Apache known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 41 Apache vulnerabilities: 3 added in the last 365 days, 25 rated critical (CVSS 9 or higher), and 8 with known ransomware use. The most recent was added Oct 8, 2026.
RSS feed for Apache exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2026-10-08 | CVE-2016-3081 | Apache Struts Command Injection Vulnerability | 8.1 (v3.1) | 96.5% | 2026-10-11 | Unknown |
| 2026-08-04 | CVE-2026-34486 | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | 7.5 (v3.1) | 98.5% | 2026-08-07 | Unknown |
| 2026-04-16 | CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability | 8.8 (v3.1) | 98.3% | 2026-04-30 | Unknown |
| 2025-05-01 | CVE-2024-38475 | Apache HTTP Server Improper Escaping of Output Vulnerability | 9.1 (v3.1) | >99.9% | 2025-05-22 | Unknown |
| 2025-04-01 | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability | 10 (v3.1) | >99.9% | 2025-04-22 | Unknown |
| 2025-02-04 | CVE-2024-45195 | Apache OFBiz Forced Browsing Vulnerability | 9.8 (v3.1) | >99.9% | 2025-02-25 | Unknown |
| 2024-09-18 | CVE-2024-27348 | Apache HugeGraph-Server Improper Access Control Vulnerability | 9.8 (v3.1) | 99.2% | 2024-10-09 | Unknown |
| 2024-08-27 | CVE-2024-38856 | Apache OFBiz Incorrect Authorization Vulnerability | 8.1 (v3.1) | 99.4% | 2024-09-17 | Unknown |
| 2024-08-07 | CVE-2024-32113 | Apache OFBiz Path Traversal Vulnerability | 9.1 (v3.1) | >99.9% | 2024-08-28 | Unknown |
| 2024-05-23 | CVE-2020-17519 | Apache Flink Improper Access Control Vulnerability | 9.1 (v3.1) | 97.8% | 2024-06-13 | Unknown |
| 2024-01-08 | CVE-2023-27524 | Apache Superset Insecure Default Initialization of Resource Vulnerability | 8.9 (v3.1) | 98.1% | 2024-01-29 | Unknown |
| 2023-11-02 | CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | 10 (v3.1) | 99.9% | 2023-11-23 | Known |
| 2023-09-06 | CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability | 9.8 (v3.1) | 96.6% | 2023-09-27 | Unknown |
| 2023-05-12 | CVE-2016-8735 | Apache Tomcat Remote Code Execution Vulnerability | 9.8 (v3.1) | 90.3% | 2023-06-02 | Unknown |
| 2023-05-01 | CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | 9 (v3.1) | >99.9% | 2023-05-22 | Known |
| 2023-03-07 | CVE-2022-33891 | Apache Spark Command Injection Vulnerability | 8.8 (v3.1) | 93.2% | 2023-03-28 | Unknown |
| 2022-08-25 | CVE-2022-24112 | Apache APISIX Authentication Bypass Vulnerability | 9.8 (v3.1) | 96.1% | 2022-09-15 | Unknown |
| 2022-08-25 | CVE-2022-24706 | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | 9.8 (v3.1) | 92.5% | 2022-09-15 | Unknown |
| 2022-03-25 | CVE-2013-2251 | Apache Struts Improper Input Validation Vulnerability | 9.8 (v3.1) | >99.9% | 2022-04-15 | Unknown |
| 2022-03-25 | CVE-2017-12615 | Apache Tomcat on Windows Remote Code Execution Vulnerability | 8.1 (v3.1) | 99.7% | 2022-04-15 | Known |
| 2022-03-25 | CVE-2017-12617 | Apache Tomcat Remote Code Execution Vulnerability | 8.1 (v3.1) | >99.9% | 2022-04-15 | Unknown |
| 2022-03-25 | CVE-2020-1956 | Apache Kylin OS Command Injection Vulnerability | 8.8 (v3.1) | 97.4% | 2022-04-15 | Unknown |
| 2022-03-03 | CVE-2020-1938 | Apache Tomcat Improper Privilege Management Vulnerability | 9.8 (v3.1) | 99.3% | 2022-03-17 | Unknown |
| 2022-02-10 | CVE-2016-3088 | Apache ActiveMQ Improper Input Validation Vulnerability | 9.8 (v3.1) | 98.5% | 2022-08-10 | Unknown |
| 2022-02-10 | CVE-2017-9791 | Apache Struts 1 Improper Input Validation Vulnerability | 9.8 (v3.1) | 98.9% | 2022-08-10 | Unknown |
| 2022-01-21 | CVE-2006-1547 | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | 7.5 (v3.1) | 54.6% | 2022-07-21 | Unknown |
| 2022-01-21 | CVE-2012-0391 | Apache Struts 2 Improper Input Validation Vulnerability | 9.8 (v3.1) | 75.6% | 2022-07-21 | Unknown |
| 2022-01-18 | CVE-2020-11978 | Apache Airflow Command Injection | 8.8 (v3.1) | 99.2% | 2022-07-18 | Unknown |
| 2022-01-18 | CVE-2020-13927 | Apache Airflow's Experimental API Authentication Bypass | 9.8 (v3.1) | 99.8% | 2022-07-18 | Unknown |
| 2021-12-10 | CVE-2019-0193 | Apache Solr DataImportHandler Code Injection Vulnerability | 7.2 (v3.1) | 83.5% | 2022-06-10 | Unknown |
| 2021-12-10 | CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability | 10 (v3.1) | >99.9% | 2021-12-24 | Known |
| 2021-12-01 | CVE-2021-40438 | Apache HTTP Server-Side Request Forgery (SSRF) | 9 (v3.1) | >99.9% | 2021-12-15 | Known |
| 2021-11-03 | CVE-2016-4437 | Apache Shiro Code Execution Vulnerability | 9.8 (v3.1) | 93.0% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2017-5638 | Apache Struts Remote Code Execution Vulnerability | 9.8 (v3.1) | >99.9% | 2022-05-03 | Known |
| 2021-11-03 | CVE-2017-9805 | Apache Struts Deserialization of Untrusted Data Vulnerability | 8.1 (v3.1) | 99.4% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2018-11776 | Apache Struts Remote Code Execution Vulnerability | 8.1 (v3.1) | >99.9% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2019-0211 | Apache HTTP Server Privilege Escalation Vulnerability | 7.8 (v3.1) | 65.0% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2019-17558 | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | 7.5 (v3.1) | 98.6% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2020-17530 | Apache Struts Remote Code Execution Vulnerability | 9.8 (v3.1) | 96.3% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2021-41773 | Apache HTTP Server Path Traversal Vulnerability | 9.8 (v3.1) | >99.9% | 2021-11-17 | Known |
| 2021-11-03 | CVE-2021-42013 | Apache HTTP Server Path Traversal Vulnerability | 9.8 (v3.1) | >99.9% | 2021-11-17 | Known |