Apache · weakness class
Server-Side Request Forgery
90 CVEs · 1 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 1
- check available
- 6
- likely to be exploited
- 4
Every one of the 90 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
- Apache OFBiz - Remote Code Execution
- Apache OFBiz < 18.12.11 - Remote Code Execution
- Apache Solr <=8.8.1 - Server-Side Request Forgery
- Apache Kafka Client - Arbitrary File Read
- Apache HTTPd Windows UNC - Server-Side Request Forgery
- Apache Druid - Server-Side Request Forgery
- A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the proje…
- Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker w…
- Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker coul…
- Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker c…
- Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
- Jar url should be blocked by DefaultScriptSecurity
- Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argumen…
- OAuth 2 authorization service vulnerable to DDos attacks
- Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
- Code execution in Apache OpenOffice via non-http(s) schemes in Hyperlinks
- In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
- Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java SAX Parser to implement its XML…
- Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend API
- Apache Batik prior to 1.16 allows RCE via scripting
- Apache CXF SSRF Vulnerability using the Aegis databinding
- Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
- Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It…
- Improper Access Control to Streaming Coordinator & SSRF
- Server-Side Request Forgery Information Disclosure Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP