[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo2ZP_fPdQUe7JvXwt_PeAlq_h9spLXIaRefxgqa_cI4":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":1589,"kevVulnerabilities":1651,"topProductsByCves":1942,"seoMetadata":1953,"meta":1962},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":1588},1854,"apache",391,2540,43,12777,"2026-04-02","a",[16,23,30,37,44,50,56,63,70,76,82,88,93,99,105,111,117,122,128,134,139,144,149,154,160,165,169,173,178,184,188,193,198,203,209,213,218,224,229,234,239,244,250,255,259,264,269,274,278,283,287,292,297,301,305,309,313,318,323,327,331,336,341,345,349,354,359,363,368,373,378,382,386,390,394,398,402,406,410,415,420,424,428,432,436,441,445,449,453,457,461,465,469,474,478,482,487,491,495,500,505,509,513,516,519,523,527,531,535,539,543,547,552,556,559,563,568,572,576,580,584,588,592,596,600,604,609,613,617,621,626,630,634,638,642,645,649,653,657,661,665,670,674,678,682,686,690,694,697,701,705,709,713,717,722,726,730,734,738,742,746,749,753,756,760,764,768,772,776,779,783,787,791,795,799,803,807,811,814,818,822,826,830,835,839,843,847,851,855,859,863,867,871,875,879,883,887,891,895,899,903,907,910,914,918,922,925,929,933,937,941,945,949,953,957,961,965,969,973,977,981,985,989,992,995,998,1001,1004,1007,1010,1013,1017,1021,1024,1028,1032,1036,1040,1044,1047,1052,1056,1060,1063,1066,1070,1074,1077,1081,1085,1089,1093,1097,1101,1105,1109,1113,1117,1121,1126,1130,1134,1138,1142,1146,1150,1153,1157,1161,1164,1168,1171,1175,1179,1183,1187,1190,1193,1197,1201,1205,1209,1213,1217,1221,1225,1228,1232,1236,1240,1243,1247,1251,1255,1259,1262,1266,1270,1274,1278,1281,1285,1289,1292,1296,1300,1303,1307,1311,1315,1319,1323,1327,1331,1334,1337,1340,1344,1348,1351,1355,1359,1363,1367,1370,1374,1378,1382,1386,1389,1392,1396,1399,1403,1407,1410,1413,1417,1421,1425,1429,1433,1437,1440,1443,1446,1449,1452,1455,1458,1461,1464,1467,1470,1473,1476,1479,1482,1485,1488,1491,1494,1497,1500,1503,1507,1511,1514,1517,1520,1523,1526,1529,1532,1535,1538,1541,1544,1547,1550,1553,1557,1560,1563,1566,1569,1573,1576,1579,1582,1585],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":21,"last_cve_update":22},6693,"http_server",267,318,5,"2025-07-23",{"id":24,"product_name":25,"version_count":26,"cve_count":27,"kev_count":28,"last_cve_update":29},6892,"tomcat",656,233,6,"2025-08-13",{"id":31,"product_name":32,"version_count":33,"cve_count":34,"kev_count":35,"last_cve_update":36},6550,"airflow",114,92,2,"2025-12-15",{"id":38,"product_name":39,"version_count":40,"cve_count":41,"kev_count":42,"last_cve_update":43},6877,"struts",174,87,8,"2023-12-07",{"id":45,"product_name":46,"version_count":47,"cve_count":48,"kev_count":49,"last_cve_update":13},6899,"traffic_server",125,80,1,{"id":51,"product_name":52,"version_count":53,"cve_count":54,"kev_count":49,"last_cve_update":55},6882,"superset",136,62,"2025-08-14",{"id":57,"product_name":58,"version_count":59,"cve_count":60,"kev_count":61,"last_cve_update":62},6797,"openoffice",44,55,0,"2025-11-12",{"id":64,"product_name":65,"version_count":66,"cve_count":67,"kev_count":68,"last_cve_update":69},6789,"ofbiz",64,52,3,"2025-08-15",{"id":71,"product_name":72,"version_count":73,"cve_count":74,"kev_count":35,"last_cve_update":75},6542,"activemq",113,50,"2025-05-07",{"id":77,"product_name":78,"version_count":79,"cve_count":80,"kev_count":61,"last_cve_update":81},6881,"subversion",186,47,"2024-10-09",{"id":83,"product_name":84,"version_count":85,"cve_count":86,"kev_count":61,"last_cve_update":87},6646,"cxf",215,42,"2025-08-08",{"id":89,"product_name":90,"version_count":91,"cve_count":86,"kev_count":61,"last_cve_update":92},6782,"nifi",77,"2024-12-28",{"id":94,"product_name":95,"version_count":96,"cve_count":97,"kev_count":68,"last_cve_update":98},6866,"solr",131,40,"2024-02-09",{"id":100,"product_name":101,"version_count":102,"cve_count":103,"kev_count":61,"last_cve_update":104},6681,"hadoop",146,36,"2024-09-25",{"id":106,"product_name":107,"version_count":108,"cve_count":109,"kev_count":61,"last_cve_update":110},6710,"inlong",21,31,"2025-05-28",{"id":112,"product_name":113,"version_count":114,"cve_count":115,"kev_count":61,"last_cve_update":116},6613,"camel",258,28,"2025-04-01",{"id":118,"product_name":119,"version_count":120,"cve_count":115,"kev_count":61,"last_cve_update":121},6617,"cloudstack",108,"2024-11-12",{"id":123,"product_name":124,"version_count":125,"cve_count":126,"kev_count":61,"last_cve_update":127},6562,"ambari",46,26,"2025-01-21",{"id":129,"product_name":130,"version_count":131,"cve_count":132,"kev_count":61,"last_cve_update":133},6794,"openmeetings",39,25,"2025-01-08",{"id":135,"product_name":136,"version_count":80,"cve_count":137,"kev_count":61,"last_cve_update":138},6653,"dolphinscheduler",24,"2025-09-03",{"id":140,"product_name":141,"version_count":142,"cve_count":137,"kev_count":61,"last_cve_update":143},6889,"tika",67,"2025-08-20",{"id":145,"product_name":146,"version_count":147,"cve_count":137,"kev_count":61,"last_cve_update":148},6734,"jspwiki",63,"2025-07-31",{"id":150,"product_name":151,"version_count":11,"cve_count":152,"kev_count":35,"last_cve_update":153},6675,"geode",23,"2025-10-18",{"id":155,"product_name":156,"version_count":157,"cve_count":158,"kev_count":61,"last_cve_update":159},6930,"zeppelin",20,22,"2025-08-03",{"id":161,"product_name":162,"version_count":163,"cve_count":157,"kev_count":49,"last_cve_update":164},6869,"spark",89,"2025-10-15",{"id":166,"product_name":167,"version_count":131,"cve_count":157,"kev_count":49,"last_cve_update":168},6599,"archiva","2024-03-01",{"id":170,"product_name":171,"version_count":60,"cve_count":157,"kev_count":49,"last_cve_update":172},6644,"couchdb","2023-12-13",{"id":174,"product_name":175,"version_count":176,"cve_count":157,"kev_count":49,"last_cve_update":177},6747,"kylin",41,"2025-10-02",{"id":179,"product_name":180,"version_count":181,"cve_count":182,"kev_count":61,"last_cve_update":183},6817,