Apache · weakness class
File and Path Handling
190 CVEs · 8 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 8
- check available
- 4
- likely to be exploited
- 19
Every one of the 190 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache 2.4.49 - Path Traversal and Remote Code Execution
- Apache Tomcat - Remote Code Execution
- Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution
- Apache Tomcat Path Equivalence - Remote Code Execution
- Apache OFBiz Directory Traversal - Remote Code Execution
- Apache Tomcat Servers - Remote Code Execution
- Apache ActiveMQ Fileserver - Arbitrary File Write
- Apache Flink - Local File Inclusion
- Apache Tomcat JK Connect <=1.2.44 - Manager Access
- Apache OFBiz - Directory Traversal & Remote Code Execution
- Apache Flink 1.5.1 - Local File Inclusion
- Apache OFBiz < 18.12.07 - Local File Inclusion
- Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to cre…
- Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
- Apache Struts: File upload component had a directory traversal vulnerability
- Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to a…
- Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
- Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal
- Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled
- Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
- Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr par…
- Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbi…
- Apache OFBiz: Path traversal allowing authentication bypass.
- Apache Solr: Configset upload on Windows allows arbitrary path write-access
- The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some…
- Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arb…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP