CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-40438Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery | Apache Software Foundation · Apache HTTP Server | Exploited | 9.0 | 100% | 2021-09-16 |
| CVE-2021-41773Apache 2.4.49 - Path Traversal and Remote Code Execution | Apache Software Foundation · Apache HTTP Server | Exploited | 7.5 | 100% | 2021-10-05 |
| CVE-2021-42013Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution | Apache Software Foundation · Apache HTTP Server | Exploited | 9.8 | 100% | 2021-10-07 |
| CVE-2024-38475Sonicwall - Pre-Authentication Arbitrary File Read | Apache Software Foundation · Apache HTTP Server | Exploited | 9.1 | 100% | 2024-07-01 |
| CVE-2019-0211In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by… | Apache · Apache HTTP Server | Exploited | 7.8 | 65% | 2019-04-08 |
| CVE-2020-11984Apache HTTP Server - Remote Code Execution | Apache · Apache HTTP Server | Public check | – | 90% | 2020-08-07 |
| CVE-2017-15715Apache httpd <=2.4.29 - Arbitrary File Upload | Apache Software Foundation · Apache HTTP Server | Public check | – | 86% | 2018-03-26 |
| CVE-2019-10092Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting | Apache · Apache HTTP Server | Public check | – | 81% | 2019-09-26 |
| CVE-2019-10098Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect | Apache · Apache HTTP Server | Public check | – | 74% | 2019-09-25 |
| CVE-2024-38472Apache HTTPd Windows UNC - Server-Side Request Forgery | Apache Software Foundation · Apache HTTP Server | Public check | 7.5 | 69% | 2024-07-01 |
| CVE-2018-8011Apache HTTP Server - NULL Pointer Dereference | Apache Software Foundation · Apache HTTP Server | Public check | – | 55% | 2018-07-18 |
| CVE-2024-38473Apache HTTP Server - ACL Bypass | Apache Software Foundation · Apache HTTP Server | Public check | 8.1 | 26% | 2024-07-01 |
| CVE-2016-4975Apache mod_userdir CRLF injection | Apache Software Foundation · Apache HTTP Server | Public check | – | 20% | 2018-08-14 |
| CVE-2021-44790Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier | Apache Software Foundation · Apache HTTP Server | Likely | – | 97% | 2021-12-20 |
| CVE-2017-9798Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigur… | Apache Software Foundation · Apache HTTP Server | Likely | – | 95% | 2017-09-18 |
| CVE-2022-30522mod_sed denial of service | Apache Software Foundation · Apache HTTP Server | Likely | – | 90% | 2022-06-08 |
| CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to… | Apache · Apache HTTP Server | Likely | – | 89% | 2020-08-07 |
| CVE-2024-27316Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames | Apache Software Foundation · Apache HTTP Server | Likely | 7.5 | 89% | 2024-04-04 |
| CVE-2023-25690Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy | Apache Software Foundation · Apache HTTP Server | Likely | 9.8 | 84% | 2023-03-07 |
| CVE-2021-44224Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier | Apache Software Foundation · Apache HTTP Server | Likely | – | 82% | 2021-12-20 |
| CVE-2016-8740The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows re… | Apache Software Foundation · Apache HTTP Server | Likely | – | 79% | 2016-12-05 |
| CVE-2022-22719mod_lua Use of uninitialized value of in r:parsebody | Apache Software Foundation · Apache HTTP Server | Likely | – | 70% | 2022-03-14 |
| CVE-2018-1303A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared m… | Apache Software Foundation · Apache HTTP Server | Likely | – | 70% | 2018-03-26 |
| CVE-2023-43622Apache HTTP Server: DoS in HTTP/2 with initial windows size 0 | Apache Software Foundation · Apache HTTP Server | Likely | – | 69% | 2023-10-23 |
| CVE-2021-26691Apache HTTP Server mod_session response handling heap overflow | Apache Software Foundation · Apache HTTP Server | Likely | – | 68% | 2021-06-10 |
