---
title: "Apache: known exploited vulnerabilities"
url: https://erroneo.us/security/vendor/apache/
description: "Every Apache vulnerability in CISA's Known Exploited Vulnerabilities catalog since October 2023 (12), newest first, with due dates and fixes."
type: vendor
section: "Security Digest"
date_modified: 2026-10-08
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Apache: known exploited vulnerabilities

- 2026-10-08 [CVE-2016-3081](https://erroneo.us/security/cve/CVE-2016-3081/index.md) Apache Struts: Apache Struts Command Injection Vulnerability (due 2026-10-11; ransomware: Unknown)
- 2026-08-04 [CVE-2026-34486](https://erroneo.us/security/cve/CVE-2026-34486/index.md) Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (due 2026-08-07; ransomware: Unknown)
- 2026-04-16 [CVE-2026-34197](https://erroneo.us/security/cve/CVE-2026-34197/index.md) Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability (due 2026-04-30; ransomware: Unknown)
- 2025-05-01 [CVE-2024-38475](https://erroneo.us/security/cve/CVE-2024-38475/index.md) Apache HTTP Server: Apache HTTP Server Improper Escaping of Output Vulnerability (due 2025-05-22; ransomware: Unknown)
- 2025-04-01 [CVE-2025-24813](https://erroneo.us/security/cve/CVE-2025-24813/index.md) Apache Tomcat: Apache Tomcat Path Equivalence Vulnerability (due 2025-04-22; ransomware: Unknown)
- 2025-02-04 [CVE-2024-45195](https://erroneo.us/security/cve/CVE-2024-45195/index.md) Apache OFBiz: Apache OFBiz Forced Browsing Vulnerability (due 2025-02-25; ransomware: Unknown)
- 2024-09-18 [CVE-2024-27348](https://erroneo.us/security/cve/CVE-2024-27348/index.md) Apache HugeGraph-Server: Apache HugeGraph-Server Improper Access Control Vulnerability (due 2024-10-09; ransomware: Unknown)
- 2024-08-27 [CVE-2024-38856](https://erroneo.us/security/cve/CVE-2024-38856/index.md) Apache OFBiz: Apache OFBiz Incorrect Authorization Vulnerability (due 2024-09-17; ransomware: Unknown)
- 2024-08-07 [CVE-2024-32113](https://erroneo.us/security/cve/CVE-2024-32113/index.md) Apache OFBiz: Apache OFBiz Path Traversal Vulnerability (due 2024-08-28; ransomware: Unknown)
- 2024-05-23 [CVE-2020-17519](https://erroneo.us/security/cve/CVE-2020-17519/index.md) Apache Flink: Apache Flink Improper Access Control Vulnerability (due 2024-06-13; ransomware: Unknown)
- 2024-01-08 [CVE-2023-27524](https://erroneo.us/security/cve/CVE-2023-27524/index.md) Apache Superset: Apache Superset Insecure Default Initialization of Resource Vulnerability (due 2024-01-29; ransomware: Unknown)
- 2023-11-02 [CVE-2023-46604](https://erroneo.us/security/cve/CVE-2023-46604/index.md) Apache ActiveMQ: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability (due 2023-11-23; ransomware: Known)

---
Source page: https://erroneo.us/security/vendor/apache/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt