Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

8 records in Jackrabbit · all components

TI-2015-01646 CVE-2015-1833 · GHSA-9284-j4c9-779q

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before…

Priority MEDIUM 62

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitra…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.55949 Published 2015-05-29 Fixed in 2.0.6, 2.2.14 +4 CWE-20
TI-2023-19328 CVE-2023-37895 · GHSA-q8cm-3v62-jj79

Apache Jackrabbit RMI access can lead to RCE

Priority MEDIUM 55

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03239 Published 2023-07-25 Fixed in 2.21.18, 2.20.11 CWE-502
TI-2026-69192 CVE-2026-92414 · GHSA-3mf8-5fj8-p748

Session hijacking in Apache Jackrabbit WebDAV server

Priority MEDIUM 49

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00725 Published 2026-10-07 No fix listed CWE-384
TI-2016-05842 CVE-2016-6801 · GHSA-9fc7-rhq3-wm7x

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in…

Priority MEDIUM 42

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.1…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02293 Published 2016-09-21 Fixed in 2.4.6, 2.6.6 +4 CWE-352
TI-2025-33606 CVE-2025-53689 · GHSA-44c3-38h8-9fh9

Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

Priority MEDIUM 41

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0054 Published 2025-07-14 Partial fix · 2.20.17, 2.22.1 +1 CWE-611
Open these records in search →