Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

13 records in Spamassassin · all components

TI-2006-02383 CVE-2006-2447 · GHSA-xj48-9vrg-vxxc

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch…

MEDIUM 62

SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the vi…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.7581 Published 2006-06-06 Fixed

TI-2018-08437 CVE-2018-11780 · GHSA-ph2p-v983-f856

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

MEDIUM 55

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.1082 Published 2018-09-17 Fixed in 3.4.2 CWE-94

TI-2020-01870 CVE-2020-1946 · GHSA-qmmx-pr2m-q429

Apache SpamAssassin has an OS Command Injection vulnerability

MEDIUM 51

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06132 Published 2021-03-25 Partial fix · 3.4.5 CWE-78

TI-2020-01855 CVE-2020-1931 · GHSA-p22p-qh9c-7725

OS command injection in Apache SpamAssassin

MEDIUM 45

A command execution issue was found in Apache SpamAssassin prior to 3.4.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.06464 Published 2020-01-30 Partial fix · 3.4.3 CWE-78

TI-2020-01854 CVE-2020-1930 · GHSA-pxq8-92ff-q845

OS command injection in Apache SpamAssassin

MEDIUM 45

A command execution issue was found in Apache SpamAssassin prior to 3.4.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07053 Published 2020-01-30 Partial fix · 3.4.3 CWE-78

TI-2019-09265 CVE-2019-12420 · GHSA-q6ww-c56f-5fhw

Uncontrolled resource consumption in Apache SpamAssassin

MEDIUM 43

In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07234 Published 2019-12-12 Partial fix CWE-400

TI-2018-08438 CVE-2018-11781 · GHSA-qvvf-537j-pvg4

Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.

LOW 36

Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00984 Published 2018-09-17 Partial fix · 3.4.2 CWE-94

TI-2017-11478 CVE-2017-15705 · GHSA-m63q-qrvc-wwrm

Improper input validation in Apache SpamAssassin

LOW 35

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.07879 Published 2018-09-17 Partial fix · 3.4.2 CWE-20

TI-2016-01136 CVE-2016-1238 · GHSA-hm5v-6984-hfqp

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3)…

LOW 35

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) c…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00779 Published 2016-08-02 Will not fix CWE-264

TI-2005-01196 CVE-2005-1266 · GHSA-8vfq-99xj-3qjx

Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of…

LOW 34

Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08349 Published 2005-06-22 Fixed

TI-2005-03176 CVE-2005-3351 · GHSA-m2fg-q836-9pmq

SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large…

LOW 33

SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07259 Published 2005-11-20 Fixed

TI-2018-08459 CVE-2018-11805 · GHSA-639c-xqgw-3jh5

OS command injection in Apache SpamAssassin

LOW 31

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00907 Published 2019-12-12 Partial fix CWE-78

TI-2007-00438 CVE-2007-0451 · GHSA-q35m-3hwc-qp9v

Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via…

LOW 30

Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06869 Published 2007-02-16 Fixed CWE-399

Open these records in search →