Apache · weakness class
Open Redirect
22 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 2
- likely to be exploited
- 3
Every one of the 22 is a mark on the map. Named now: 1 to 22, most at risk first.
- Apache Tomcat - Open Redirect
- Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect
- Apache Airflow: Open redirect during login
- Apache Superset Open Redirect
- In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to…
- Apache Tomcat: Open redirect with FORM authentication
- After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended…
- Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
- Apache Airflow prior to 2.4.2 has an open redirect
- Open Redirect
- Apache Helix: Open redirect
- Apache Superset: Open Redirect Vulnerability
- Apache Superset: Open Redirect Vulnerability
- Apache Airflow: Open Redirect Bypass Vulnerability
- Apache APISIX: Cas-auth Host header influence on CAS service URL
- Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value
- Apache Tomcat: Occasionally open redirect
- Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
- Apache CXF: OIDC RP Open Redirect
- Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
- Apache Syncope: CAS service URL injection via Forwarded HTTP headers
- Apache Allura: OAuth1 missing callback validation
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.