Apache vulnerabilities

CVEs per yearBy the year they were published

1. 201911
2. 20191
3. 20192
4. 202017
5. 202054
6. 20201
7. 20232
8. 20242
9. 20251

Known exploitedNewest addition to KEV first

• CVE-2020-1956

  Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…

  Apache · Kylin

  ExploitedHigh8.8
• CVE-2020-1938

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…

  Apache · Apache Tomcat

  ExploitedCritical9.8
• CVE-2019-0193

  In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH…

  Apache · Apache Solr

  ExploitedHigh7.2
• CVE-2019-0211

  In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including…

  Apache · Apache HTTP Server

  ExploitedHigh7.8

Newest CVEs

• CVE-2025-58712

  Amq: privilege escalation via excessive /etc/passwd permissions

  apache · activemq-artemis

  Medium6.4
• CVE-2024-42362

  GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

  Apache · HertzBeat

  High8.8
• CVE-2024-42361

  GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}

  Apache · HertzBeat

  High7.5
• CVE-2021-32824

  Regular expression Denial of Service in MooTools

  Apache · Dubbo

  Critical9.8
• CVE-2021-25958

  Generation of Error Message Containing Sensitive Information in Apache OFBiz

  apache · ofbiz-framework

  Medium6.5
• CVE-2020-11996

  A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…

  Apache · Apache Tomcat

  High7.5
• CVE-2020-1956

  Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…

  Apache · Kylin

  ExploitedHigh8.8
• CVE-2019-0235

  Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

  Apache · Apache OFBiz

  High8.8
• CVE-2019-12425

  Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host

  Apache · Apache OFBiz

  High7.5
• CVE-2020-9482

  If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication…

  Apache · Apache NiFi Registry

  Medium6.5