Apache · weakness class
Input Validation and Logic
324 CVEs · 2 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 2
- check available
- 7
- likely to be exploited
- 51
Every one of the 324 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache Struts 2 - Remote Command Execution
- Apache Struts2 S2-053 - Remote Code Execution
- Apache Struts - Multiple Open Redirection Vulnerabilities
- Apache Struts2 S2-053 - Remote Code Execution
- Apache httpd <=2.4.29 - Arbitrary File Upload
- Apache Unomi <1.5.2 - Remote Code Execution
- Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write
- Apache Tomcat - HTTP Request Smuggling
- Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution
- Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, do…
- Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
- Apache Camel: Camel Message Header Injection via Improper Filtering
- Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
- The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2)…
- Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
- Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors…
- Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to…
- The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows re…
- The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a…
- The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smu…
- The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly…
- Apache Traffic Server: Malformed http/2 frames can cause an abort
- XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.…
- Apache Kylin: Command injection by Useless configuration
- The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1…
- tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which all…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP