Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

14 records in Jmeter · all components

TI-2021-04451 CVE-2021-21351 · GHSA-hrcp-8f3q-4w2c

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.82136 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04446 CVE-2021-21346 · GHSA-4hrm-m67v-5cxr

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.76367 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04444 CVE-2021-21344 · GHSA-59jw-jqf4-3wq3

XStream is vulnerable to an Arbitrary Code Execution attack

CRITICAL 88

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7598 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04445 CVE-2021-21345 · GHSA-hwpc-8xqv-jvj4

XStream is vulnerable to a Remote Command Execution attack

HIGH 81

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.72324 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04441 CVE-2021-21341 · GHSA-2p3x-qw9c-25hh

XStream can cause a Denial of Service

HIGH 78

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.77801 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2021-04442 CVE-2021-21342 · GHSA-hvv8-336g-rx3m

Deserialization of untrusted data in xstream

HIGH 76

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.4999 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04449 CVE-2021-21349 · GHSA-f6hm-88x3-mfjv

Deserialization of untrusted data in xstream

HIGH 73

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.46826 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04443 CVE-2021-21343 · GHSA-74cv-f58x-f9wf

Deserialization of untrusted data in xstream

HIGH 69

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.46666 Published 2021-03-22 Partial fix · 1.4.16 CWE-502

TI-2021-04450 CVE-2021-21350 · GHSA-43gc-mjxg-gvrq

XStream is vulnerable to an Arbitrary Code Execution attack

HIGH 65

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.15234 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2021-04447 CVE-2021-21347 · GHSA-qpfq-ph7r-qv6f

XStream is vulnerable to an Arbitrary Code Execution attack

MEDIUM 64

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14301 Published 2021-03-22 Partial fix · 1.4.16 CWE-434

TI-2018-01201 CVE-2018-1297 · GHSA-7v85-6hv2-rwgw

Cleartext transmission of sensitive information in Apache JMeter

MEDIUM 55

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11502 Published 2018-02-13 Fixed in 4.0 CWE-319

TI-2021-04448 CVE-2021-21348 · GHSA-56p8-3fh9-4cvq

XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)

MEDIUM 54

XStream is a Java library to serialize objects to XML and back again.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13832 Published 2021-03-22 Partial fix · 1.4.16 CWE-400

TI-2018-01192 CVE-2018-1287 · GHSA-j7j7-g4ww-pxg5

Improper signature verification in Apache JMeter

MEDIUM 48

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03352 Published 2018-02-14 Fixed in 4.0 CWE-347

TI-2019-00164 CVE-2019-0187 · GHSA-wg37-7mrv-cfwm

Broken or risky cryptographic algorithm in Apache JMeter

MEDIUM 47

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options).

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02636 Published 2019-03-06 Fixed in 5.1 CWE-327

Open these records in search →