Vulnerabilities

Filters

Reset all

2 selected

75 records

Sort

Vendor: Apache Component: Activemq Clear all filters

TI-2026-52537 CVE-2026-74761 · GHSA-hx9m-72qj-2q46

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

MEDIUM 40

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00623 Published 2026-09-09 Fixed in 6.3.2, 5.19.11 CWE-20

TI-2026-42692 CVE-2026-59878 · GHSA-4mq2-fjvq-8232

Improper input validation in Apache ActiveMQ AMQP

MEDIUM 40

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00785 Published 2026-07-28 Fixed in 5.19.9, 6.2.8 CWE-20

TI-2026-44077 CVE-2026-61487 · GHSA-xmcq-x3wj-p8v6

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

LOW 29

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00457 Published 2026-07-28 Fixed in 5.19.9, 6.2.8 CWE-285

TI-2026-36592 CVE-2026-49434 · GHSA-h5gm-rvw6-2xpx

Improper input validation in Apache ActiveMQ Broker

MEDIUM 40

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-06-30 Partial fix · 5.19.8, 6.2.7 CWE-20

TI-2026-36590 CVE-2026-49432 · GHSA-xjwq-9jw5-jf7w

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service

MEDIUM 40

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00785 Published 2026-06-30 Partial fix · 5.19.8, 6.2.7 CWE-20

TI-2026-36775 CVE-2026-49877 · GHSA-f892-4h9f-j7g9

Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console

LOW 38

Improper Authorization vulnerability in Apache ActiveMQ.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00513 Published 2026-06-30 Fixed in 5.19.8, 6.2.7 CWE-285

TI-2026-37397 CVE-2026-50734 · GHSA-7259-vf48-52q3

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire…

MEDIUM 40

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-06-30 Partial fix · 5.19.8, 6.2.7 CWE-789

TI-2026-37413 CVE-2026-50750 · GHSA-9qj4-v6r6-3wmx

Uncontrolled resource consumption in Apache ActiveMQ Broker

MEDIUM 40

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00686 Published 2026-06-30 Fixed in 5.19.8, 6.2.7 CWE-400

TI-2026-37878 CVE-2026-52760 · GHSA-j548-68g5-9j7x

Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00679 Published 2026-06-30 Fixed in 5.19.8, 6.2.7 CWE-79

TI-2026-38892 CVE-2026-53916 · GHSA-2q9g-8573-3265

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec

MEDIUM 40

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-06-30 Partial fix · 5.19.8, 6.2.7 CWE-789

TI-2026-38893 CVE-2026-53917 · GHSA-f77w-px59-cqf5

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker…

MEDIUM 40

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2026-06-30 Partial fix · 5.19.8, 6.2.7 CWE-789

TI-2026-39329 CVE-2026-54475 · GHSA-mhp6-f224-j2c3

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover

MEDIUM 40

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2026-06-30 Partial fix · 5.19.8, 6.2.7 CWE-862

TI-2026-30569 CVE-2026-42253 · GHSA-8wm6-6fqh-phmc

Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01018 Published 2026-06-01 Fixed in 5.19.7, 6.2.6 CWE-79

TI-2026-30868 CVE-2026-42588 · GHSA-hg6c-8mvr-jqc9

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

LOW 39

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0074 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-20

TI-2026-33275 CVE-2026-45505 · GHSA-v853-w46p-fv2h

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass

MEDIUM 41

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-20

TI-2026-34264 CVE-2026-46605 · GHSA-cpw7-g3p5-qrfq

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

LOW 20

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00348 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-285

TI-2026-36361 CVE-2026-49157 · GHSA-99qx-5qqr-4j95

Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default

MEDIUM 40

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0044 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-276

TI-2026-36462 CVE-2026-49270 · GHSA-hf52-78x8-6w3w

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription…

LOW 27

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00369 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-1230

TI-2026-29683 CVE-2026-41044 · GHSA-mr6m-xj7v-3cv3

Improper input validation in Apache ActiveMQ

MEDIUM 42

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0098 Published 2026-04-24 Partial fix · 5.19.6, 6.2.5 CWE-20

TI-2026-29682 CVE-2026-41043 · GHSA-2jp3-2923-9h52

Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues

LOW 36

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0056 Published 2026-04-24 Partial fix · 5.19.6, 6.2.5 CWE-79

TI-2026-29218 CVE-2026-40466 · GHSA-w3w2-mpp5-92gm

Improper input validation in Apache ActiveMQ Broker

MEDIUM 48

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04783 Published 2026-04-24 Partial fix · 5.19.6, 6.2.5 CWE-20

TI-2026-28294 CVE-2026-39304 · GHSA-5568-6qcg-g7fx

Uncontrolled resource consumption in Apache ActiveMQ Client

MEDIUM 41

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00912 Published 2026-04-10 Partial fix · 5.19.4, 6.2.4 CWE-400

TI-2026-25646 CVE-2026-33227 · GHSA-h2h4-5m64-m273

Path traversal in Apache ActiveMQ Client

LOW 20

Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00426 Published 2026-04-07 Partial fix · 5.19.3, 6.2.2 CWE-22

TI-2026-26494 CVE-2026-34197 · GHSA-rxpj-7qvf-xv32

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

CRITICAL 97KEV

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.98256 Published 2026-04-07 Fixed in 5.19.4, 6.2.3 +1 CWE-20

TI-2025-40693 CVE-2025-66168 · GHSA-c825-6ph3-4h84

Integer overflow in Apache ActiveMQ

MEDIUM 40

WARNING: Users of 6.x should upgrade to 6.2.4 or later as the fix was missed in previous 6.x releases.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00872 Published 2026-03-04 Partial fix · 5.19.2, 6.1.9 +1 CWE-190