Apache · weakness class
Access Control
464 CVEs · 4 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 4
- check available
- 4
- likely to be exploited
- 31
Every one of the 464 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache OFBiz - Remote Code Execution
- Apache OFBiz - Improper Authorization & Remote Code Execution
- Apache HugeGraph-Server - Remote Command Execution
- ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form w…
- Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
- Apache Airflow - Unauthenticated Variable Import
- Apache Druid - Local File Inclusion
- Apache ShenYu Admin Unauth Access
- ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and ex…
- Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
- Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured…
- CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attacker…
- An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
- Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the prese…
- The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) dele…
- The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary f…
- Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML doc…
- Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might…
- Authentication Bypass Vulnerability
- Apache Syncope: Remote Code Execution by delegated administrators
- mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is us…
- The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request author…
- Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
- The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authoriza…
- Apache StreamPipes: Leverage of User ID for Privilege Escalation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.