Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

76 records in Ofbiz · all components

TI-2024-21190 CVE-2024-32113 · GHSA-38cv-ch3v-j5cw

Apache OFBiz: Path traversal leading to RCE

Priority CRITICAL 100KEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99916 Published 2024-05-08 Fixed in 18.12.13 CWE-22
TI-2024-23934 CVE-2024-36104 · GHSA-77m3-6865-xvqj

Apache OFBiz: Path traversal leading to a RCE

Priority HIGH 83

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.87883 Published 2024-06-04 Fixed in 18.12.14 CWE-22
TI-2021-10676 CVE-2021-30128 · GHSA-7ffx-8mw5-5mgr

Unsafe deserialization in Apache OFBiz

Priority HIGH 82

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.81209 Published 2021-04-27 Fixed in 17.12.07 CWE-502
TI-2022-09383 CVE-2022-25813 · GHSA-wrch-3crx-rcpq

Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz

Priority HIGH 69

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.67261 Published 2022-09-02 No fix listed CWE-1336
TI-2023-27859 CVE-2023-50968 · GHSA-gm45-8hgv-xg5f

Apache OFBiz: Arbitrary file properties reading and SSRF attack

Priority HIGH 68

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63373 Published 2023-12-26 No fix listed CWE-200
TI-2025-34263 CVE-2025-54466 · GHSA-7vg9-49f9-pfxr

Apache OFBiz: RCE Vulnerability in scrum plugin

Priority HIGH 65

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.27963 Published 2025-08-15 Fixed in 24.09.02 CWE-94
TI-2025-21949 CVE-2025-30676 · GHSA-vhg6-m6c8-39c2

Apache OFBiz: Stored XSS Vulnerability

Priority MEDIUM 64

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.67607 Published 2025-04-01 Fixed in 18.12.19 CWE-80
TI-2019-00166 CVE-2019-0189 · GHSA-7f6q-4x5x-p74v

Deserialization of untrusted data in Apache OFBiz

Priority MEDIUM 63

The java.io.ObjectInputStream is known to cause Java serialisation issues.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.2371 Published 2019-09-11 No fix listed CWE-502
TI-2013-02012 CVE-2013-2250 · GHSA-4xmq-9x3w-xpvr

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through…

Priority MEDIUM 57

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharac…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.12366 Published 2013-08-15 No fix listed CWE-20
TI-2018-05810 CVE-2018-8033 · GHSA-2v2f-rp8w-vrxh

Information disclosure in Apache OFBiz

Priority MEDIUM 54

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.25743 Published 2018-12-13 No fix listed CWE-200
Load more
Open these records in search →