"pulsar",110,19,"2024-04-02",{"id":185,"product_name":186,"version_count":137,"cve_count":182,"kev_count":61,"last_cve_update":187},6829,"ranger","2025-03-03",{"id":189,"product_name":190,"version_count":191,"cve_count":182,"kev_count":61,"last_cve_update":192},6657,"dubbo",106,"2023-12-15",{"id":194,"product_name":195,"version_count":163,"cve_count":196,"kev_count":49,"last_cve_update":197},6640,"cordova",18,"2021-02-16",{"id":199,"product_name":200,"version_count":131,"cve_count":201,"kev_count":49,"last_cve_update":202},6845,"shiro",17,"2024-01-15",{"id":204,"product_name":205,"version_count":206,"cve_count":207,"kev_count":61,"last_cve_update":208},6820,"qpid",34,16,"2019-04-23",{"id":210,"product_name":211,"version_count":126,"cve_count":207,"kev_count":61,"last_cve_update":212},6752,"linkis","2025-01-14",{"id":214,"product_name":215,"version_count":216,"cve_count":207,"kev_count":61,"last_cve_update":217},6664,"fineract",27,"2024-03-29",{"id":219,"product_name":220,"version_count":221,"cve_count":222,"kev_count":61,"last_cve_update":223},6915,"wicket",178,15,"2021-05-25",{"id":225,"product_name":226,"version_count":80,"cve_count":227,"kev_count":61,"last_cve_update":228},6730,"jmeter",14,"2021-03-23",{"id":230,"product_name":231,"version_count":232,"cve_count":227,"kev_count":61,"last_cve_update":233},6832,"roller",56,"2025-04-14",{"id":235,"product_name":236,"version_count":237,"cve_count":227,"kev_count":61,"last_cve_update":238},6721,"james",11,"2024-02-27",{"id":240,"product_name":241,"version_count":242,"cve_count":227,"kev_count":61,"last_cve_update":243},6688,"hive",60,"2022-07-16",{"id":245,"product_name":246,"version_count":247,"cve_count":248,"kev_count":35,"last_cve_update":249},6755,"log4j",79,13,"2023-03-10",{"id":251,"product_name":252,"version_count":253,"cve_count":248,"kev_count":61,"last_cve_update":254},6868,"spamassassin",29,"2021-03-25",{"id":256,"product_name":257,"version_count":80,"cve_count":248,"kev_count":61,"last_cve_update":258},6680,"guacamole","2025-07-02",{"id":260,"product_name":261,"version_count":262,"cve_count":248,"kev_count":61,"last_cve_update":263},6884,"syncope",82,"2025-10-20",{"id":265,"product_name":266,"version_count":80,"cve_count":267,"kev_count":61,"last_cve_update":268},6711,"iotdb",12,"2025-09-24",{"id":270,"product_name":271,"version_count":272,"cve_count":267,"kev_count":61,"last_cve_update":273},6738,"karaf",93,"2022-12-21",{"id":275,"product_name":276,"version_count":109,"cve_count":237,"kev_count":61,"last_cve_update":277},6623,"commons_compress","2024-02-19",{"id":279,"product_name":280,"version_count":281,"cve_count":237,"kev_count":61,"last_cve_update":282},6874,"storm",37,"2023-11-23",{"id":284,"product_name":285,"version_count":222,"cve_count":237,"kev_count":61,"last_cve_update":286},6875,"streampark","2025-10-10",{"id":288,"product_name":289,"version_count":290,"cve_count":237,"kev_count":61,"last_cve_update":291},6922,"xerces-c\\+\\+",32,"2024-02-29",{"id":293,"product_name":294,"version_count":295,"cve_count":237,"kev_count":49,"last_cve_update":296},6614,"cassandra",235,"2025-08-25",{"id":298,"product_name":299,"version_count":196,"cve_count":237,"kev_count":61,"last_cve_update":300},6607,"batik","2022-10-25",{"id":302,"product_name":303,"version_count":126,"cve_count":237,"kev_count":61,"last_cve_update":304},6676,"geronimo","2013-07-11",{"id":306,"product_name":307,"version_count":201,"cve_count":237,"kev_count":61,"last_cve_update":308},6602,"atlas","2022-12-14",{"id":310,"product_name":311,"version_count":137,"cve_count":237,"kev_count":61,"last_cve_update":312},6687,"hertzbeat","2025-09-09",{"id":314,"product_name":315,"version_count":42,"cve_count":316,"kev_count":61,"last_cve_update":317},6804,"ozone",10,"2024-02-07",{"id":319,"product_name":320,"version_count":321,"cve_count":316,"kev_count":61,"last_cve_update":322},6544,"activemq_artemis",66,"2024-10-14",{"id":324,"product_name":325,"version_count":86,"cve_count":316,"kev_count":61,"last_cve_update":326},6897,"tomee","2021-09-19",{"id":328,"product_name":329,"version_count":33,"cve_count":316,"kev_count":61,"last_cve_update":330},6886,"tapestry","2022-12-02",{"id":332,"product_name":333,"version_count":41,"cve_count":334,"kev_count":61,"last_cve_update":335},6765,"mesos",9,"2019-03-25",{"id":337,"product_name":338,"version_count":339,"cve_count":334,"kev_count":61,"last_cve_update":340},6813,"poi",54,"2022-03-04",{"id":342,"product_name":343,"version_count":262,"cve_count":334,"kev_count":61,"last_cve_update":344},6815,"portable_runtime","2024-08-26",{"id":346,"product_name":347,"version_count":248,"cve_count":334,"kev_count":61,"last_cve_update":348},6843,"shenyu","2023-10-19",{"id":350,"product_name":351,"version_count":352,"cve_count":334,"kev_count":35,"last_cve_update":353},6596,"apisix",69,"2025-10-31",{"id":355,"product_name":356,"version_count":357,"cve_count":334,"kev_count":61,"last_cve_update":358},6656,"druid",404,"2024-09-17",{"id":360,"product_name":361,"version_count":352,"cve_count":42,"kev_count":61,"last_cve_update":362},6808,"pdfbox","2021-06-12",{"id":364,"product_name":365,"version_count":366,"cve_count":42,"kev_count":61,"last_cve_update":367},6821,"qpid_broker-j",48,"2019-03-06",{"id":369,"product_name":370,"version_count":371,"cve_count":42,"kev_count":61,"last_cve_update":372},6650,"derby",33,"2023-11-20",{"id":374,"product_name":375,"version_count":376,"cve_count":42,"kev_count":61,"last_cve_update":377},6736,"kafka",81,"2024-04-12",{"id":379,"product_name":380,"version_count":131,"cve_count":42,"kev_count":61,"last_cve_update":381},6898,"traffic_control","2025-10-16",{"id":383,"product_name":384,"version_count":281,"cve_count":385,"kev_count":61,"last_cve_update":116},6565,"answer",7,{"id":387,"product_name":388,"version_count":28,"cve_count":385,"kev_count":61,"last_cve_update":389},6605,"axis","2024-01-06",{"id":391,"product_name":392,"version_count