CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-41773Apache 2.4.49 - Path Traversal and Remote Code Execution | Apache Software Foundation · Apache HTTP Server | Exploited | 7.5 | 100% | 2021-10-05 |
| CVE-2017-12617Apache Tomcat - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 8.1 | 100% | 2017-10-03 |
| CVE-2021-42013Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution | Apache Software Foundation · Apache HTTP Server | Exploited | 9.8 | 100% | 2021-10-07 |
| CVE-2025-24813Apache Tomcat Path Equivalence - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 10.0 | 100% | 2025-03-10 |
| CVE-2024-32113Apache OFBiz Directory Traversal - Remote Code Execution | Apache Software Foundation · Apache OFBiz | Exploited | 9.1 | 100% | 2024-05-08 |
| CVE-2017-12615Apache Tomcat Servers - Remote Code Execution | Apache Software Foundation · Apache Tomcat | Exploited | 8.1 | 100% | 2017-09-19 |
| CVE-2016-3088Apache ActiveMQ Fileserver - Arbitrary File Write | Apache · ActiveMQ | Exploited | 9.8 | 98% | 2016-06-01 |
| CVE-2020-17519Apache Flink - Local File Inclusion | Apache Software Foundation · Apache Flink | Exploited | 9.1 | 98% | 2021-01-05 |
| CVE-2018-11759Apache Tomcat JK Connect <=1.2.44 - Manager Access | Apache Software Foundation · Apache Tomcat Connectors | Public check | – | 91% | 2018-10-31 |
| CVE-2024-36104Apache OFBiz - Directory Traversal & Remote Code Execution | Apache Software Foundation · Apache OFBiz | Public check | 9.1 | 88% | 2024-06-04 |
| CVE-2020-17518Apache Flink 1.5.1 - Local File Inclusion | Apache Software Foundation · Apache Flink | Public check | – | 49% | 2021-01-05 |
| CVE-2022-47501Apache OFBiz < 18.12.07 - Local File Inclusion | Apache Software Foundation · Apache OFBiz | Public check | 7.5 | 10% | 2023-04-14 |
| CVE-2008-2938Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote att… | Apache · Tomcat | Likely | – | 100% | 2008-08-13 |
| CVE-2007-0450Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allo… | Apache · Http Server | Likely | – | 91% | 2007-03-16 |
| CVE-2015-1830Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to cre… | Apache · Activemq | Likely | – | 84% | 2015-08-19 |
| CVE-2023-50386Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets | Apache Software Foundation · Apache Solr | Likely | 8.8 | 84% | 2024-02-09 |
| CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability | Apache Software Foundation · Apache Struts | Likely | – | 81% | 2023-12-07 |
| CVE-2016-0709Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to a… | Apache · Jetspeed | Likely | – | 77% | 2016-04-11 |
| CVE-2001-0925The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains… | Apache · Http Server | Likely | – | 75% | 2002-02-02 |
| CVE-2008-6505Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot… | Apache · Struts | Likely | – | 73% | 2009-03-23 |
| CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks | Apache Software Foundation · Apache Struts | Likely | 9.5 | 72% | 2024-12-11 |
| CVE-2022-44635Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal | Apache Software Foundation · Apache Fineract | Likely | 8.8 | 69% | 2022-11-29 |
| CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled | Apache Software Foundation · Apache Tomcat | Likely | 7.5 | 64% | 2025-10-27 |
| CVE-2024-27317Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification | Apache Software Foundation · Apache Pulsar | Likely | 8.4 | 57% | 2024-03-12 |
| CVE-2013-6397Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr par… | Apache · Solr | Likely | – | 57% | 2013-12-07 |
| CVE-2016-0784Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbi… | Apache · Openmeetings | Likely | – | 55% | 2016-04-11 |
| CVE-2010-3863Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass int… | Apache · Shiro | Likely | – | 55% | 2010-11-05 |
| CVE-2008-2370Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string… | Apache · Tomcat | Likely | – | 53% | 2008-08-04 |
| CVE-2024-25065Apache OFBiz: Path traversal allowing authentication bypass. | Apache Software Foundation · Apache OFBiz | Likely | 9.1 | 48% | 2024-02-28 |
| CVE-2024-52012Apache Solr: Configset upload on Windows allows arbitrary path write-access | Apache Software Foundation · Apache Solr | Likely | 5.4 | 47% | 2025-01-27 |
| CVE-2018-1323The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some… | Apache Software Foundation · Apache Tomcat Connectors | Likely | – | 46% | 2018-03-12 |
| CVE-2007-5461Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remo… | Apache · Tomcat | Likely | – | 40% | 2007-10-15 |
| CVE-2008-5518Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload… | Apache · Geronimo | Likely | – | 36% | 2009-04-17 |
| CVE-2011-4367Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arb… | Apache · Myfaces | Likely | – | 34% | 2014-06-19 |
| CVE-2025-61734Apache Kylin: improper restriction of file read | Apache Software Foundation · Apache Kylin | Likely | 7.5 | 29% | 2025-10-02 |
| CVE-2019-12409The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping w… | Apache · Solr | Likely | – | 22% | 2019-11-18 |
| CVE-2008-5515Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when… | Apache · Tomcat | Likely | – | 19% | 2009-06-16 |
| CVE-2015-5345The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints… | Apache · Tomcat | Likely | 5.3 | 18% | 2016-02-25 |
| CVE-2007-1860mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attack… | Apache · Tomcat Jk Web Server Connector | Likely | – | 13% | 2007-05-25 |
| CVE-2015-5174Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass inte… | Apache · Tomcat | Likely | – | 13% | 2016-02-25 |
| CVE-2009-2902Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal seq… | Apache · Tomcat | Likely | – | 11% | 2010-01-28 |
| CVE-2010-3450Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (… | Apache · Openoffice | Likely | – | 11% | 2011-01-28 |
| CVE-2017-7675The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was theref… | Apache Software Foundation · Apache Tomcat | Likely | – | 10% | 2017-08-11 |
| CVE-2019-0225A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtai… | Apache · Apache JSPWiki | Possible | – | 10.0% | 2019-03-28 |
| CVE-2009-2693Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot)… | Apache · Tomcat | Possible | – | 9.6% | 2010-01-28 |
| CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal. | Apache Software Foundation · Apache Camel | Possible | – | 9.6% | 2018-09-17 |
| CVE-2012-5641Directory traversal vulnerability in the partition2 function in mochiweb_util.erl in MochiWeb before 2.4.0, as used in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x b… | Apache · Couchdb | Possible | – | 8.9% | 2014-03-18 |
| CVE-2019-0194Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also af… | Apache · Apache Camel | Possible | – | 8.5% | 2019-04-30 |
| CVE-2016-6795In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution… | Apache Software Foundation · Apache Struts | Possible | – | 8.2% | 2017-09-20 |
| CVE-2020-11979As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the… | Apache · Apache Ant | Possible | – | 7.8% | 2020-10-01 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.