Skip to content

Apache · weakness class

Other weaknesses

32 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
9

Every one of the 32 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is…CVE-2006-3747Apache · 97% likely

    CWE-189

  2. Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to ca…CVE-2010-0010Apache · 43% likely

    CWE-189

  3. java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to cont…CVE-2014-0227Apache · 21% likely

    CWE-19

  4. Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x befor…CVE-2014-0075Apache · 18% likely

    CWE-189

  5. A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.1…CVE-2016-8745Apache Software Foundation · 16% likely

    CWE-388

  6. qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists beca…CVE-2015-0224Apache · 15% likely

    CWE-19

  7. Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a de…CVE-2009-2412Apache · 14% likely

    CWE-189

  8. Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a den…CVE-2009-1956Apache · 12% likely

    CWE-189

  9. Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial o…CVE-2012-0022Apache · 10% likely

    CWE-189

  10. Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or p…CVE-2015-5213Apache · 9.6% likely

    CWE-189

  11. Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted m…CVE-2012-4459Apache · 9.2% likely

    CWE-189

  12. Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allow…CVE-2014-0099Apache · 8.8% likely

    CWE-189

  13. The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct click…CVE-2016-0734Apache · 8.6% likely

    CWE-254

  14. The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a s…CVE-2015-0203Apache · 8.5% likely

    CWE-19

  15. Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to caus…CVE-2011-2516Apache · 7.7% likely

    CWE-189

  16. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an…CVE-2015-5344Apache · 7.1% likely

    CWE-19

  17. XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.CVE-2014-3629Apache · 6.9% likely

    CWE-19

  18. Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote atta…CVE-2015-5348Apache · 6.4% likely

    CWE-19

  19. The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width e…CVE-2012-4458Apache · 6.4% likely

    CWE-189

  20. main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag t…CVE-2016-6497Apache · 5.7% likely

    CWE-254

  21. Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.CVE-2014-8152Apache · 5.6% likely

    CWE-254

  22. Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allo…CVE-2011-3607Apache · 4.9% likely

    CWE-189

  23. Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.CVE-2014-3500Apache · 4.1% likely

    CWE-17

  24. Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.CVE-2002-0493Apache · 3.8% likely

    CWE-254

  25. Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through…CVE-2014-3501Apache · 3.7% likely

    CWE-254

  26. The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved…CVE-2003-1580Apache · 3.7% likely

    CWE-189

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.