Apache

The vulnerabilities41

1. 8 October 2026CVE-2016-3081StrutsApache Struts Command Injection Vulnerability
2. 4 August 2026CVE-2026-34486TomcatApache Tomcat Missing Encryption of Sensitive Data Vulnerability
3. 16 April 2026CVE-2026-34197ActiveMQApache ActiveMQ Improper Input Validation Vulnerability
4. 1 May 2025CVE-2024-38475HTTP ServerApache HTTP Server Improper Escaping of Output Vulnerability
5. 1 April 2025CVE-2025-24813TomcatApache Tomcat Path Equivalence Vulnerability
6. 4 February 2025CVE-2024-45195OFBizApache OFBiz Forced Browsing Vulnerability
7. 18 September 2024CVE-2024-27348HugeGraph-ServerApache HugeGraph-Server Improper Access Control Vulnerability
8. 27 August 2024CVE-2024-38856OFBizApache OFBiz Incorrect Authorization Vulnerability
9. 7 August 2024CVE-2024-32113OFBizApache OFBiz Path Traversal Vulnerability
10. 23 May 2024CVE-2020-17519FlinkApache Flink Improper Access Control Vulnerability
11. 8 January 2024CVE-2023-27524SupersetApache Superset Insecure Default Initialization of Resource Vulnerability
12. 2 November 2023CVE-2023-46604ActiveMQApache ActiveMQ Deserialization of Untrusted Data VulnerabilityRansomware
13. 6 September 2023CVE-2023-33246RocketMQApache RocketMQ Command Execution Vulnerability
14. 12 May 2023CVE-2016-8735TomcatApache Tomcat Remote Code Execution Vulnerability
15. 1 May 2023CVE-2021-45046Log4j2Apache Log4j2 Deserialization of Untrusted Data VulnerabilityRansomware
16. 7 March 2023CVE-2022-33891SparkApache Spark Command Injection Vulnerability
17. 25 August 2022CVE-2022-24706CouchDBApache CouchDB Insecure Default Initialization of Resource Vulnerability
18. 25 August 2022CVE-2022-24112APISIXApache APISIX Authentication Bypass Vulnerability
19. 25 March 2022CVE-2020-1956KylinApache Kylin OS Command Injection Vulnerability
20. 25 March 2022CVE-2017-12617TomcatApache Tomcat Remote Code Execution Vulnerability
21. 25 March 2022CVE-2017-12615TomcatApache Tomcat on Windows Remote Code Execution VulnerabilityRansomware
22. 25 March 2022CVE-2013-2251StrutsApache Struts Improper Input Validation Vulnerability
23. 3 March 2022CVE-2020-1938TomcatApache Tomcat Improper Privilege Management Vulnerability
24. 10 February 2022CVE-2017-9791Struts 1Apache Struts 1 Improper Input Validation Vulnerability
25. 10 February 2022CVE-2016-3088ActiveMQApache ActiveMQ Improper Input Validation Vulnerability
26. 21 January 2022CVE-2012-0391Struts 2Apache Struts 2 Improper Input Validation Vulnerability
27. 21 January 2022CVE-2006-1547Struts 1Apache Struts 1 ActionForm Denial-of-Service Vulnerability
28. 18 January 2022CVE-2020-13927Airflow's Experimental APIApache Airflow's Experimental API Authentication Bypass
29. 18 January 2022CVE-2020-11978AirflowApache Airflow Command Injection
30. 10 December 2021CVE-2021-44228Log4j2Apache Log4j2 Remote Code Execution VulnerabilityRansomware
31. 10 December 2021CVE-2019-0193SolrApache Solr DataImportHandler Code Injection Vulnerability
32. 1 December 2021CVE-2021-40438ApacheApache HTTP Server-Side Request Forgery (SSRF)Ransomware
33. 3 November 2021CVE-2021-42013HTTP ServerApache HTTP Server Path Traversal VulnerabilityRansomware
34. 3 November 2021CVE-2021-41773HTTP ServerApache HTTP Server Path Traversal VulnerabilityRansomware
35. 3 November 2021CVE-2020-17530StrutsApache Struts Remote Code Execution Vulnerability
36. 3 November 2021CVE-2019-17558SolrApache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
37. 3 November 2021CVE-2019-0211HTTP ServerApache HTTP Server Privilege Escalation Vulnerability
38. 3 November 2021CVE-2018-11776StrutsApache Struts Remote Code Execution Vulnerability
39. 3 November 2021CVE-2017-9805StrutsApache Struts Deserialization of Untrusted Data Vulnerability
40. 3 November 2021CVE-2017-5638StrutsApache Struts Remote Code Execution VulnerabilityRansomware
41. 3 November 2021CVE-2016-4437ShiroApache Shiro Code Execution Vulnerability

Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.