Patchfirst
Patchfirst

Vendor

Apache

41 of 232 Apache CVEs in Patchfirst (18%) are in of vulnerabilities exploited in the wild, 8 of them used by ransomware.

CVEs
232
In CISA KEV
4118%
Known ransomware use
8
Median days to KEV
503
from publication
Latest KEV listing
8 Oct 2026
Watch Apache Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Struts In KEV: 6 CVEs: 7
  • Tomcat In KEV: 6 CVEs: 7
  • HTTP Server In KEV: 4 CVEs: 4
  • ActiveMQ In KEV: 3 CVEs: 3
  • OFBiz In KEV: 3 CVEs: 3
  • Log4j2 In KEV: 2 CVEs: 2
  • Solr In KEV: 2 CVEs: 2
  • Struts 1 In KEV: 2 CVEs: 2
  • Airflow In KEV: 1 CVEs: 1
  • Airflow's Experimental API In KEV: 1 CVEs: 1

Top ATT&CK techniques

What attackers do with Apache CVEs
Open in ATT&CK Navigator

Counts are Apache CVEs linked to the technique. Each link’s provenance is on the CVE page.

Apache CVEs

Top 100 of 232 by priority
  1. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2016-3088Apache ActiveMQ Improper Input Validation Vulnerability
    Apache · ActiveMQKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports
    98.5%Top 0.08%
    86.0priority
  3. CVE-2021-45046Apache Log4j2 Deserialization of Untrusted Data Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 9.0T1059Command and Scripting InterpreterT1486Data Encrypted for Impact2 reports
    >99.9%Top 0.02%
    85.4priority
  4. CVE-2021-42013Apache HTTP Server Path Traversal Vulnerability
    Apache · HTTP ServerKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services1 report
    >99.9%Top 0.02%
    83.7priority
  5. CVE-2018-11776Apache Struts Remote Code Execution Vulnerability
    Apache · StrutsKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    >99.9%Top 0.01%
    82.5priority
  6. CVE-2025-60021Apache bRPC: Remote command injection vulnerability in heap builtin service
    Apache Software Foundation · Apache bRPCPublic exploitCritical · 9.8
    25.5%Top 2%
    81.5priority
  7. CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
    Apache Software Foundation · Apache Log4j2Public exploitMedium · 6.6T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    97.9%Top 0.09%
    81.5priority
  8. CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
    Apache Software Foundation · Apache Log4j2Public exploitMedium · 5.9T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation1 report
    >99.9%Top 0.01%
    81.0priority
  9. CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
    Apache · ActiveMQKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+1 more
    >99.9%Top 0.01%
    79.9priority
  10. CVE-2021-41773Apache HTTP Server Path Traversal Vulnerability
    Apache · HTTP ServerKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1210Exploitation of Remote Services
    >99.9%Top 0.01%
    79.9priority
  11. CVE-2017-5638Apache Struts Remote Code Execution Vulnerability
    Apache · StrutsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    >99.9%Top 0.01%
    79.9priority
  12. CVE-2021-40438Apache HTTP Server-Side Request Forgery (SSRF)
    Apache · ApacheKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing ApplicationT1090Proxy
    >99.9%Top 0.01%
    79.3priority
  13. CVE-2017-12615Apache Tomcat on Windows Remote Code Execution Vulnerability
    Apache · TomcatKEVRansomwarePublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1505.003Web Shell
    99.7%Top 0.05%
    78.7priority
  14. CVE-2017-9805Apache Struts Deserialization of Untrusted Data Vulnerability
    Apache · StrutsKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.4%Top 0.06%
    78.7priority
  15. CVE-2026-33453Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote…
    Apache Software Foundation · Apache CamelPublic exploitCritical · 10.0
    9.2%Top 4.7%
    78.3priority
  16. CVE-2019-0211Apache HTTP Server Privilege Escalation Vulnerability
    Apache · HTTP ServerKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation
    65.0%Top 0.75%
    78.3priority
  17. CVE-2025-54988Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA
    Apache Software Foundation · Apache Tika PDF parser modulePublic exploitHigh · 8.4
    47.9%Top 1.1%
    76.3priority
  18. CVE-2026-34197Apache ActiveMQ Improper Input Validation Vulnerability
    Apache · ActiveMQKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    98.3%Top 0.08%
    74.1priority
  19. CVE-2024-27348Apache HugeGraph-Server Improper Access Control Vulnerability
    Apache · HugeGraph-ServerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report
    99.2%Top 0.07%
    73.7priority
  20. CVE-2016-3081Apache Struts Command Injection Vulnerability
    Apache · StrutsKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    96.5%Top 0.12%
    73.6priority
  21. CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
