Apache — security advisories

77 advisories40 exploitedlatest 2026-07-10⚡ RSS feed

Tracked Apache products:

⚡ Watch Apache

Get an email when a new Apache advisory drops — max one per day, one-click unsubscribe.

[UPDATE] [medium] Apache Tomcat and Tomcat Native: Multiple vulnerabilities

mediumCVE-2026-34486 CVE-2026-24880 CVE-2026-25854 CVE-2026-29129cert-bund2026-07-10

[UPDATE] [medium] Apache log4j: Multiple vulnerabilities allow file manipulation

mediumCVE-2026-34477 CVE-2026-34478 CVE-2026-34479 CVE-2026-34480cert-bund2026-07-10

[UPDATE] [medium] Apache CXF: Multiple vulnerabilities

mediumCVE-2026-49875 CVE-2026-50623 CVE-2026-50627 CVE-2026-50628cert-bund2026-07-10

[UPDATE] [high] Apache CXF: Multiple vulnerabilities

highCVE-2026-44417 CVE-2026-44618 CVE-2026-44930cert-bund2026-07-10

[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilities

highCVE-2023-38709 CVE-2024-42516 CVE-2024-43204 CVE-2024-43394cert-bund2026-07-09

[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilities

highCVE-2026-23918 CVE-2026-24072 CVE-2026-28780 CVE-2026-29168cert-bund2026-07-09

[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilities

highCVE-2026-49975 CVE-2026-29167 CVE-2026-29170 CVE-2026-34355cert-bund2026-07-09

[UPDATE] [medium] Apache Tomcat: Multiple vulnerabilities

mediumCVE-2026-50229 CVE-2026-53404 CVE-2026-53434 CVE-2026-55276cert-bund2026-07-09

USN-8516-1: Apache HTTP Server vulnerabilities

unknownCVE-2026-29167 CVE-2026-29170 CVE-2026-34355 CVE-2026-34356ubuntu2026-07-08

[UPDATE] [critical] Apache log4j: Vulnerability allows code execution

criticalcert-bund2026-07-08

[NEW] [medium] Apache Airflow: Multiple vulnerabilities

mediumCVE-2026-48828 CVE-2026-48891 CVE-2026-49487 CVE-2026-33264cert-bund2026-07-08

[NEW] [medium] Apache Airflow: Vulnerability allows file manipulation

mediumCVE-2026-49297cert-bund2026-07-07

[NEW] [high] Apache Camel: Multiple vulnerabilities

highCVE-2026-40047 CVE-2026-40859 CVE-2026-43865 CVE-2026-43866cert-bund2026-07-07

[UPDATE] [high] Apache Camel: Multiple vulnerabilities

highCVE-2026-27172 CVE-2026-33454 CVE-2026-40022 CVE-2026-40048cert-bund2026-07-06

[UPDATE] [high] Apache Camel: Multiple vulnerabilities

highCVE-2026-23552 CVE-2026-25747cert-bund2026-07-06

[UPDATE] [high] Apache Camel (Neo4j): Vulnerability allows data manipulation

highCVE-2025-66169cert-bund2026-07-06

[UPDATE] [medium] Apache Commons: Multiple vulnerabilities allow unspecified attack

mediumCVE-2024-29131 CVE-2024-29133cert-bund2026-07-06

[UPDATE] [medium] Apache Camel: Multiple vulnerabilities allow denial of service

mediumCVE-2023-39410 CVE-2023-5072cert-bund2026-07-06

[UPDATE] [medium] Apache Ivy: Vulnerability allows information disclosure

mediumCVE-2022-46751cert-bund2026-07-06

[NEW] [medium] Apache HttpComponents Core: Multiple vulnerabilities allow Denial of Service

mediumCVE-2026-54399 CVE-2026-54428cert-bund2026-07-02

[UPDATE] [high] Apache HTTP Server: Multiple vulnerabilities

highexploitedCVE-2024-38475 CVE-2023-38709 CVE-2024-36387 CVE-2024-38472cert-bund2026-07-02

[UPDATE] [high] Apache Tomcat: Multiple vulnerabilities

highCVE-2026-41284 CVE-2026-41293 CVE-2026-42498 CVE-2026-43512cert-bund2026-07-02

Apache Tomcat Multiple Vulnerabilities

unknownCVE-2026-50229 CVE-2026-53404 CVE-2026-53434 CVE-2026-55276hkcert2026-07-02

Multiple vulnerabilities in Apache Tomcat (June 30, 2026)

unknownCVE-2026-55276 CVE-2026-50229 CVE-2026-55956 CVE-2026-55955cert-fr-avis2026-06-30

CVE-2026-42536: Apache HTTP Server: mod_xml2enc heap overflow

highCVSS 7.5CVE-2026-42536msrc2026-06-09

CVE-2026-44185: Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

highCVSS 7.3CVE-2026-44185msrc2026-06-09

CVE-2026-43951: Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash

mediumCVSS 6.5CVE-2026-43951msrc2026-06-09

CVE-2026-34356: Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

highCVSS 7.5CVE-2026-34356msrc2026-06-09

CVE-2026-44631: Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow

criticalCVSS 9.4CVE-2026-44631msrc2026-06-09

CVE-2026-34355: Apache HTTP Server: mod_proxy_html buffer overflow

highCVSS 7.5CVE-2026-34355msrc2026-06-09

CVE-2026-48913: Apache HTTP Server: mod_http2 memory corruption when file handles exhausted