":393,"cve_count":385,"kev_count":61,"last_cve_update":268},6931,"zookeeper",100,{"id":395,"product_name":396,"version_count":59,"cve_count":385,"kev_count":49,"last_cve_update":397},6707,"ignite","2021-04-01",{"id":399,"product_name":400,"version_count":131,"cve_count":385,"kev_count":61,"last_cve_update":401},6609,"bookkeeper","2022-12-15",{"id":403,"product_name":404,"version_count":201,"cve_count":385,"kev_count":61,"last_cve_update":405},6888,"thrift","2021-02-12",{"id":407,"product_name":408,"version_count":248,"cve_count":385,"kev_count":61,"last_cve_update":409},6708,"impala","2021-07-22",{"id":411,"product_name":412,"version_count":413,"cve_count":28,"kev_count":61,"last_cve_update":414},6835,"santuario_xml_security_for_java",57,"2023-10-20",{"id":416,"product_name":417,"version_count":418,"cve_count":28,"kev_count":61,"last_cve_update":419},6598,"apr-util",112,"2011-05-24",{"id":421,"product_name":422,"version_count":227,"cve_count":28,"kev_count":61,"last_cve_update":423},6606,"axis2","2012-11-04",{"id":425,"product_name":426,"version_count":152,"cve_count":28,"kev_count":61,"last_cve_update":427},6647,"cxf_fediz","2018-07-05",{"id":429,"product_name":430,"version_count":253,"cve_count":28,"kev_count":61,"last_cve_update":431},6655,"drill","2024-07-24",{"id":433,"product_name":434,"version_count":131,"cve_count":28,"kev_count":61,"last_cve_update":435},6692,"httpclient","2020-12-02",{"id":437,"product_name":438,"version_count":439,"cve_count":28,"kev_count":61,"last_cve_update":440},6716,"jackrabbit",248,"2025-09-08",{"id":442,"product_name":443,"version_count":366,"cve_count":28,"kev_count":61,"last_cve_update":444},6726,"jena","2025-07-21",{"id":446,"product_name":447,"version_count":21,"cve_count":28,"kev_count":61,"last_cve_update":448},6729,"jetspeed","2022-07-06",{"id":450,"product_name":451,"version_count":158,"cve_count":28,"kev_count":61,"last_cve_update":452},6735,"juddi","2021-07-29",{"id":454,"product_name":455,"version_count":371,"cve_count":28,"kev_count":61,"last_cve_update":456},6776,"mod_python","2006-03-09",{"id":458,"product_name":459,"version_count":196,"cve_count":28,"kev_count":61,"last_cve_update":460},6812,"pluto","2022-01-06",{"id":462,"product_name":463,"version_count":42,"cve_count":28,"kev_count":61,"last_cve_update":464},6849,"sling","2017-07-19",{"id":466,"product_name":467,"version_count":227,"cve_count":28,"kev_count":61,"last_cve_update":468},6928,"xml_security_for_c\\+\\+","2013-08-20",{"id":470,"product_name":471,"version_count":472,"cve_count":21,"kev_count":61,"last_cve_update":473},6604,"avro",61,"2023-09-29",{"id":475,"product_name":476,"version_count":137,"cve_count":21,"kev_count":61,"last_cve_update":477},6561,"allura","2024-06-22",{"id":479,"product_name":480,"version_count":227,"cve_count":21,"kev_count":61,"last_cve_update":481},6626,"commons_fileupload","2023-02-20",{"id":483,"product_name":484,"version_count":485,"cve_count":21,"kev_count":61,"last_cve_update":486},6684,"hbase",116,"2019-08-26",{"id":488,"product_name":489,"version_count":472,"cve_count":21,"kev_count":61,"last_cve_update":490},6917,"wss4j","2021-03-10",{"id":492,"product_name":493,"version_count":115,"cve_count":21,"kev_count":61,"last_cve_update":494},6571,"apache-airflow-providers-apache-hive","2023-07-13",{"id":496,"product_name":497,"version_count":498,"cve_count":21,"kev_count":61,"last_cve_update":499},6778,"myfaces",99,"2021-02-19",{"id":501,"product_name":502,"version_count":316,"cve_count":503,"kev_count":61,"last_cve_update":504},6771,"mod_fcgid",4,"2019-12-03",{"id":506,"product_name":507,"version_count":158,"cve_count":503,"kev_count":61,"last_cve_update":508},6876,"streampipes","2024-07-17",{"id":510,"product_name":511,"version_count":42,"cve_count":503,"kev_count":61,"last_cve_update":512},6798,"openoffice.org","2012-06-21",{"id":514,"product_name":515,"version_count":137,"cve_count":503,"kev_count":61,"last_cve_update":55},6611,"brpc",{"id":517,"product_name":518,"version_count":59,"cve_count":503,"kev_count":61,"last_cve_update":87},6836,"seata",{"id":520,"product_name":521,"version_count":237,"cve_count":503,"kev_count":61,"last_cve_update":522},6853,"sling_cms","2023-02-04",{"id":524,"product_name":525,"version_count":132,"cve_count":503,"kev_count":61,"last_cve_update":526},6624,"commons_configuration","2024-03-21",{"id":528,"product_name":529,"version_count":115,"cve_count":503,"kev_count":49,"last_cve_update":530},6831,"rocketmq","2024-07-22",{"id":532,"product_name":533,"version_count":201,"cve_count":503,"kev_count":61,"last_cve_update":534},6791,"oozie","2025-03-22",{"id":536,"product_name":537,"version_count":385,"cve_count":503,"kev_count":61,"last_cve_update":538},6790,"olingo","2020-01-09",{"id":540,"product_name":541,"version_count":97,"cve_count":503,"kev_count":61,"last_cve_update":542},6871,"sshd","2023-12-18",{"id":544,"product_name":545,"version_count":42,"cve_count":503,"kev_count":61,"last_cve_update":546},6781,"netbeans","2020-09-09",{"id":548,"product_name":549,"version_count":550,"cve_count":503,"kev_count":61,"last_cve_update":551},6787,"nuttx",157,"2021-06-21",{"id":553,"product_name":554,"version_count":248,"cve_count":503,"kev_count":61,"last_cve_update":555},6618,"cocoon","2023-11-30",{"id":557,"product_name":558,"version_count":108,"cve_count":503,"kev_count":49,"last_cve_update":110},6620,"commons_beanutils",{"id":560,"product_name":561,"version_count":35,"cve_count":503,"kev_count":61,"last_cve_update":562},6880,"submarine","2024-06-12",{"id":564,"product_name":565,"version_count":566,"cve_count":503,"kev_count":61,"last_cve_update":567},6566,"ant",51,"2021-07-14",{"id":569,"product_name":570,"version_count":109,"cve_count":503,"kev_count":61,"last_cve_update":571},6723,"james_server","2025-02-06",{"id":573,"product_name":574,"version_count":158,"cve_count":503,"kev_count":61,"last_cve_update":575},6567,"any23","2023-07-05",{"id":577