Cyberfeed6 › Vendors › Apache
CISA lists 41 Apache vulnerabilities as exploited in real attacks, and 8 of them are known to be used in ransomware campaigns. Most entries concern Struts, Tomcat, HTTP Server, ActiveMQ.
Showing the 40 most recently added of 41. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2016-3081Apache Struts Command Injection Vulnerability | Struts | 2026-10-08 | High (8.1) | No | Vendor notice |
| CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | Tomcat | 2026-08-04 | High (7.5) | No | Vendor notice |
| CVE-2026-34197Apache ActiveMQ Improper Input Validation Vulnerability | ActiveMQ | 2026-04-16 | High (8.8) | No | Vendor notice |
| CVE-2024-38475Apache HTTP Server Improper Escaping of Output Vulnerability | HTTP Server | 2025-05-01 | Critical (9.1) | No | Vendor notice |
| CVE-2025-24813Apache Tomcat Path Equivalence Vulnerability | Tomcat | 2025-04-01 | Critical (10.0) | No | Vendor notice |
| CVE-2024-45195Apache OFBiz Forced Browsing Vulnerability | OFBiz | 2025-02-04 | Critical (9.8) | No | Vendor notice |
| CVE-2024-27348Apache HugeGraph-Server Improper Access Control Vulnerability | HugeGraph-Server | 2024-09-18 | Critical (9.8) | No | Vendor notice |
| CVE-2024-38856Apache OFBiz Incorrect Authorization Vulnerability | OFBiz | 2024-08-27 | High (8.1) | No | Vendor notice |
| CVE-2024-32113Apache OFBiz Path Traversal Vulnerability | OFBiz | 2024-08-07 | Critical (9.1) | No | Vendor notice |
| CVE-2020-17519Apache Flink Improper Access Control Vulnerability | Flink | 2024-05-23 | Critical (9.1) | No | Vendor notice |
| CVE-2023-27524Apache Superset Insecure Default Initialization of Resource Vulnerability | Superset | 2024-01-08 | High (8.9) | No | Vendor notice |
| CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | ActiveMQ | 2023-11-02 | Critical (10.0) | Yes | Vendor notice |
| CVE-2023-33246Apache RocketMQ Command Execution Vulnerability | RocketMQ | 2023-09-06 | Critical (9.8) | No | Vendor notice |
| CVE-2016-8735Apache Tomcat Remote Code Execution Vulnerability | Tomcat | 2023-05-12 | Critical (9.8) | No | Vendor notice |
| CVE-2021-45046Apache Log4j2 Deserialization of Untrusted Data Vulnerability | Log4j2 | 2023-05-01 | Critical (9.0) | Yes | Vendor notice |
| CVE-2022-33891Apache Spark Command Injection Vulnerability | Spark | 2023-03-07 | High (8.8) | No | Vendor notice |
| CVE-2022-24706Apache CouchDB Insecure Default Initialization of Resource Vulnerability | CouchDB | 2022-08-25 | Critical (9.8) | No | Vendor notice |
| CVE-2022-24112Apache APISIX Authentication Bypass Vulnerability | APISIX | 2022-08-25 | Critical (9.8) | No | Vendor notice |
| CVE-2020-1956Apache Kylin OS Command Injection Vulnerability | Kylin | 2022-03-25 | High (8.8) | No | |
| CVE-2017-12617Apache Tomcat Remote Code Execution Vulnerability | Tomcat | 2022-03-25 | High (8.1) | No | |
| CVE-2017-12615Apache Tomcat on Windows Remote Code Execution Vulnerability | Tomcat | 2022-03-25 | High (8.1) | Yes | |
| CVE-2013-2251Apache Struts Improper Input Validation Vulnerability | Struts | 2022-03-25 | Critical (9.8) | No | |
| CVE-2020-1938Apache Tomcat Improper Privilege Management Vulnerability | Tomcat | 2022-03-03 | Critical (9.8) | No | |
| CVE-2017-9791Apache Struts 1 Improper Input Validation Vulnerability | Struts 1 | 2022-02-10 | Critical (9.8) | No | |
| CVE-2016-3088Apache ActiveMQ Improper Input Validation Vulnerability | ActiveMQ | 2022-02-10 | Critical (9.8) | No | |
| CVE-2012-0391Apache Struts 2 Improper Input Validation Vulnerability | Struts 2 | 2022-01-21 | Critical (9.8) | No | |
| CVE-2006-1547Apache Struts 1 ActionForm Denial-of-Service Vulnerability | Struts 1 | 2022-01-21 | High (7.5) | No | |
| CVE-2020-13927Apache Airflow's Experimental API Authentication Bypass | Airflow's Experimental API | 2022-01-18 | Critical (9.8) | No | |
| CVE-2020-11978Apache Airflow Command Injection | Airflow | 2022-01-18 | High (8.8) | No | |
| CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability | Log4j2 | 2021-12-10 | Critical (10.0) | Yes | |
| CVE-2019-0193Apache Solr DataImportHandler Code Injection Vulnerability | Solr | 2021-12-10 | High (7.2) | No | |
| CVE-2021-40438Apache HTTP Server-Side Request Forgery (SSRF) | Apache | 2021-12-01 | Critical (9.0) | Yes | |
| CVE-2021-42013Apache HTTP Server Path Traversal Vulnerability | HTTP Server | 2021-11-03 | Critical (9.8) | Yes | |
| CVE-2021-41773Apache HTTP Server Path Traversal Vulnerability | HTTP Server | 2021-11-03 | High (7.5) | Yes | |
| CVE-2020-17530Apache Struts Remote Code Execution Vulnerability | Struts | 2021-11-03 | Critical (9.8) | No | |
| CVE-2019-17558Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | Solr | 2021-11-03 | High (7.5) | No | |
| CVE-2019-0211Apache HTTP Server Privilege Escalation Vulnerability | HTTP Server | 2021-11-03 | High (7.8) | No | |
| CVE-2018-11776Apache Struts Remote Code Execution Vulnerability | Struts | 2021-11-03 | High (8.1) | No | |
| CVE-2017-9805Apache Struts Deserialization of Untrusted Data Vulnerability | Struts | 2021-11-03 | High (8.1) | No | |
| CVE-2017-5638Apache Struts Remote Code Execution Vulnerability | Struts | 2021-11-03 | Critical (9.8) | Yes |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.