Apache Software Foundation vulnerabilities
2,973 published CVEs name Apache Software Foundation among the affected products; CISA lists 29 of them as exploited in the wild.
- 2,973Published CVEs2,901 of them scored
- 1,478Last 12 monthspublished in the last year
- 587Critical1,254 more rated high
- 29Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Apache Software Foundation · Apache Tomcat
ExploitedHigh7.5 - CVE-2026-34197
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Apache Software Foundation · Apache ActiveMQ Broker
ExploitedHigh8.8 - CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Apache Software Foundation · Apache HTTP Server
ExploitedCritical9.1 - CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Software Foundation · Apache Tomcat
ExploitedCritical10.0 - CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Apache Software Foundation · Apache OFBiz
ExploitedCritical9.8 - CVE-2024-27348
Apache HugeGraph-Server: Command execution in gremlin
Apache Software Foundation · Apache HugeGraph-Server
ExploitedCritical9.8 - CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Apache Software Foundation · Apache OFBiz
ExploitedHigh8.1 - CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
Apache Software Foundation · Apache OFBiz
ExploitedCritical9.1 - CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
Apache Software Foundation · Apache Flink
ExploitedCritical9.1 - CVE-2023-27524
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Apache Software Foundation · Apache Superset
ExploitedHigh8.9