,"product_name":578,"version_count":316,"cve_count":68,"kev_count":61,"last_cve_update":579},6610,"brooklyn","2017-09-13",{"id":581,"product_name":582,"version_count":158,"cve_count":68,"kev_count":61,"last_cve_update":583},6750,"libapreq2","2022-08-25",{"id":585,"product_name":586,"version_count":352,"cve_count":68,"kev_count":61,"last_cve_update":587},6751,"libcloud","2014-01-07",{"id":589,"product_name":590,"version_count":42,"cve_count":68,"kev_count":61,"last_cve_update":591},6754,"log4cxx","2025-08-22",{"id":593,"product_name":594,"version_count":68,"cve_count":68,"kev_count":61,"last_cve_update":595},6920,"xerces2_java","2017-10-30",{"id":597,"product_name":598,"version_count":207,"cve_count":68,"kev_count":61,"last_cve_update":599},6894,"tomcat_jk_connector","2018-10-31",{"id":601,"product_name":602,"version_count":376,"cve_count":68,"kev_count":49,"last_cve_update":603},6667,"flink","2021-01-05",{"id":605,"product_name":606,"version_count":607,"cve_count":68,"kev_count":61,"last_cve_update":608},6766,"mina",71,"2024-12-25",{"id":610,"product_name":611,"version_count":334,"cve_count":68,"kev_count":61,"last_cve_update":612},6906,"unomi","2021-05-04",{"id":614,"product_name":615,"version_count":503,"cve_count":68,"kev_count":61,"last_cve_update":616},6670,"flume","2022-10-26",{"id":618,"product_name":619,"version_count":216,"cve_count":68,"kev_count":61,"last_cve_update":620},6904,"uimaj","2023-11-08",{"id":622,"product_name":623,"version_count":624,"cve_count":68,"kev_count":61,"last_cve_update":625},6775,"mod_perl",35,"2018-08-26",{"id":627,"product_name":628,"version_count":41,"cve_count":68,"kev_count":61,"last_cve_update":629},6896,"tomcat_native","2018-07-31",{"id":631,"product_name":632,"version_count":385,"cve_count":68,"kev_count":61,"last_cve_update":633},6715,"ivy","2023-08-21",{"id":635,"product_name":636,"version_count":181,"cve_count":68,"kev_count":61,"last_cve_update":637},6678,"groovy","2020-12-07",{"id":639,"product_name":640,"version_count":281,"cve_count":68,"kev_count":61,"last_cve_update":641},6847,"skywalking","2022-07-18",{"id":643,"product_name":644,"version_count":157,"cve_count":68,"kev_count":61,"last_cve_update":431},6810,"pinot",{"id":646,"product_name":647,"version_count":248,"cve_count":68,"kev_count":61,"last_cve_update":648},6814,"pony_mail","2019-04-22",{"id":650,"product_name":651,"version_count":207,"cve_count":68,"kev_count":61,"last_cve_update":652},6574,"apache-airflow-providers-apache-spark","2023-08-17",{"id":654,"product_name":655,"version_count":196,"cve_count":68,"kev_count":61,"last_cve_update":656},6654,"doris","2025-02-04",{"id":658,"product_name":659,"version_count":316,"cve_count":68,"kev_count":61,"last_cve_update":660},6840,"shardingsphere","2023-07-19",{"id":662,"product_name":663,"version_count":385,"cve_count":68,"kev_count":61,"last_cve_update":664},6839,"servicecomb","2024-01-31",{"id":666,"product_name":667,"version_count":668,"cve_count":68,"kev_count":61,"last_cve_update":669},6686,"heron",111,"2022-10-24",{"id":671,"product_name":672,"version_count":237,"cve_count":68,"kev_count":61,"last_cve_update":673},6912,"virtual_computing_lab","2019-07-29",{"id":675,"product_name":676,"version_count":503,"cve_count":35,"kev_count":61,"last_cve_update":677},6786,"nutch","2021-01-25",{"id":679,"product_name":680,"version_count":132,"cve_count":35,"kev_count":61,"last_cve_update":681},6761,"maven","2021-04-23",{"id":683,"product_name":684,"version_count":35,"cve_count":35,"kev_count":61,"last_cve_update":685},6616,"chainsaw","2022-01-18",{"id":687,"product_name":688,"version_count":227,"cve_count":35,"kev_count":61,"last_cve_update":689},6919,"xalan-java","2022-07-19",{"id":691,"product_name":692,"version_count":334,"cve_count":35,"kev_count":61,"last_cve_update":693},6756,"log4net","2020-05-11",{"id":695,"product_name":696,"version_count":115,"cve_count":35,"kev_count":61,"last_cve_update":595},6641,"cordova_file_transfer",{"id":698,"product_name":699,"version_count":49,"cve_count":35,"kev_count":61,"last_cve_update":700},6861,"sling_servlets_post","2017-08-14",{"id":702,"product_name":703,"version_count":126,"cve_count":35,"kev_count":61,"last_cve_update":704},6714,"isis","2022-10-19",{"id":706,"product_name":707,"version_count":103,"cve_count":35,"kev_count":61,"last_cve_update":708},6579,"apache-airflow-providers-google","2023-02-24",{"id":710,"product_name":711,"version_count":109,"cve_count":35,"kev_count":61,"last_cve_update":712},6612,"calcite","2022-09-11",{"id":714,"product_name":715,"version_count":366,"cve_count":35,"kev_count":61,"last_cve_update":716},6584,"apache-airflow-providers-mysql","2025-03-19",{"id":718,"product_name":719,"version_count":720,"cve_count":35,"kev_count":61,"last_cve_update":721},6850,"sling_api",38,"2022-06-22",{"id":723,"product_name":724,"version_count":42,"cve_count":35,"kev_count":61,"last_cve_update":725},6625,"commons_email","2018-03-20",{"id":727,"product_name":728,"version_count":125,"cve_count":35,"kev_count":61,"last_cve_update":729},6608,"beam","2020-10-23",{"id":731,"product_name":732,"version_count":334,"cve_count":35,"kev_count":61,"last_cve_update":733},6800,"openwhisk","2018-07-23",{"id":735,"product_name":736,"version_count":182,"cve_count":35,"kev_count":61,"last_cve_update":737},6585,"apache-airflow-providers-odbc","2023-06-27",{"id":739,"product_name":740,"version_count":49,"cve_count":35,"kev_count":61,"last_cve_update":741},6677,"gobblin","2022-02-04",{"id":743,"product_name":744,"version_count":503,"cve_count":35,"kev_count":61,"last_cve_update":745},6803,"org.apache.sling.servlets.post","2013-10-17",{"id":747,"product_name":748,"version_count":196,"cve_count":35,"kev_count":61,"last_cve_update":133},6577,"apache-airflow-providers-fab",{"id":750,"product_name":751,"version_count":68,"cve_count":35,"kev_count":61,"last_cve_update":752},6895,"tomcat_jk_web_server_connector","2007-05-25",{"id":