Apache · weakness class
Misconfiguration and Insecure Design
31 CVEs · 2 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 2
- check available
- 2
- likely to be exploited
- 2
Every one of the 31 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Superset - Authentication Bypass
- CouchDB Erlang Distribution - Remote Command Execution
- Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
- Apache NiFi - Information Disclosure
- The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCred…
- The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https sessio…
- Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
- authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is en…
- The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results inc…
- The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script…
- The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges…
- Clickjacking in the web console
- h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.
- The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middl…
- Apache InLong: Users who joined later can see the data of deleted users
- Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
- Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
- The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwo…
- Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
- Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
- Apache Tomcat: EncryptInterceptor requirements not clearly documented
- Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set
- Apache James: WebAdmin exposed without authentication on official Docker default
- Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy
- Apache Tomcat Native: Insecure OpenSSL options enabled
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP