Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

8 records in Tomcat Native · all components

TI-2026-59033 CVE-2026-86246 · GHSA-9p2m-jvmj-wh8q

Apache Tomcat Native: Insecure OpenSSL options enabled

Priority MEDIUM 47

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and A…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00347 Published 2026-09-23 Partial fix CWE-1188
TI-2026-59030 CVE-2026-86243 · GHSA-w68h-fc49-cmrg

Apache Tomcat Native: DoS via TLS handshake

Priority MEDIUM 40

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00564 Published 2026-09-23 Partial fix CWE-126
TI-2018-05797 CVE-2018-8020 · GHSA-r94v-7v68-9rjq

Improper certificate validation in Apache Tomcat Native

Priority LOW 39

Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses.

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.0418 Published 2018-07-31 Partial fix CWE-295
TI-2018-05796 CVE-2018-8019 · GHSA-w5fc-h82j-vq6w

Improper certificate validation in Apache Tomcat Native

Priority LOW 39

When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses.

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.0405 Published 2018-07-31 Partial fix CWE-295
TI-2017-11472 CVE-2017-15698 · GHSA-ppg5-72hh-9jj4

Improper certificate validation in Apache Tomcat Native

Priority LOW 33

When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.03527 Published 2018-01-31 Partial fix CWE-295
Open these records in search →