Apache · weakness class
Injection and Smuggling
233 CVEs · 3 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 3
- check available
- 7
- likely to be exploited
- 21
Every one of the 233 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution
- Sonicwall - Pre-Authentication Arbitrary File Read
- Apache Solr <=8.3.1 - Remote Code Execution
- Apache Solr <= 7.1 - XML Entity Injection
- Apache Tika - XML External Entity Injection
- Apache Cocoon 2.1.12 - XML Injection
- Apache Struts XWork - XML External Entity Injection
- Apache Tika - XXE Injection
- Apache HTTP Server - ACL Bypass
- Apache mod_userdir CRLF injection
- Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to…
- Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
- Shell Command Injection Vulnerability in Nimbus Thrift Server
- Apache Camel: Camel Message Header Injection through request parameters
- Incorrect Transfer-Encoding handling with HTTP/1.0
- Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
- mod_proxy_wstunnel tunneling of non Upgraded connections
- Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong con…
- Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
- The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a cra…
- HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier
- mod_proxy_ajp: Possible request smuggling
- This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImport…
- The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall prote…
- CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and…
- In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.