection Security Bypass in InLong

Priority MEDIUM 52

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoa…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0143 Published 2023-10-16 Fixed in 1.9.0 CWE-639
TI-2023-17558 CVE-2023-35088 · GHSA-r5pv-7g89-cxmc

Apache InLong: SQL injection in audit endpoint

Priority MEDIUM 52

Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01643 Published 2023-07-25 Fixed in 1.8.0 CWE-89
TI-2023-10470 CVE-2023-24997 · GHSA-22j4-qc48-j8f8

Apache InLong: Jdbc Connection Security Bypass

Priority MEDIUM 52

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01325 Published 2023-02-01 No fix listed CWE-502
TI-2023-14823 CVE-2023-31098 · GHSA-w3wr-gmwf-r333

Apache InLong: Weak Password Implementation in InLong

Priority MEDIUM 51

Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01233 Published 2023-05-22 Fixed in 1.47.0 CWE-521
TI-2023-14790 CVE-2023-31062 · GHSA-q5p5-xg93-2jqc

Apache InLong: Privilege escalation vulnerability for InLong

Priority MEDIUM 51

Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01289 Published 2023-05-22 Fixed in 1.7.0 CWE-269
TI-2024-17465 CVE-2024-26580 · GHSA-p2gx-4434-pf6g

Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

Priority MEDIUM 50

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0122 Published 2024-03-06 Fixed in 1.11.0 CWE-502
TI-2024-17464 CVE-2024-26579 · GHSA-fgh3-pwmp-3qw3

Apache Inlong JDBC Vulnerability

Priority MEDIUM 50

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using malicious parameters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01139 Published 2024-05-08 Fixed in 1.12.0 CWE-502
TI-2023-14792 CVE-2023-31065 · GHSA-757p-7hp5-pqmr

Apache InLong: Insufficient Session Expiration in InLong

Priority MEDIUM 50

Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01162 Published 2023-05-22 Fixed in 1.7.0 CWE-613
TI-2023-14793 CVE-2023-31066 · GHSA-wx79-r3q8-fq9h

Apache InLong: Insecure direct object references for inlong sources

Priority MEDIUM 48

Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01355 Published 2023-05-22 Fixed in 1.7.0 CWE-552
TI-2022-19498 CVE-2022-40955 · GHSA-26m4-qjp9-xmc6

Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC

Priority MEDIUM 45

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deseriali…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02685 Published 2022-09-20 Fixed in 1.3.0 CWE-502
TI-2023-24854 CVE-2023-46227 · GHSA-jj32-3pf5-5mv5

Apache inlong has an Arbitrary File Read Vulnerability

Priority MEDIUM 42

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01372 Published 2023-10-19 Fixed in 1.9.0 CWE-502
TI-2023-23392 CVE-2023-43667 · GHSA-fpcf-qr79-hjqp

Apache InLong: Log Injection in Global functions

Priority MEDIUM 42

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create mislea…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0171 Published 2023-10-16 Fixed in 1.8.0 CWE-74
TI-2023-17260 CVE-2023-34434 · GHSA-pq67-9jf9-hc3c

Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param

Priority MEDIUM 42

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01701 Published 2023-07-25 Fixed in 1.8.0 CWE-502
TI-2023-28412 CVE-2023-51785 · GHSA-crwj-2r3c-gx2g

Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager

Priority MEDIUM 41

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01012 Published 2024-01-03 Fixed in 1.10.0 CWE-502
TI-2023-15068 CVE-2023-31454 · GHSA-rf76-whgp-fp56

Apache InLong: IDOR make users can bind any cluster

Priority MEDIUM 41

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01182 Published 2023-05-22 Fixed in 1.7.0 CWE-732
TI-2023-15067 CVE-2023-31453 · GHSA-8rjh-3mhm-966q

Apache InLong: IDOR make users can delete others' subscription

Priority MEDIUM 41

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01182 Published 2023-05-22 Fixed in 1.7.0 CWE-732
Load more
Open these records in search →