Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

10 records in Poi · all components

TI-2017-09351 CVE-2017-12626 · GHSA-523c-xh4g-mh5m

Infinite loop in Apache POI

Priority MEDIUM 51

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10142 Published 2018-01-29 Partial fix · 3.17 CWE-835
TI-2014-02855 CVE-2014-3529 · GHSA-q56h-jjj6-52mf

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary…

Priority LOW 34

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML E…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.12757 Published 2014-09-04 Partial fix · 3.10.1 CWE-611
TI-2025-22816 CVE-2025-31672 · GHSA-gmg8-593g-7mv3

Improper input validation in Apache POI

Priority LOW 33

Improper Input Validation vulnerability in Apache POI.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01382 Published 2025-04-09 Partial fix · 5.4.0 CWE-20
TI-2012-00206 CVE-2012-0213 · GHSA-jqx5-h2hw-5q4f

The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache…

Priority LOW 33

The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilizatio…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07503 Published 2012-08-07 Partial fix · 3.10-beta1 CWE-399
TI-2019-09260 CVE-2019-12415 · GHSA-9jwc-q6j3-8g9g

XML external entity injection in Apache POI

Priority LOW 27

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from intern…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00998 Published 2019-10-23 Partial fix · 4.1.1 CWE-611
Open these records in search →