    Apache Software Foundation · Apache StrutsPublic exploitHigh · 8.1
    50.4%Top 1.1%
    73.5priority
  22. CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
    Apache · TomcatKEVPublic exploitHigh · 7.5T1040Network SniffingT1557Adversary-in-the-Middle
    98.5%Top 0.08%
    73.2priority
  23. CVE-2016-15057Apache Continuum: Command injection leading to RCE
    Apache Software Foundation · Apache ContinuumPublic exploitCritical · 9.9
    3.9%Top 9.8%
    73.0priority
  24. CVE-2022-33891Apache Spark Command Injection Vulnerability
    Apache · SparkKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell1 report
    93.2%Top 0.17%
    73.0priority
  25. CVE-2024-45216Apache Solr: Authentication bypass possible using a fake URL Path ending
    Apache Software Foundation · Apache SolrPublic exploitCritical · 9.8
    92.7%Top 0.17%
    72.5priority
  26. CVE-2017-12617Apache Tomcat Remote Code Execution Vulnerability
    Apache · TomcatKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    >99.9%Top 0.02%
    72.5priority
  27. CVE-2024-56337Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
    Apache Software Foundation · Apache TomcatCritical · 9.8
    9.0%Top 4.7%
    72.3priority
  28. CVE-2026-40466Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery…
    Apache Software Foundation · Apache ActiveMQ BrokerPublic exploitHigh · 8.8
    4.8%Top 8.1%
    71.8priority
  29. CVE-2017-9798Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a…
    Apache Software Foundation · Apache HTTP ServerPublic exploit
    95.0%Top 0.14%
    71.7priority
  30. CVE-2025-27817Apache Kafka Client: Arbitrary file read and SSRF vulnerability
    Apache Software Foundation · Apache Kafka ClientPublic exploitHigh · 7.5
    68.8%Top 0.66%
    71.2priority
  31. CVE-2026-44825Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users
    Apache Software Foundation · Apache SolrPublic exploitHigh · 8.1
    3.9%Top 9.7%
    71.1priority
  32. CVE-2016-0736In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured…
    Apache Software Foundation · Apache HTTP ServerPublic exploit
    49.0%Top 1.1%
    71.1priority
  33. CVE-2024-32114Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
    Apache Software Foundation · Apache ActiveMQPublic exploitHigh · 8.5
    7.1%Top 5.7%
    70.5priority
  34. CVE-2025-24813Apache Tomcat Path Equivalence Vulnerability
    Apache · TomcatKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    99.9%Top 0.03%
    69.9priority
  35. CVE-2024-32113Apache OFBiz Path Traversal Vulnerability
    Apache · OFBizKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System
    99.9%Top 0.03%
    69.9priority
  36. CVE-2020-13945In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
    Apache Software Foundation · Apache APISIXPublic exploit
    73.0%Top 0.55%
    69.9priority
  37. CVE-2020-13927Apache Airflow's Experimental API Authentication Bypass
    Apache · Airflow's Experimental APIKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.8%Top 0.04%
    69.9priority
  38. CVE-2013-2251Apache Struts Improper Input Validation Vulnerability
    Apache · StrutsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    >99.9%Top 0.01%
    69.9priority
  39. CVE-2024-38856Apache OFBiz Incorrect Authorization Vulnerability
    Apache · OFBizKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.4%Top 0.06%
    69.8priority
  40. CVE-2023-33246Apache RocketMQ Command Execution Vulnerability
    Apache · RocketMQKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+1 more
    96.6%Top 0.12%
    69.8priority
  41. CVE-2023-27524Apache Superset Insecure Default Initialization of Resource Vulnerability
    Apache · SupersetKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts
    98.1%Top 0.09%
    69.8priority
  42. CVE-2022-24706Apache CouchDB Insecure Default Initialization of Resource Vulnerability
    Apache · CouchDBKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts
    92.5%Top 0.17%
    69.8priority
  43. CVE-2022-24112Apache APISIX Authentication Bypass Vulnerability
    Apache · APISIXKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    96.1%Top 0.12%
    69.8priority
  44. CVE-2020-17530Apache Struts Remote Code Execution Vulnerability
    Apache · StrutsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    96.3%Top 0.12%
    69.8priority
  45. CVE-2020-1938Apache Tomcat Improper Privilege Management Vulnerability
    Apache · TomcatKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    99.3%Top 0.06%
    69.8priority
  46. CVE-2017-9791Apache Struts 1 Improper Input Validation Vulnerability
    Apache · Struts 1KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    98.9%Top 0.07%
    69.8priority
