Apache Software Foundation

11 results · Clear filters · Feed

• High 7.5
  CVE-2026-34486 Exploited Public exploit EPSS 99%

  Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat org.apache.tomcat:tomcat-tribes Maven
  Apr 9, 2026

  KEV Aug 4, 2026
• High 8.8
  CVE-2026-34197 Exploited Public exploit EPSS 98%

  Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

  Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia…

  Apache Software Foundation Apache ActiveMQ Apache ActiveMQ All Apache ActiveMQ Broker Debian Ubuntu Maven
  Apr 7, 2026

  KEV Apr 16, 2026
• High 8.1
  CVE-2024-38856 Exploited Public exploit EPSS 99%

  Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

  Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of …

  Apache Software Foundation Apache OFBiz
  Aug 5, 2024

  KEV Aug 27, 2024
• High 8.9
  CVE-2023-27524 Exploited Public exploit EPSS 98%

  Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

  Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resour…

  Apache Software Foundation Apache Superset apache-superset PyPI
  Apr 24, 2023

  KEV Jan 8, 2024
• High 8.8
  CVE-2022-33891 Exploited Public exploit EPSS 93%

  Apache Spark shell command injection vulnerability via Spark UI

  The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…

  Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.12 Maven PyPI
  Jul 18, 2022

  KEV Mar 7, 2023
• High 7.5
  CVE-2021-41773 Exploited · Ransomware Public exploit EPSS 100%

  Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

  A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
  Oct 5, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2020-11978 Exploited Public exploit EPSS 99%

  Remote code execution (RCE) in Apache Airflow

  An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user runnin…

  Apache Software Foundation Apache Airflow apache-airflow PyPI
  Jul 16, 2020

  KEV Jan 18, 2022
• High 8.1
  CVE-2018-11776 Exploited Public exploit EPSS 100%

  Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

  Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  Aug 22, 2018

  KEV Nov 3, 2021
• High 8.1
  CVE-2017-12617 Exploited Public exploit EPSS 100%

  Unrestricted Upload of File with Dangerous Type Apache Tomcat

  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  Oct 3, 2017

  KEV Mar 25, 2022
• High 8.1
  CVE-2017-12615 Exploited · Ransomware Public exploit EPSS 100%

  When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

  When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

  Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
  Sep 19, 2017

  KEV Mar 25, 2022
• High 8.1
  CVE-2017-9805 Exploited Public exploit EPSS 99%

  REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

  The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
  Sep 15, 2017

  KEV Nov 3, 2021