Security Digest
Apache: known exploited vulnerabilities
12 Apache CVEs CISA has confirmed as exploited in the wild since October 2023. If you run these products, check each one.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2026-10-08 | CVE-2016-3081 | Apache Struts Apache Struts Command Injection Vulnerability | 2026-10-11 |
| 2026-08-04 | CVE-2026-34486 | Apache Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | 2026-08-07 |
| 2026-04-16 | CVE-2026-34197 | Apache ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability | 2026-04-30 |
| 2025-05-01 | CVE-2024-38475 | Apache HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability | 2025-05-22 |
| 2025-04-01 | CVE-2025-24813 | Apache Tomcat Apache Tomcat Path Equivalence Vulnerability | 2025-04-22 |
| 2025-02-04 | CVE-2024-45195 | Apache OFBiz Apache OFBiz Forced Browsing Vulnerability | 2025-02-25 |
| 2024-09-18 | CVE-2024-27348 | Apache HugeGraph-Server Apache HugeGraph-Server Improper Access Control Vulnerability | 2024-10-09 |
| 2024-08-27 | CVE-2024-38856 | Apache OFBiz Apache OFBiz Incorrect Authorization Vulnerability | 2024-09-17 |
| 2024-08-07 | CVE-2024-32113 | Apache OFBiz Apache OFBiz Path Traversal Vulnerability | 2024-08-28 |
| 2024-05-23 | CVE-2020-17519 | Apache Flink Apache Flink Improper Access Control Vulnerability | 2024-06-13 |
| 2024-01-08 | CVE-2023-27524 | Apache Superset Apache Superset Insecure Default Initialization of Resource Vulnerability | 2024-01-29 |
| 2023-11-02 | CVE-2023-46604 | Apache ActiveMQ Apache ActiveMQ Deserialization of Untrusted Data Vulnerability Ransomware | 2023-11-23 |