754,"product_name":755,"version_count":566,"cve_count":35,"kev_count":61,"last_cve_update":116},6806,"parquet_java",{"id":757,"product_name":758,"version_count":207,"cve_count":35,"kev_count":61,"last_cve_update":759},6570,"apache-airflow-providers-apache-drill","2023-08-11",{"id":761,"product_name":762,"version_count":35,"cve_count":35,"kev_count":61,"last_cve_update":763},6651,"directory_ldap_api","2018-07-10",{"id":765,"product_name":766,"version_count":54,"cve_count":35,"kev_count":61,"last_cve_update":767},6600,"arrow","2019-11-08",{"id":769,"product_name":770,"version_count":86,"cve_count":35,"kev_count":61,"last_cve_update":771},6893,"tomcat_connectors","2023-09-13",{"id":773,"product_name":774,"version_count":207,"cve_count":35,"kev_count":61,"last_cve_update":775},6652,"directory_studio","2021-07-26",{"id":777,"product_name":778,"version_count":222,"cve_count":35,"kev_count":61,"last_cve_update":143},6658,"eventmesh",{"id":780,"product_name":781,"version_count":316,"cve_count":35,"kev_count":61,"last_cve_update":782},6744,"knox","2022-01-17",{"id":784,"product_name":785,"version_count":248,"cve_count":35,"kev_count":61,"last_cve_update":786},6597,"apisix_dashboard","2021-12-27",{"id":788,"product_name":789,"version_count":316,"cve_count":35,"kev_count":61,"last_cve_update":790},6927,"xml-rpc","2020-01-23",{"id":792,"product_name":793,"version_count":472,"cve_count":35,"kev_count":61,"last_cve_update":794},6816,"portable_runtime_utility","2023-01-31",{"id":796,"product_name":797,"version_count":248,"cve_count":35,"kev_count":61,"last_cve_update":798},6615,"cayenne","2022-02-11",{"id":800,"product_name":801,"version_count":267,"cve_count":35,"kev_count":61,"last_cve_update":802},6838,"sentry","2018-08-23",{"id":804,"product_name":805,"version_count":61,"cve_count":35,"kev_count":61,"last_cve_update":806},6925,"xml_graphics_batik","2023-08-22",{"id":808,"product_name":809,"version_count":42,"cve_count":35,"kev_count":61,"last_cve_update":810},6883,"synapse","2017-12-11",{"id":812,"product_name":813,"version_count":68,"cve_count":35,"kev_count":61,"last_cve_update":555},6890,"tiles",{"id":815,"product_name":816,"version_count":28,"cve_count":35,"kev_count":61,"last_cve_update":817},6822,"qpid-cpp","2019-12-13",{"id":819,"product_name":820,"version_count":316,"cve_count":35,"kev_count":61,"last_cve_update":821},6552,"airflow_cncf_kubernetes","2024-01-24",{"id":823,"product_name":824,"version_count":720,"cve_count":35,"kev_count":61,"last_cve_update":825},6541,"accumulo","2023-06-21",{"id":827,"product_name":828,"version_count":97,"cve_count":35,"kev_count":61,"last_cve_update":829},6923,"xerces-j","2022-01-24",{"id":831,"product_name":832,"version_count":833,"cve_count":35,"kev_count":61,"last_cve_update":834},6767,"mina_sshd",45,"2024-08-12",{"id":836,"product_name":837,"version_count":253,"cve_count":35,"kev_count":61,"last_cve_update":838},6774,"mod_jk","2009-04-09",{"id":840,"product_name":841,"version_count":316,"cve_count":35,"kev_count":61,"last_cve_update":842},6826,"qpid_proton","2017-05-02",{"id":844,"product_name":845,"version_count":222,"cve_count":35,"kev_count":61,"last_cve_update":846},6902,"uimaducc","2019-05-01",{"id":848,"product_name":849,"version_count":132,"cve_count":35,"kev_count":61,"last_cve_update":850},6777,"mxnet","2022-07-24",{"id":852,"product_name":853,"version_count":49,"cve_count":35,"kev_count":61,"last_cve_update":854},6918,"ws-xmlrpc","2017-10-27",{"id":856,"product_name":857,"version_count":503,"cve_count":35,"kev_count":61,"last_cve_update":858},6685,"helix","2023-07-26",{"id":860,"product_name":861,"version_count":503,"cve_count":35,"kev_count":61,"last_cve_update":862},6632,"commons_jxpath","2022-10-06",{"id":864,"product_name":865,"version_count":49,"cve_count":35,"kev_count":61,"last_cve_update":866},6628,"commons_imaging","2019-05-06",{"id":868,"product_name":869,"version_count":196,"cve_count":35,"kev_count":61,"last_cve_update":870},6649,"deltaspike","2020-03-19",{"id":872,"product_name":873,"version_count":222,"cve_count":35,"kev_count":61,"last_cve_update":874},6783,"nifi_minifi_c\\+\\+","2023-09-03",{"id":876,"product_name":877,"version_count":35,"cve_count":35,"kev_count":61,"last_cve_update":878},6784,"nifi_registry","2022-06-15",{"id":880,"product_name":881,"version_count":68,"cve_count":35,"kev_count":61,"last_cve_update":882},6865,"soap","2022-11-14",{"id":884,"product_name":885,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":886},6819,"pyarrow","2023-11-09",{"id":888,"product_name":889,"version_count":132,"cve_count":49,"kev_count":61,"last_cve_update":890},6635,"commons_net","2022-12-03",{"id":892,"product_name":893,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":894},6636,"commons_ognl","2025-08-18",{"id":896,"product_name":897,"version_count":237,"cve_count":49,"kev_count":61,"last_cve_update":898},6637,"commons_text","2022-10-13",{"id":900,"product_name":901,"version_count":248,"cve_count":49,"kev_count":61,"last_cve_update":902},6638,"commons_vfs","2025-03-23",{"id":904,"product_name":905,"version_count":152,"cve_count":49,"kev_count":61,"last_cve_update":906},6639,"continuum","2011-02-17",{"id":908,"product_name":909,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":595},6642,"cordova_in-app-browser",{"id":911,"product_name":912,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":913},6643,"cordova_inappbrowser","2020-01-14",{"id":915,"product_name":916,"version_count":248,"cve_count":49,"kev_count":61,"last_cve_update":917},6619,"commons_bcel","2022-11-07",{"id":919,"product_name":920,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":921},6648,"ddlutils","2021-09-30",{"id":923,"product_name":924,"version_count":42,"cve_count":49,"kev_count":61,"last_cve_update":381},6546,"activemq_nms_amqp",{"id":926,"product_name":927,"version_count":21,"cve_count":49,"kev_count":61,"last_cve_update":928},6661,"felix_health_check_webconsole_plugin","2023-07-25",{"id":930,"product_name":931,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":932},6665,"flex","2015-04-08",{"id":934,"product_name":935,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":936},6666,"flex_blazeds","2017-12-28",{"id":938,"product_name":939,"version_count":316,"cve_count":49,"kev_count":61,"last_cve_update":940},6669,"flink_stateful_functions","2023-09-19",{"id":942,"product_name":943,"version_count":227,"cve_count":49,"kev_count":61,"last_cve_update":944},6671,"formatting_objects_processor","2017-04-18",{"id":946,"product_name":947,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":948},6672,"fortress","2020-08-11",{"id":950,"product_name":951,"version_count":216,"cve_count":49,"kev_count":61,"last_cve_update":952},6673,"fory","2025-09-15",{"id":954,"product_name":955,"version_count":35,"cve_count":49,"kev_count":61,"last_cve_update":956},6679,"groovy_ldap","2017-01-18",{"id":958,"product_name":959,"version_count":158,"cve_count":49,"kev_count":49,"last_cve_update":960},6603,"aurora","2016-06-07",{"id":962,"product_name":963,"version_count":334,"cve_count":49,"kev_count":61,"last_cve_update":964},6601,"asterixdb","2021-03-01",{"id":966,"product_name":967,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":968},6682,"hama","2022-11-21",{"id":970,"product_name":971,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":972},6683,"harmony","2014-04-29",{"id":974,"product_name":975,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":976},6690,"html\\\u002Fjava_api","2021-01-11",{"id":978,"product_name":979,"version_count":68,"cve_count":49,"kev_count":61,"last_cve_update":980},6691,"httpasyncclient","2014-08-21",{"id":982,"product_name":983,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":984},6595,"apache_webserver","2008-06-16",{"id":986,"product_name":987,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6694,"http_server2.0a1","2011-11-30",{"id":990,"product_name":991,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6695,"http_server2.0a2",{"id":993,"product_name":994,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6696,"http_server2.0a3",{"id":996,"product_name":997,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6697,"http_server2.0a4",{"id":999,"product_name":1000,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6698,"http_server2.0a5",{"id":1002,"product_name":1003,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6699,"http_server2.0a6",{"id":1005,"product_name":1006,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6700,"http_server2.0a7",{"id":1008,"product_name":1009,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6701,"http_server2.0a8",{"id":1011,"product_name":1012,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":988},6702,"http_server2.0a9",{"id":1014,"product_name":1015,"version_count":21,"cve_count":49,"kev_count":49,"last_cve_update":1016},6703,"hugegraph","2024-04-22",{"id":1018,"product_name":1019,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1020},6705,"hupa","2018-02-27",{"id":1022,"product_name":1023,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":481},6706,"identity_backend",{"id":1025,"product_name":1026,"version_count":86,"cve_count":49,"kev_count":61,"last_cve_update":1027},6592,"apache_sling_engine","2023-04-13",{"id":1029,"product_name":1030,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1031},6591,"apache_http_server","2010-04-20",{"id":1033,"product_name":1034,"version_count":35,"cve_count":49,"kev_count":61,"last_cve_update":1035},6712,"iotdb_web_workbench","2023-04-17",{"id":1037,"product_name":1038,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1039},6713,"iotdb_workbench","2024-08-05",{"id":1041,"product_name":1042,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1043},6924,"xmlbeans","2021-01-14",{"id":1045,"product_name":1046,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":440},6717,"jackrabbit_jcr_commons",{"id":1048,"product_name":1049,"version_count":1050,"cve_count":49,"kev_count":61,"last_cve_update":1051},6718,"jackrabbit_oak",283,"2020-01-28",{"id":1053,"product_name":1054,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1055},6720,"jakarta_slide","2007-10-30",{"id":1057,"product_name":1058,"version_count":503,"cve_count":49,"kev_count":61,"last_cve_update":1059},6590,"apache_commons_daemon","2011-08-15",{"id":1061,"product_name":1062,"version_count":108,"cve_count":49,"kev_count":61,"last_cve_update":238},6722,"james_mime4j",{"id":1064,"product_name":1065,"version_count":720,"cve_count":49,"kev_count":61,"last_cve_update":677},6724,"java_chassis",{"id":1067,"product_name":1068,"version_count":125,"cve_count":49,"kev_count":61,"last_cve_update":1069},6725,"jclouds","2020-02-18",{"id":1071,"product_name":1072,"version_count":68,"cve_count":49,"kev_count":61,"last_cve_update":1073},6727,"jena_fuseki","2021-07-05",{"id":1075,"product_name":1076,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":882},6728,"jena_sdb",{"id":1078,"product_name":1079,"version_count":227,"cve_count":49,"kev_count":61,"last_cve_update":1080},6926,"xmlgraphics_commons","2021-02-24",{"id":1082,"product_name":1083,"version_count":207,"cve_count":49,"kev_count":61,"last_cve_update":1084},6589,"apache_calcite_avatica","2022-07-28",{"id":1086,"product_name":1087,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1088},6731,"jms_client_amqp","2016-07-13",{"id":1090,"product_name":1091,"version_count":125,"cve_count":49,"kev_count":61,"last_cve_update":1092},6732,"johnzon","2023-07-07",{"id":1094,"product_name":1095,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1096},6733,"jserv","2011-10-05",{"id":1098,"product_name":1099,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1100},6588,"apache_axis2\\\u002Fc","2014-09-29",{"id":1102,"product_name":1103,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1104},6737,"kafka_connect","2023-02