Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

14 records in Storm · all components

TI-2021-15907 CVE-2021-38294 · GHSA-6768-mcjc-8223

Shell Command Injection Vulnerability in Nimbus Thrift Server

Priority HIGH 83

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.83805 Published 2021-10-25 Fixed in v1.2.4, 2.2.1 +2 CWE-74
TI-2021-17787 CVE-2021-40865 · GHSA-w729-7633-2fw5

Unsafe Pre-Authentication Deserialization In Workers

Priority HIGH 78

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.6418 Published 2021-10-25 Fixed in v1.2.4, 2.2.1 +2 CWE-502
TI-2018-08436 CVE-2018-11779 · GHSA-25pc-85qf-6j69

Deserialization of untrusted data in Apache Storm

Priority MEDIUM 48

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03477 Published 2019-07-25 Fixed in 1.2.3 CWE-502
TI-2017-07179 CVE-2017-9799 · GHSA-x825-rjww-2245

It was found that under some situations and configurations of Apache Storm 1.x before…

Priority MEDIUM 46

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.04872 Published 2017-08-09 Fixed in 1.1.1, 1.0.4
TI-2018-01232 CVE-2018-1331 · GHSA-p8jx-x2vw-wm33

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and…

Priority MEDIUM 45

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04424 Published 2018-07-10 Fixed in 1.2.2, 1.1.3
TI-2019-00178 CVE-2019-0202 · GHSA-r9pv-hg64-jqrp

Information disclosure in Apache Storm

Priority LOW 37

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02043 Published 2019-07-25 Fixed in 1.2.3 CWE-200
TI-2026-29718 CVE-2026-41081 · GHSA-j2q8-xx3q-8fqh

Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

Priority LOW 35

Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions Affected: up to 2.8.7 Description: When TLS transport is enabled in Apache Storm without requiring…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00286 Published 2026-04-27 Fixed in 2.8.7 CWE-287
TI-2018-01233 CVE-2018-1332 · GHSA-q35p-chc6-7x57

Information disclosure in Apache Storm

Priority LOW 32

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01413 Published 2018-06-05 Fixed in 1.1.3, 1.2.2 CWE-200
TI-2018-05785 CVE-2018-8008 · GHSA-898j-5cc8-cmf5

Path traversal in Apache Storm

Priority LOW 29

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as…

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.02247 Published 2018-06-05 Fixed in 1.1.3, 1.2.2 +1 CWE-22
TI-2026-27671 CVE-2026-35565 · GHSA-f2hp-qw27-8wfq

Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI

Priority LOW 25

Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization component interpolates topology metadata including component…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00466 Published 2026-04-13 Fixed in 2.8.6 CWE-79
Open these records in search →