Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

9 records in Shenyu · all components

TI-2022-07916 CVE-2022-23944 · GHSA-6v39-p2xq-g5c3

Apache ShenYu 2.4.1 Improper access control

Priority HIGH 79

User can access /plugin api without authentication.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.79007 Published 2022-01-25 Fixed in 2.4.2 CWE-862
TI-2022-20760 CVE-2022-42735 · GHSA-vf8h-2wwj-jq22

Apache ShenYu Admin ultra vires

Priority MEDIUM 42

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0119 Published 2023-02-15 Fixed in 2.5.1 CWE-269
TI-2022-17499 CVE-2022-37435 · GHSA-fjjw-82xw-vfc2

Apache ShenYu Admin Improper Privilege Management

Priority MEDIUM 41

Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01341 Published 2022-09-01 Fixed in 2.5.0 CWE-732
TI-2022-07364 CVE-2022-23223 · GHSA-7wq4-89xx-g62j

Apache ShenYu Password leakage

Priority MEDIUM 40

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04306 Published 2022-01-25 Fixed in 2.4.2 CWE-522
TI-2022-09924 CVE-2022-26650 · GHSA-cw56-j3fm-7w57

Apache ShenYu (incubating) Regular expression denial of service

Priority LOW 38

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02663 Published 2022-05-17 Fixed in 2.4.3 CWE-1333
TI-2023-11025 CVE-2023-25753 · GHSA-7w8v-5fcq-pvqw

Server-Side Request Forgery in Apache ShenYu

Priority LOW 31

There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01137 Published 2023-10-19 Fixed in 2.6.0 CWE-918
Open these records in search →