-07",{"id":1106,"product_name":1107,"version_count":28,"cve_count":49,"kev_count":61,"last_cve_update":1108},6586,"apache-airflow-providers-smtp","2023-08-23",{"id":1110,"product_name":1111,"version_count":115,"cve_count":49,"kev_count":61,"last_cve_update":1112},6745,"kudu","2021-03-09",{"id":1114,"product_name":1115,"version_count":503,"cve_count":49,"kev_count":61,"last_cve_update":1116},6749,"ldap_studio","2016-04-11",{"id":1118,"product_name":1119,"version_count":316,"cve_count":49,"kev_count":61,"last_cve_update":1120},6753,"livy","2021-02-20",{"id":1122,"product_name":1123,"version_count":1124,"cve_count":49,"kev_count":61,"last_cve_update":1125},6583,"apache-airflow-providers-mongo",30,"2024-02-20",{"id":1127,"product_name":1128,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1129},6758,"lucene.net","2024-10-31",{"id":1131,"product_name":1132,"version_count":33,"cve_count":49,"kev_count":61,"last_cve_update":1133},6759,"lucene_replicator","2024-09-30",{"id":1135,"product_name":1136,"version_count":413,"cve_count":49,"kev_count":61,"last_cve_update":1137},6760,"manifoldcf","2022-12-07",{"id":1139,"product_name":1140,"version_count":35,"cve_count":49,"kev_count":61,"last_cve_update":1141},6762,"maven_archetype","2024-09-26",{"id":1143,"product_name":1144,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1145},6763,"maven_shared_utils","2022-05-23",{"id":1147,"product_name":1148,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1149},6764,"maven_wagon","2013-04-09",{"id":1151,"product_name":1152,"version_count":108,"cve_count":49,"kev_count":61,"last_cve_update":737},6582,"apache-airflow-providers-microsoft-mssql",{"id":1154,"product_name":1155,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1156},6768,"mod_auth_radius","2005-01-11",{"id":1158,"product_name":1159,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1160},6769,"mod_dav_svn","2013-12-07",{"id":1162,"product_name":1163,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1160},6770,"mod_dontdothat",{"id":1165,"product_name":1166,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1167},6772,"mod-gnutls","2015-03-13",{"id":1169,"product_name":1170,"version_count":334,"cve_count":49,"kev_count":61,"last_cve_update":854},6543,"activemq_apollo",{"id":1172,"product_name":1173,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1174},6779,"myfaces_tomahawk","2007-06-18",{"id":1176,"product_name":1177,"version_count":131,"cve_count":49,"kev_count":61,"last_cve_update":1178},6780,"myfaces_trinidad","2016-10-03",{"id":1180,"product_name":1181,"version_count":196,"cve_count":49,"kev_count":61,"last_cve_update":1182},6581,"apache-airflow-providers-jdbc","2023-06-29",{"id":1184,"product_name":1185,"version_count":503,"cve_count":49,"kev_count":61,"last_cve_update":1186},6788,"ode","2018-03-05",{"id":1188,"product_name":1189,"version_count":201,"cve_count":49,"kev_count":61,"last_cve_update":1108},6580,"apache-airflow-providers-imap",{"id":1191,"product_name":1192,"version_count":222,"cve_count":49,"kev_count":61,"last_cve_update":304},6793,"openjpa",{"id":1194,"product_name":1195,"version_count":316,"cve_count":49,"kev_count":61,"last_cve_update":1196},6795,"opennlp","2017-10-03",{"id":1198,"product_name":1199,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1200},6799,"opentaps","2006-12-15",{"id":1202,"product_name":1203,"version_count":163,"cve_count":49,"kev_count":61,"last_cve_update":1204},6801,"orc","2018-05-18",{"id":1206,"product_name":1207,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1208},6802,"orchestration_director_engine","2010-06-22",{"id":1210,"product_name":1211,"version_count":267,"cve_count":49,"kev_count":61,"last_cve_update":1212},6805,"parquet","2025-05-06",{"id":1214,"product_name":1215,"version_count":131,"cve_count":49,"kev_count":61,"last_cve_update":1216},6807,"parquet-mr","2021-12-20",{"id":1218,"product_name":1219,"version_count":132,"cve_count":49,"kev_count":61,"last_cve_update":1220},6576,"apache-airflow-providers-docker","2022-08-16",{"id":1222,"product_name":1223,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1224},6811,"plc4x","2021-12-19",{"id":1226,"product_name":1227,"version_count":267,"cve_count":49,"kev_count":61,"last_cve_update":708},6575,"apache-airflow-providers-apache-sqoop",{"id":1229,"product_name":1230,"version_count":248,"cve_count":49,"kev_count":61,"last_cve_update":1231},6573,"apache-airflow-providers-apache-pinot","2022-11-22",{"id":1233,"product_name":1234,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1235},6818,"pulsar_manager","2020-12-18",{"id":1237,"product_name":1238,"version_count":206,"cve_count":49,"kev_count":61,"last_cve_update":1239},6633,"commons_lang","2025-07-11",{"id":1241,"product_name":1242,"version_count":334,"cve_count":49,"kev_count":61,"last_cve_update":1231},6572,"apache-airflow-providers-apache-pig",{"id":1244,"product_name":1245,"version_count":206,"cve_count":49,"kev_count":61,"last_cve_update":1246},6823,"qpid_dispatch","2018-02-13",{"id":1248,"product_name":1249,"version_count":59,"cve_count":49,"kev_count":61,"last_cve_update":1250},6827,"qpid_proton-j","2018-11-13",{"id":1252,"product_name":1253,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1254},6828,"rampart\\\u002Fc","2011-06-02",{"id":1256,"product_name":1257,"version_count":316,"cve_count":49,"kev_count":61,"last_cve_update":1258},6830,"rave","2013-03-14",{"id":1260,"product_name":1261,"version_count":371,"cve_count":49,"kev_count":61,"last_cve_update":708},6569,"apache-airflow-providers-amazon",{"id":1263,"product_name":1264,"version_count":222,"cve_count":49,"kev_count":61,"last_cve_update":1265},6833,"rust_sgx_sdk","2020-01-04",{"id":1267,"product_name":1268,"version_count":339,"cve_count":49,"kev_count":61,"last_cve_update":1269},6837,"seatunnel","2024-08-21",{"id":1271,"product_name":1272,"version_count":68,"cve_count":49,"kev_count":61,"last_cve_update":1