  47. CVE-2016-4437Apache Shiro Code Execution Vulnerability
    Apache · ShiroKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    93.0%Top 0.17%
    69.8priority
  48. CVE-2012-0391Apache Struts 2 Improper Input Validation Vulnerability
    Apache · Struts 2KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    75.6%Top 0.48%
    69.8priority
  49. CVE-2023-25690Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
    Apache Software Foundation · Apache HTTP ServerPublic exploitCritical · 9.8
    84.5%Top 0.3%
    69.6priority
  50. CVE-2018-8033In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles…
    Apache Software Foundation · Apache OFBizPublic exploit
    25.7%Top 2%
    69.6priority
  51. CVE-2024-38475Apache HTTP Server Improper Escaping of Output Vulnerability
    Apache · HTTP ServerKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more
    >99.9%Top 0.02%
    69.4priority
  52. CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
    Apache Software Foundation · Apache StrutsPublic exploitCritical · 9.5
    72.4%Top 0.56%
    69.2priority
  53. CVE-2020-11978Apache Airflow Command Injection
    Apache · AirflowKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    99.2%Top 0.07%
    69.1priority
  54. CVE-2020-1956Apache Kylin OS Command Injection Vulnerability
    Apache · KylinKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    97.4%Top 0.1%
    69.1priority
  55. CVE-2023-37582Apache RocketMQ: Possible remote code execution when using the update configuration function
    Apache Software Foundation · Apache RocketMQPublic exploitCritical · 9.8
    90.4%Top 0.2%
    68.7priority
  56. CVE-2024-45195Apache OFBiz Forced Browsing Vulnerability
    Apache · OFBizKEVPublic exploitHigh · 7.5T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    >99.9%Top 0.02%
    68.2priority
  57. CVE-2020-17519Apache Flink Improper Access Control Vulnerability
    Apache · FlinkKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1005Data from Local System
    98.0%Top 0.09%
    68.2priority
  58. CVE-2019-17558Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability
    Apache · SolrKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    98.6%Top 0.08%
    68.2priority
  59. CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
    Apache Software Foundation · Apache Log4j 1.xPublic exploitHigh · 7.5
    80.6%Top 0.38%
    68.1priority
  60. CVE-2006-1547Apache Struts 1 ActionForm Denial-of-Service Vulnerability
    Apache · Struts 1KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation
    54.6%Top 0.98%
    68.1priority
  61. CVE-2023-50386Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
    Apache Software Foundation · Apache SolrPublic exploitHigh · 8.8
    83.7%Top 0.31%
    68.0priority
  62. CVE-2019-0193Apache Solr DataImportHandler Code Injection Vulnerability
    Apache · SolrKEVPublic exploitHigh · 7.2T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    83.5%Top 0.31%
    68.0priority
  63. CVE-2023-25194Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using…
    Apache Software Foundation · Apache Kafka Connect APIPublic exploitHigh · 8.8
    95.8%Top 0.13%
    67.7priority
  64. CVE-2024-36104Apache OFBiz: Path traversal leading to a RCE
    Apache Software Foundation · Apache OFBizPublic exploitCritical · 9.1
    87.9%Top 0.24%
    66.3priority
  65. CVE-2024-45507Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE
    Apache Software Foundation · Apache OFBizPublic exploitHigh · 8.8
    96.4%Top 0.12%
    66.1priority
  66. CVE-2025-27636Apache Camel: Camel Message Header Injection via Improper Filtering
    Apache Software Foundation · Apache CamelPublic exploitMedium · 5.6
    97.1%Top 0.11%
    65.8priority
  67. CVE-2025-29891Apache Camel: Camel Message Header Injection through request parameters
    Apache Software Foundation · Apache CamelPublic exploitMedium · 4.8
    76.1%Top 0.47%
    65.0priority
  68. CVE-2021-30128Unsafe deserialization in Apache OFBiz
    Apache Software Foundation · Apache OFBizPublic exploit
    81.2%Top 0.37%
    64.9priority
  69. CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the…
    Apache Software Foundation · Apache SparkPublic exploit
    65.8%Top 0.73%
    64.9priority
  70. CVE-2016-8735Apache Tomcat Remote Code Execution Vulnerability
    Apache · TomcatKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    90.3%Top 0.2%
    64.8priority
  71. CVE-2022-47501Apache OFBiz: Arbitrary file reading vulnerability
    Apache Software Foundation · Apache OFBizPublic exploitHigh · 7.5
    10.2%Top 4.3%
    64.4priority
  72. CVE-2023-37941Apache Superset: Metadata db write access can lead to remote code execution
    Apache Software Foundation · Apache SupersetPublic exploitMedium · 6.6