| CVE-2021-26690mod_session NULL pointer dereference | Apache Software Foundation · Apache HTTP Server | Likely | – | 65% | 2021-06-10 |
| CVE-2021-34798NULL pointer dereference in httpd core | Apache Software Foundation · Apache HTTP Server | Likely | – | 65% | 2021-09-16 |
| CVE-2021-36160mod_proxy_uwsgi out of bound read | Apache Software Foundation · Apache HTTP Server | Likely | – | 64% | 2021-09-16 |
| CVE-2019-0190A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denia… | Apache Software Foundation · Apache HTTP Server | Likely | – | 60% | 2019-01-30 |
| CVE-2019-17567mod_proxy_wstunnel tunneling of non Upgraded connections | Apache Software Foundation · Apache HTTP Server | Likely | – | 60% | 2021-06-10 |
| CVE-2017-7668The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input st… | Apache Software Foundation · Apache HTTP Server | Likely | – | 57% | 2017-06-20 |
| CVE-2017-9788In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between succe… | Apache Software Foundation · Apache HTTP Server | Likely | – | 57% | 2017-07-13 |
| CVE-2020-1927In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to… | Apache · Apache HTTP Server | Likely | – | 57% | 2020-04-01 |
| CVE-2020-11993Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong con… | Apache · Apache HTTP Server | Likely | – | 57% | 2020-08-07 |
| CVE-2017-7659A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process. | Apache Software Foundation · Apache HTTP Server | Likely | – | 54% | 2017-07-26 |
| CVE-2020-35452mod_auth_digest possible stack overflow by one nul byte | Apache Software Foundation · Apache HTTP Server | Likely | – | 53% | 2021-06-10 |
| CVE-2019-10097In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could… | Apache · Apache HTTP Server | Likely | – | 53% | 2019-09-26 |
| CVE-2022-37436Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting | Apache Software Foundation · Apache HTTP Server | Likely | 5.3 | 53% | 2023-01-17 |
| CVE-2021-31618NULL pointer dereference on specially crafted HTTP/2 request | Apache Software Foundation · Apache HTTP Server | Likely | – | 52% | 2021-06-15 |
| CVE-2020-1934In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. | Apache · Apache HTTP Server | Likely | – | 52% | 2020-04-01 |
| CVE-2021-30641Unexpected URL matching with 'MergeSlashes OFF' | Apache Software Foundation · Apache HTTP Server | Likely | – | 52% | 2021-06-10 |
| CVE-2018-11763In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout co… | Apache Software Foundation · Apache HTTP Server | Likely | – | 51% | 2018-09-25 |
| CVE-2022-23943mod_sed: Read/write beyond bounds | Apache Software Foundation · Apache HTTP Server | Likely | – | 50% | 2022-03-14 |
| CVE-2020-13950mod_proxy_http NULL pointer dereference | Apache Software Foundation · Apache HTTP Server | Likely | – | 50% | 2021-06-10 |
| CVE-2026-23918Apache HTTP Server: http2: double free and possible RCE on early reset | Apache Software Foundation · Apache HTTP Server | Likely | 8.8 | 50% | 2026-05-04 |
| CVE-2016-0736In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (… | Apache Software Foundation · Apache HTTP Server | Likely | – | 49% | 2017-07-27 |
| CVE-2021-33193Request splitting via HTTP/2 method injection and mod_proxy | Apache Software Foundation · Apache HTTP Server | Likely | – | 46% | 2021-08-16 |
| CVE-2022-22721core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody | Apache Software Foundation · Apache HTTP Server | Likely | – | 42% | 2022-03-14 |
| CVE-2024-38476Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect | Apache Software Foundation · Apache HTTP Server | Likely | 9.8 | 42% | 2024-07-01 |
| CVE-2021-39275ap_escape_quotes buffer overflow | Apache Software Foundation · Apache HTTP Server | Likely | – | 39% | 2021-09-16 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.