Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

17 records in Kafka · all components

TI-2018-12295 CVE-2018-17196 · GHSA-47w3-66wq-cpxg

Improper input validation in Apache Kafka

Priority MEDIUM 46

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05379 Published 2019-07-11 Partial fix · 2.1.1 CWE-20
TI-2019-09246 CVE-2019-12399 · GHSA-6jmf-mxwf-r3jc

Cleartext transmission of sensitive information in Apache Kafka

Priority LOW 39

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03915 Published 2020-01-14 Fixed in 2.0.2, 2.1.2 +2 CWE-319
TI-2021-15833 CVE-2021-38153 · GHSA-3j6g-hxx5-3q26

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Priority LOW 36

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.06201 Published 2021-09-22 Partial fix · 2.6.3, 2.7.2 +1 CWE-203
TI-2017-09335 CVE-2017-12610 · GHSA-xm78-4m3g-7wm7

Improper authentication in Apache Kafka

Priority LOW 35

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-i…

CVSS 3.0MEDIUM 6.8 Network Low privileges No interaction EPSS 0.02872 Published 2018-07-26 Partial fix · 0.10.2.2, 0.11.0.2 CWE-287
TI-2020-16544 CVE-2020-27218 · GHSA-86wm-rrjm-8wh8

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2…

Priority LOW 33

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.08277 Published 2020-11-28 Partial fix · 9.4.35.v20201120 CWE-226
TI-2018-01193 CVE-2018-1288 · GHSA-gh27-38p5-mrxc

Code injection in Apache Kafka

Priority LOW 32

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data r…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.04801 Published 2018-07-26 Partial fix · 0.10.2.2, 0.11.0.3 +1 CWE-94
Open these records in search →