Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

9 records in Pdfbox · all components

TI-2019-00201 CVE-2019-0228 · GHSA-c9jj-3wvg-q65h

XML external entity injection in Apache PDFBox

MEDIUM 54

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09451 Published 2019-04-17 Fixed in 2.0.15 CWE-611

TI-2016-01985 CVE-2016-2175 · GHSA-4c32-xmgj-2g98

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML…

MEDIUM 41

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0384 Published 2016-06-01 Partial fix · 1.8.12, 2.0.1 CWE-611

TI-2018-05813 CVE-2018-8036 · GHSA-j2xq-pfff-mvgg

Infinite loop in Apache PDFBox

LOW 36

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.03992 Published 2018-07-03 Partial fix · 1.8.15, 2.0.11 CWE-835

TI-2021-11808 CVE-2021-31811 · GHSA-fg3j-q579-v8x4

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file

LOW 31

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03572 Published 2021-06-12 Partial fix · 2.0.24 CWE-789

TI-2021-09241 CVE-2021-27906 · GHSA-6vqp-h455-42mr

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file

LOW 31

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03337 Published 2021-03-19 Partial fix · 2.0.23 CWE-789

TI-2018-08451 CVE-2018-11797 · GHSA-gx96-vgf7-hwfg

Uncontrolled resource consumption in Apache PDFBox

LOW 31

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03505 Published 2018-10-05 Partial fix · 1.8.16, 2.0.12 CWE-400

TI-2021-11809 CVE-2021-31812 · GHSA-7grw-6pjh-jpc9

A carefully crafted PDF file can trigger an infinite loop while loading the file

LOW 30

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03054 Published 2021-06-12 Partial fix · 2.0.24 CWE-834

TI-2021-09195 CVE-2021-27807 · GHSA-2h3j-m7gr-25xj

A carefully crafted PDF file can trigger an infinite loop while loading the file

LOW 30

A carefully crafted PDF file can trigger an infinite loop while loading the file.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.02993 Published 2021-03-19 Partial fix · 2.0.23 CWE-834

TI-2026-26280 CVE-2026-33929 · GHSA-gcj8-76p4-g2fq

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

LOW 21

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00711 Published 2026-04-14 Partial fix · 2.0.37, 3.0.8 CWE-22

Open these records in search →

Critical	776
High	1543
Medium	1572
Low	112
No CVSS	51