Vulnerabilities

TI-2026-30569 CVE-2026-42253 · GHSA-8wm6-6fqh-phmc

Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01018 Published 2026-06-01 Fixed in 5.19.7, 6.2.6 CWE-79

TI-2026-30868 CVE-2026-42588 · GHSA-hg6c-8mvr-jqc9

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

LOW 39

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0074 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-20

TI-2026-33275 CVE-2026-45505 · GHSA-v853-w46p-fv2h

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass

MEDIUM 41

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-20

TI-2026-34264 CVE-2026-46605 · GHSA-cpw7-g3p5-qrfq

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal

LOW 20

Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00348 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-285

TI-2026-36361 CVE-2026-49157 · GHSA-99qx-5qqr-4j95

Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default

MEDIUM 40

Incorrect Default Permissions vulnerability in Apache ActiveMQ.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0044 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-276

TI-2026-36462 CVE-2026-49270 · GHSA-hf52-78x8-6w3w

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription…

LOW 27

Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00369 Published 2026-06-01 Partial fix · 5.19.7, 6.2.6 CWE-1230