highCVSS 7.3CVE-2026-48913msrc2026-06-09

CVE-2026-42535: Apache HTTP Server: mod_dav_fs protected directory access

highCVSS 7.5CVE-2026-42535msrc2026-06-09

CVE-2026-29170: Apache HTTP Server: mod_proxy_ftp XSS

mediumCVSS 6.1CVE-2026-29170msrc2026-06-09

CVE-2026-44119: Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules

mediumCVSS 5.5CVE-2026-44119msrc2026-06-09

CVE-2026-29167: Apache HTTP Server: mod_ldap per-dir use-after-free

highCVSS 8.6CVE-2026-29167msrc2026-06-09

CVE-2026-49975: Apache HTTP Server: mod_http2 denial of service

highCVSS 7.5CVE-2026-49975msrc2026-06-09

CVE-2026-44186: Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

mediumCVSS 6.5CVE-2026-44186msrc2026-06-09

CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability

criticalexploitedCVE-2026-34197cisa-kev2026-04-16

CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability

criticalexploitedCVE-2024-38475cisa-kev2025-05-01

CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability

criticalexploitedCVE-2025-24813cisa-kev2025-04-01

CVE-2024-45195: Apache OFBiz Forced Browsing Vulnerability

criticalexploitedCVE-2024-45195cisa-kev2025-02-04

CVE-2024-27348: Apache HugeGraph-Server Improper Access Control Vulnerability

criticalexploitedCVE-2024-27348cisa-kev2024-09-18

CVE-2024-38856: Apache OFBiz Incorrect Authorization Vulnerability

criticalexploitedCVE-2024-38856cisa-kev2024-08-27

CVE-2024-32113: Apache OFBiz Path Traversal Vulnerability

criticalexploitedCVE-2024-32113cisa-kev2024-08-07

CVE-2020-17519: Apache Flink Improper Access Control Vulnerability

criticalexploitedCVE-2020-17519cisa-kev2024-05-23

CVE-2023-27524: Apache Superset Insecure Default Initialization of Resource Vulnerability

criticalexploitedCVE-2023-27524cisa-kev2024-01-08

Vulnerability in Apache Struts 2 (December 13, 2023)

unknownCVE-2023-50164cert-fr-alerte2023-12-13

CVE-2023-46604: Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

criticalexploitedCVE-2023-46604cisa-kev2023-11-02

CVE-2023-33246: Apache RocketMQ Command Execution Vulnerability

criticalexploitedCVE-2023-33246cisa-kev2023-09-06

CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability

criticalexploitedCVE-2016-8735cisa-kev2023-05-12

CVE-2021-45046: Apache Log4j2 Deserialization of Untrusted Data Vulnerability

criticalexploitedCVE-2021-45046cisa-kev2023-05-01

CVE-2022-33891: Apache Spark Command Injection Vulnerability

criticalexploitedCVE-2022-33891cisa-kev2023-03-07

CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability

criticalexploitedCVE-2022-24706cisa-kev2022-08-25

CVE-2022-24112: Apache APISIX Authentication Bypass Vulnerability

criticalexploitedCVE-2022-24112cisa-kev2022-08-25

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability

criticalexploitedCVE-2017-12617cisa-kev2022-03-25

CVE-2020-1956: Apache Kylin OS Command Injection Vulnerability

criticalexploitedCVE-2020-1956cisa-kev2022-03-25

CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability

criticalexploitedCVE-2017-12615cisa-kev2022-03-25

CVE-2013-2251: Apache Struts Improper Input Validation Vulnerability

criticalexploitedCVE-2013-2251cisa-kev2022-03-25

CVE-2020-1938: Apache Tomcat Improper Privilege Management Vulnerability

criticalexploitedCVE-2020-1938cisa-kev2022-03-03

CVE-2017-9791: Apache Struts 1 Improper Input Validation Vulnerability

criticalexploitedCVE-2017-9791cisa-kev2022-02-10

CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability

criticalexploitedCVE-2016-3088cisa-kev2022-02-10

CVE-2012-0391: Apache Struts 2 Improper Input Validation Vulnerability

criticalexploitedCVE-2012-0391cisa-kev2022-01-21

CVE-2006-1547: Apache Struts 1 ActionForm Denial-of-Service Vulnerability

criticalexploitedCVE-2006-1547cisa-kev2022-01-21

CVE-2020-13927: Apache Airflow's Experimental API Authentication Bypass

criticalexploitedCVE-2020-13927cisa-kev2022-01-18

CVE-2020-11978: Apache Airflow Command Injection

criticalexploitedCVE-2020-11978cisa-kev2022-01-18

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability

criticalexploitedCVE-2021-44228cisa-kev2021-12-10

CVE-2019-0193: Apache Solr DataImportHandler Code Injection Vulnerability

criticalexploitedCVE-2019-0193cisa-kev2021-12-10

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF)

criticalexploitedCVE-2021-40438cisa-kev2021-12-01

CVE-2017-5638: Apache Struts Remote Code Execution Vulnerability

criticalexploitedCVE-2017-5638cisa-kev2021-11-03

CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability

criticalexploitedCVE-2020-17530cisa-kev2021-11-03

CVE-2016-4437: Apache Shiro Code Execution Vulnerability

criticalexploitedCVE-2016-4437cisa-kev2021-11-03

CVE-2019-17558: Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

criticalexploitedCVE-2019-17558cisa-kev2021-11-03

CVE-2017-9805: Apache Struts Deserialization of Untrusted Data Vulnerability

criticalexploitedCVE-2017-9805cisa-kev2021-11-03

CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability

criticalexploitedCVE-2019-0211cisa-kev2021-11-03

CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability

criticalexploitedCVE-2021-41773cisa-kev2021-11-03

CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability

criticalexploitedCVE-2021-42013cisa-kev2021-11-03

CVE-2018-11776: Apache Struts Remote Code Execution Vulnerability

criticalexploitedCVE-2018-11776cisa-kev2021-11-03