Exploited Vulnerabilities DailyApache: known exploited vulnerabilities
Entries41No. 7
Ransomware-linked8
Products21
Latest2026-10-08
Added per year
By product
6
6
4
3
3
2
2
2
1
1
1
1
1
1
1
Entries
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2016-3081 | Apache Struts | 2026-10-08 | 93.3% | Unknown |
| CVE-2026-34486 | Apache Tomcat | 2026-08-04 | 6.5% | Unknown |
| CVE-2026-34197 | Apache ActiveMQ | 2026-04-16 | 15.4% | Unknown |
| CVE-2024-38475 | Apache HTTP Server | 2025-05-01 | 99.9% | Unknown |
| CVE-2025-24813 | Apache Tomcat | 2025-04-01 | 99.9% | Unknown |
| CVE-2024-45195 | Apache OFBiz | 2025-02-04 | 99.9% | Unknown |
| CVE-2024-27348 | Apache HugeGraph-Server | 2024-09-18 | 99.2% | Unknown |
| CVE-2024-38856 | Apache OFBiz | 2024-08-27 | 99.4% | Unknown |
| CVE-2024-32113 | Apache OFBiz | 2024-08-07 | 99.9% | Unknown |
| CVE-2020-17519 | Apache Flink | 2024-05-23 | 97.8% | Unknown |
| CVE-2023-27524 | Apache Superset | 2024-01-08 | 97.4% | Unknown |
| CVE-2023-46604 | Apache ActiveMQ | 2023-11-02 | 99.8% | Known |
| CVE-2023-33246 | Apache RocketMQ | 2023-09-06 | 96.5% | Unknown |
| CVE-2016-8735 | Apache Tomcat | 2023-05-12 | 90.3% | Unknown |
| CVE-2021-45046 | Apache Log4j2 | 2023-05-01 | 99.9% | Known |
| CVE-2022-33891 | Apache Spark | 2023-03-07 | 93.2% | Unknown |
| CVE-2022-24706 | Apache CouchDB | 2022-08-25 | 92.5% | Unknown |
| CVE-2022-24112 | Apache APISIX | 2022-08-25 | 96.0% | Unknown |
| CVE-2020-1956 | Apache Kylin | 2022-03-25 | 97.3% | Unknown |
| CVE-2017-12617 | Apache Tomcat | 2022-03-25 | 99.9% | Unknown |
| CVE-2017-12615 | Apache Tomcat | 2022-03-25 | 99.6% | Known |
| CVE-2013-2251 | Apache Struts | 2022-03-25 | 99.9% | Unknown |
| CVE-2020-1938 | Apache Tomcat | 2022-03-03 | 99.2% | Unknown |
| CVE-2017-9791 | Apache Struts 1 | 2022-02-10 | 98.9% | Unknown |
| CVE-2016-3088 | Apache ActiveMQ | 2022-02-10 | 98.5% | Unknown |
| CVE-2012-0391 | Apache Struts 2 | 2022-01-21 | 75.5% | Unknown |
| CVE-2006-1547 | Apache Struts 1 | 2022-01-21 | 54.6% | Unknown |
| CVE-2020-13927 | Apache Airflow's Experimental API | 2022-01-18 | 99.7% | Unknown |
| CVE-2020-11978 | Apache Airflow | 2022-01-18 | 99.1% | Unknown |
| CVE-2021-44228 | Apache Log4j2 | 2021-12-10 | 99.9% | Known |
| CVE-2019-0193 | Apache Solr | 2021-12-10 | 83.5% | Unknown |
| CVE-2021-40438 | Apache Apache | 2021-12-01 | 99.9% | Known |
| CVE-2021-42013 | Apache HTTP Server | 2021-11-03 | 99.9% | Known |
| CVE-2021-41773 | Apache HTTP Server | 2021-11-03 | 99.9% | Known |
| CVE-2020-17530 | Apache Struts | 2021-11-03 | 95.9% | Unknown |
| CVE-2019-17558 | Apache Solr | 2021-11-03 | 98.5% | Unknown |
| CVE-2019-0211 | Apache HTTP Server | 2021-11-03 | 65.0% | Unknown |
| CVE-2018-11776 | Apache Struts | 2021-11-03 | 99.9% | Unknown |
| CVE-2017-9805 | Apache Struts | 2021-11-03 | 99.3% | Unknown |
| CVE-2017-5638 | Apache Struts | 2021-11-03 | 99.9% | Known |
| CVE-2016-4437 | Apache Shiro | 2021-11-03 | 93.0% | Unknown |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
CISA KEV lists 41 Apache vulnerabilities (No. 7 of 288 vendors).