Apache vulnerabilities43 known to be exploited.
Apache has 2,540 published vulnerabilities across 391 products in our catalogue. 43 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is HTTP Server, with 318. If you run Apache software, patch the exploited flaws first.
The most recent Apache flaw added to the known-exploited list is CVE-2024-38475, on 1 May 2025. We keep watching the known-exploited list.
Which Apache products have the most vulnerabilities?
HTTP Server leads with 318 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Apache vulnerabilities are being exploited?
43 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.1Apache HTTP Server Improper Escaping of Output Vulnerability
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not...
- 9.8Apache Tomcat Path Equivalence Vulnerability
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
- 7.5Apache OFBiz Forced Browsing Vulnerability
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
- 9.8Apache HugeGraph-Server Improper Access Control Vulnerability
Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.
- 9.8Apache OFBiz Incorrect Authorization Vulnerability
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
- 9.8Apache OFBiz Path Traversal Vulnerability
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
- 7.5Apache Flink Improper Access Control Vulnerability
Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.
- 8.9Apache Superset Insecure Default Initialization of Resource Vulnerability
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default...
Which Apache flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers...
- >99%
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
- >99%
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
- >99%CVE-2008-2938Medium
Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via...
- >99%CVE-2014-0094Medium
The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
- >99%
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.
- 99%CVE-2011-3192High
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses...
- 99%
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
- 98%CVE-2014-0112High
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted...
All Apache products we track.
354 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- HTTP Serverhttp_server318 vulnerabilities267 versions
- Tomcattomcat233 vulnerabilities656 versions
- Airflowairflow92 vulnerabilities114 versions
- Strutsstruts87 vulnerabilities174 versions
- Traffic Servertraffic_server80 vulnerabilities125 versions
- Supersetsuperset62 vulnerabilities136 versions
- Openofficeopenoffice55 vulnerabilities44 versions
- Ofbizofbiz52 vulnerabilities64 versions
- Activemqactivemq50 vulnerabilities113 versions
- Subversionsubversion47 vulnerabilities186 versions
- Cxfcxf42 vulnerabilities215 versions
- Nifinifi42 vulnerabilities77 versions
- Solrsolr40 vulnerabilities131 versions
- Hadoophadoop36 vulnerabilities146 versions
- Inlonginlong31 vulnerabilities21 versions
- Camelcamel28 vulnerabilities258 versions
- Cloudstackcloudstack28 vulnerabilities108 versions
- Ambariambari26 vulnerabilities46 versions
- Openmeetingsopenmeetings25 vulnerabilities39 versions
- Dolphinschedulerdolphinscheduler24 vulnerabilities47 versions
- Jspwikijspwiki24 vulnerabilities63 versions
- Tikatika24 vulnerabilities67 versions
- Geodegeode23 vulnerabilities43 versions
- Zeppelinzeppelin22 vulnerabilities20 versions
This directory lists the 354 Apache products with at least one tracked version, of 391 in our catalogue.
Running Apache? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
- Matched to
- HTTP Server on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 2,540 published vulnerabilities across 391 products and 12,777 versions from Apache. The most recent Apache flaw added to the known-exploited list is CVE-2024-38475, on 1 May 2025.
43 Apache vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2024-38475, CVE-2025-24813 and CVE-2024-45195. The full list is on this page.
HTTP Server, with 318 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Apache products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.