    35.5%Top 1.6%
    64.3priority
  73. CVE-2022-42889Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
    Apache Software Foundation · Apache Commons TextPublic exploit
    99.9%Top 0.03%
    63.0priority
  74. CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability
    Apache Software Foundation · Apache StrutsPublic exploit
    80.8%Top 0.37%
    62.9priority
  75. CVE-2023-39265Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
    Apache Software Foundation · Apache SupersetPublic exploitLow · 3.8
    86.0%Top 0.27%
    62.6priority
  76. CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
    Apache Software Foundation · Apache Log4jHigh · 7.5
    1.9%Top 20%
    62.3priority
  77. CVE-2017-12635Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB…
    Apache Software Foundation · Apache CouchDBPublic exploit
    99.8%Top 0.04%
    62.3priority
  78. CVE-2023-51467Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
    Apache Software Foundation · Apache OFBizPublic exploit
    96.0%Top 0.12%
    62.2priority
  79. CVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.
    Apache Software Foundation · Apache StrutsPublic exploit
    85.4%Top 0.28%
    62.0priority
  80. CVE-2017-12611In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag…
    Apache Software Foundation · Apache StrutsPublic exploit
    87.1%Top 0.25%
    61.9priority
  81. CVE-2021-25646Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
    Apache Software Foundation · Apache DruidPublic exploit
    99.1%Top 0.07%
    61.8priority
  82. CVE-2017-15715In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a…
    Apache Software Foundation · Apache HTTP ServerPublic exploit
    85.5%Top 0.28%
    61.5priority
  83. CVE-2018-1335From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used…
    Apache Software Foundation · Apache TikaPublic exploit
    93.6%Top 0.16%
    61.1priority
  84. CVE-2018-8007Apache CouchDB administrative users can configure the database server via HTTP(S)
    Apache Software Foundation · Apache CouchDB
    12.2%Top 3.8%
    61.0priority
  85. CVE-2021-26295RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
    Apache Software Foundation · Apache OFBizPublic exploit
    97.8%Top 0.09%
    60.7priority
  86. CVE-2020-9480In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication…
    Apache Software Foundation · Apache SparkPublic exploit
    29.4%Top 1.8%
    60.7priority
  87. CVE-2022-24288Apache Airflow: RCE in example DAGs
    Apache Software Foundation · Apache AirflowPublic exploit
    77.9%Top 0.43%
    60.6priority
  88. CVE-2020-13942Remote Code Execution in Apache Unomi
    Apache Software Foundation · Apache UnomiPublic exploit
    68.3%Top 0.67%
    60.5priority
  89. CVE-2023-47248PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
    Apache Software Foundation · PyArrowPublic exploit
    14.5%Top 3.4%
    60.4priority
  90. CVE-2021-37580Apache ShenYu Admin bypass JWT authentication
    Apache Software Foundation · Apache ShenYu AdminPublic exploit
    42.1%Top 1.3%
    60.4priority
  91. CVE-2019-17564Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled
    Apache · Apache DubboPublic exploit
    36.5%Top 1.5%
    60.4priority
  92. CVE-2023-49070Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
    Apache Software Foundation · Apache OFBizPublic exploit
    95.4%Top 0.13%
    60.0priority
  93. CVE-2021-27850Bypass of the fix for CVE-2019-0195
    Apache Software Foundation · Apache TapestryPublic exploit
    93.6%Top 0.16%
    60.0priority
  94. CVE-2020-1943Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07
    Apache · Apache OFBizPublic exploit
    97.3%Top 0.1%
    60.0priority
  95. CVE-2019-0232When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17…
    Apache · TomcatPublic exploit
    99.9%Top 0.03%
    60.0priority
  96. CVE-2018-11759The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker…
    Apache Software Foundation · Apache Tomcat ConnectorsPublic exploit
    90.6%Top 0.2%
    60.0priority
  97. CVE-2022-34305XSS in examples web application
    Apache Software Foundation · Apache TomcatPublic exploit
    6.7%Top 6.1%
    59.9priority
  98. CVE-2021-36749Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended…
    Apache Software Foundation · Apache DruidPublic exploit
    80.9%Top 0.37%
    59.9priority
  99. CVE-2019-0192In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an…
    Apache Software Foundation · Apache SolrPublic exploit
    78.2%Top 0.42%
    59.9priority
  100. CVE-2023-50968Apache OFBiz: Arbitrary file properties reading and SSRF attack
    Apache Software Foundation · Apache OFBizPublic exploit
    63.4%Top 0.79%
    59.8priority
↑ ↓ chooseEnter openEsc close