Apache · weakness class
Command and Code Injection
180 CVEs · 10 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 10
- check available
- 12
- likely to be exploited
- 23
Every one of the 180 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Log4j2 - Remote Code Injection
- Apache Airflow <=1.10.10 - Remote Code Execution
- Apache ActiveMQ - Remote Code Execution
- Apache Kylin 3.0.1 - Command Injection Vulnerability
- Apache S2-032 Struts - Remote Code Execution
- RocketMQ <= 5.1.0 - Remote Code Execution
- Apache Struts 2.0.0-2.5.25 - Remote Code Execution
- Apache Spark UI - Remote Command Injection
- Apache Solr DataImportHandler <8.2.0 - Remote Code Execution
- The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of pro…
- Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution
- Apache OFBiz < 18.12.10 - Arbitrary Code Execution
- Apache Struts2 S2-012 RCE
- Apache RocketMQ - Remote Command Execution
- AirFlow < 2.4.0 - Remote Code Execution
- Apache Struts2 S2-062 - Remote Code Execution
- Apache Airflow OS Command Injection
- Apache Struts <2.3.1.1 - Remote Code Execution
- Apache Cassandra Load UDF RCE
- Apache bRPC Heap Profiler - Remote Command Injection
- Apache Airflow <=1.10.10 - Command Injection
- Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
- Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
- CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequent…
- Command injection
- phf CGI program allows remote command execution through shell metacharacters.
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.