Apache known exploited vulnerabilities
The Beam CVE database tracks 41 known exploited vulnerabilities for Apache: 25 critical and 16 high severity. The newest is CVE-2026-34486, published Apr 9, 2026.
These are the Apache vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 41
- Critical
- 25
- Known exploited (CISA KEV)
- 41
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
high7.5ExploitedApr 9, 2026CVE-2026-34197
Apache ActiveMQ Improper Input Validation Vulnerability
high8.8ExploitedApr 7, 2026CVE-2025-24813
Apache Tomcat Path Equivalence Vulnerability
critical9.8ExploitedMar 10, 2025CVE-2024-45195
Apache OFBiz Forced Browsing Vulnerability
high7.5ExploitedSep 4, 2024CVE-2024-38856
Apache OFBiz Incorrect Authorization Vulnerability
critical9.8ExploitedAug 5, 2024CVE-2024-38475
Apache HTTP Server Improper Escaping of Output Vulnerability
critical9.1ExploitedJul 1, 2024CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability
critical9.8ExploitedMay 8, 2024CVE-2024-27348
Apache HugeGraph-Server Improper Access Control Vulnerability
critical9.8ExploitedApr 22, 2024CVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
critical9.8ExploitedOct 27, 2023CVE-2023-33246
Apache RocketMQ Command Execution Vulnerability
critical9.8ExploitedMay 24, 2023CVE-2023-27524
Apache Superset Insecure Default Initialization of Resource Vulnerability
critical9.8ExploitedApr 24, 2023CVE-2022-33891
Apache Spark Command Injection Vulnerability
high8.8ExploitedJul 18, 2022CVE-2022-24706
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
critical9.8ExploitedApr 26, 2022CVE-2022-24112
Apache APISIX Authentication Bypass Vulnerability
critical9.8ExploitedFeb 11, 2022CVE-2021-45046
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
critical9.0ExploitedDec 14, 2021CVE-2021-44228
Apache Log4j2 Remote Code Execution Vulnerability
critical10.0ExploitedDec 10, 2021CVE-2021-42013
Apache HTTP Server Path Traversal Vulnerability
critical9.8ExploitedOct 7, 2021CVE-2021-41773
Apache HTTP Server Path Traversal Vulnerability
critical9.8ExploitedOct 5, 2021CVE-2021-40438
Apache HTTP Server-Side Request Forgery (SSRF)
critical9.0ExploitedSep 16, 2021CVE-2020-17519
Apache Flink Improper Access Control Vulnerability
high7.5ExploitedJan 5, 2021CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
critical9.8ExploitedDec 11, 2020CVE-2020-13927
Apache Airflow's Experimental API Authentication Bypass
critical9.8ExploitedNov 10, 2020CVE-2020-11978
Apache Airflow Command Injection
high8.8ExploitedJul 17, 2020CVE-2020-1956
Apache Kylin OS Command Injection Vulnerability
high8.8ExploitedMay 22, 2020CVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
critical9.8ExploitedFeb 24, 2020CVE-2019-17558
Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
high7.5ExploitedDec 30, 2019CVE-2019-0193
Apache Solr DataImportHandler Code Injection Vulnerability
high7.2ExploitedAug 1, 2019CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability
high7.8ExploitedApr 8, 2019CVE-2018-11776
Apache Struts Remote Code Execution Vulnerability
high8.1ExploitedAug 22, 2018CVE-2017-12617
Apache Tomcat Remote Code Execution Vulnerability
high8.1ExploitedOct 4, 2017CVE-2017-12615
Apache Tomcat on Windows Remote Code Execution Vulnerability
high8.1ExploitedSep 19, 2017CVE-2017-9805
Apache Struts Deserialization of Untrusted Data Vulnerability
high8.1ExploitedSep 15, 2017CVE-2017-9791
Apache Struts 1 Improper Input Validation Vulnerability
critical9.8ExploitedJul 10, 2017CVE-2016-8735
Apache Tomcat Remote Code Execution Vulnerability
critical9.8ExploitedApr 6, 2017CVE-2017-5638
Apache Struts Remote Code Execution Vulnerability
critical9.8ExploitedMar 11, 2017CVE-2016-4437
Apache Shiro Code Execution Vulnerability
critical9.8ExploitedJun 7, 2016CVE-2016-3088
Apache ActiveMQ Improper Input Validation Vulnerability
critical9.8ExploitedJun 1, 2016CVE-2016-3081
Apache Struts Command Injection Vulnerability
high8.1ExploitedApr 26, 2016CVE-2013-2251
Apache Struts Improper Input Validation Vulnerability
critical9.8ExploitedJul 20, 2013CVE-2012-0391
Apache Struts 2 Improper Input Validation Vulnerability
critical9.8ExploitedJan 8, 2012CVE-2006-1547
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
high7.5ExploitedMar 30, 2006