Apache vulnerabilities

CVEs per yearBy the year they were published

1. 201955
2. 202031
3. 20211
4. 20231
5. 20242
6. 20251

Known exploitedNewest addition to KEV first

• CVE-2020-1956

  Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…

  Apache · Kylin

  ExploitedHigh8.8
• CVE-2020-1938

  When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…

  Apache · Apache Tomcat

  ExploitedCritical9.8
• CVE-2019-0193

  In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH…

  Apache · Apache Solr

  ExploitedHigh7.2
• CVE-2019-0211

  In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including…

  Apache · Apache HTTP Server

  ExploitedHigh7.8

Newest CVEs

• CVE-2025-58712

  Amq: privilege escalation via excessive /etc/passwd permissions

  apache · activemq-artemis

  Medium6.4
• CVE-2024-42362

  GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

  Apache · HertzBeat

  High8.8
• CVE-2024-42361

  GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}

  Apache · HertzBeat

  High7.5
• CVE-2021-32824

  Regular expression Denial of Service in MooTools

  Apache · Dubbo

  Critical9.8
• CVE-2021-25958

  Generation of Error Message Containing Sensitive Information in Apache OFBiz

  apache · ofbiz-framework

  Medium6.5
• CVE-2020-11996

  A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…

  Apache · Apache Tomcat

  High7.5
• CVE-2020-1956

  Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…

  Apache · Kylin

  ExploitedHigh8.8
• CVE-2019-0235

  Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

  Apache · Apache OFBiz

  High8.8
• CVE-2019-12425

  Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host

  Apache · Apache OFBiz

  High7.5
• CVE-2020-9482

  If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication…

  Apache · Apache NiFi Registry

  Medium6.5