Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

8 records in Traffic Control · all components

TI-2024-30436 CVE-2024-45387 · GHSA-vq94-9pfv-ccqr

Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

Priority HIGH 79

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.66091 Published 2024-12-23 Fixed in 7.0.0, 8.0.2 CWE-285
TI-2021-19325 CVE-2021-43350 · GHSA-mg2c-rc36-p594

LDAP filter injection vulnerability in Traffic Ops

Priority MEDIUM 50

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04761 Published 2021-11-11 Fixed in 6.0.1, 5.1.4 CWE-90
TI-2019-09251 CVE-2019-12405 · GHSA-3f8r-4qwm-r7jf

Improper authentication in Apache Traffic Control

Priority MEDIUM 48

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03455 Published 2019-09-09 Fixed in 3.0.2-RC1 CWE-287
TI-2017-05306 CVE-2017-7670 · GHSA-f2wr-c4c4-xjg7

Uncontrolled resource consumption in Apache Traffic Control

Priority MEDIUM 40

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04671 Published 2017-07-10 Fixed in 1.8.1, 2.0.0 +3 CWE-400
TI-2022-07358 CVE-2022-23206 · GHSA-wp47-9r3h-xfgq

Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

Priority LOW 37

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01978 Published 2022-02-06 Fixed in 6.1.0, 5.1.6 CWE-918
TI-2020-13271 CVE-2020-17522 · GHSA-pw59-4qgf-jxr8

Incorrect permission assignment in Apache Traffic Control

Priority LOW 33

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arb…

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.03976 Published 2021-01-26 Fixed in 5.0.0 CWE-732
TI-2021-18531 CVE-2021-42009 · GHSA-gw97-f6h8-gm94

Apache Traffic Control Traffic Ops Email Injection Vulnerability

Priority LOW 25

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.02824 Published 2021-10-12 Fixed in 5.1.3 CWE-20
Open these records in search →