273},6841,"shardingsphere_elasticjob-ui","2022-01-20",{"id":1275,"product_name":1276,"version_count":68,"cve_count":49,"kev_count":61,"last_cve_update":1277},6842,"shardingsphere-ui","2021-11-11",{"id":1279,"product_name":8,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1280},6568,"2009-03-03",{"id":1282,"product_name":1283,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1284},6844,"shindig","2013-10-24",{"id":1286,"product_name":1287,"version_count":385,"cve_count":49,"kev_count":49,"last_cve_update":1288},6545,"activemq_legacy_openwire_module","2023-10-27",{"id":1290,"product_name":1291,"version_count":21,"cve_count":49,"kev_count":61,"last_cve_update":1284},6851,"sling_auth_core_component",{"id":1293,"product_name":1294,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1295},6852,"sling_authentication_service","2017-12-18",{"id":1297,"product_name":1298,"version_count":334,"cve_count":49,"kev_count":61,"last_cve_update":1299},6854,"sling_commons_json","2023-05-15",{"id":1301,"product_name":1302,"version_count":152,"cve_count":49,"kev_count":61,"last_cve_update":721},6855,"sling_commons_log",{"id":1304,"product_name":1305,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1306},6856,"sling_commons_messaging_mail","2021-12-14",{"id":1308,"product_name":1309,"version_count":253,"cve_count":49,"kev_count":61,"last_cve_update":1310},6857,"sling_i18n","2023-02-23",{"id":1312,"product_name":1313,"version_count":108,"cve_count":49,"kev_count":61,"last_cve_update":1314},6858,"sling_jcr_base","2023-02-14",{"id":1316,"product_name":1317,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1318},6859,"sling_jcr_contentloader","2018-01-09",{"id":1320,"product_name":1321,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1322},6860,"sling_resource_merger","2023-03-20",{"id":1324,"product_name":1325,"version_count":566,"cve_count":49,"kev_count":61,"last_cve_update":1326},6862,"sling_servlets_resolver","2024-02-06",{"id":1328,"product_name":1329,"version_count":1124,"cve_count":49,"kev_count":61,"last_cve_update":1330},6863,"sling_xss_protection_api","2018-01-10",{"id":1332,"product_name":1333,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1330},6864,"sling_xss_protection_api_compat",{"id":1335,"product_name":1336,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1088},6563,"amqp_0-x_jms_client",{"id":1338,"product_name":1339,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":542},6872,"sshj",{"id":1341,"product_name":1342,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1343},6873,"standard_taglibs","2015-03-09",{"id":1345,"product_name":1346,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1347},6560,"airflow_sqoop_provider","2023-08-28",{"id":1349,"product_name":1350,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1347},6559,"airflow_spark_provider",{"id":1352,"product_name":1353,"version_count":35,"cve_count":49,"kev_count":61,"last_cve_update":1354},6878,"struts2-showcase","2013-07-10",{"id":1356,"product_name":1357,"version_count":68,"cve_count":49,"kev_count":61,"last_cve_update":1358},6879,"struts_extras","2025-07-30",{"id":1360,"product_name":1361,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1362},6885,"systemds","2022-06-27",{"id":1364,"product_name":1365,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1366},6555,"airflow_hive_provider","2023-04-07",{"id":1368,"product_name":1369,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":567},6887,"teaclave_sgx_sdk",{"id":1371,"product_name":1372,"version_count":201,"cve_count":49,"kev_count":61,"last_cve_update":1373},6554,"airflow_hdfs_provider","2023-09-14",{"id":1375,"product_name":1376,"version_count":86,"cve_count":49,"kev_count":61,"last_cve_update":1377},6553,"airflow_common_sql_provider","2025-04-07",{"id":1379,"product_name":1380,"version_count":35,"cve_count":49,"kev_count":61,"last_cve_update":1381},6551,"airflow_celery_provider","2023-10-28",{"id":1383,"product_name":1384,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1385},6549,"airavata_django_portal","2021-12-09",{"id":1387,"product_name":1388,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":522},6548,"age",{"id":1390,"product_name":1391,"version_count":61,"cve_count":49,"kev_count":61,"last_cve_update":1208},6900,"tuscany",{"id":1393,"product_name":1394,"version_count":334,"cve_count":49,"kev_count":61,"last_cve_update":1395},6901,"uima-as","2018-04-26",{"id":1397,"product_name":1398,"version_count":385,"cve_count":49,"kev_count":61,"last_cve_update":1395},6903,"uimafit",{"id":1400,"product_name":1401,"version_count":49,"cve_count":49,"kev_count":61,"last_cve_update":1402},6907,"unstructured_information_management_architecture","2023-03-30",{"id":1404,"product_name":1405,"version_count":267,"cve_count":49,"kev_count":61,"last_cve_update":1406},6909,"vcl","2018-02-21",{"id":1408,"product_name":1409,"version_count":316,"cve_count":49,"kev_count":61,"last_cve_update":490},6910,"velocity_engine",{"id":1411,"product_name":1412,"version_count":42,"cve_count":49,"kev_count":61,"last_cve_update":490},6911,"velocity_tools",{"id":1414,"product_name":1415,"version_count":334,"cve_count":49,"kev_count":61,"last_cve_update":1416},6916,"wink","2017-08-08",{"id":1418,"product_name":1419,"version_count":248,"cve_count":49,"kev_count":61,"last_cve_update":1420},6621,"commons_collections","2015-12-15",{"id":1422,"product_name":1423,"version_count":222,"cve_count":49,"kev_count":61,"last_cve_update":1424},6627,"commons-httpclient","2014-09-04",{"id":1426,"product_name":1427,"version_count":1124,"cve_count":49,"kev_count":61,"last_cve_update":1428},6629,"commons_io","2021-04-13",{"id":1430,"product_name":1431,"version_count":35,"cve_count":49,"kev_count":61,"last_cve_update":1432},6631,"commons_jelly","2017-09-28",{"id":1434,"product_name":1435,"version_count":334,"cve_count":61,"kev_count":61,"last_cve_update":1436},6557,"airflow_providers_fab",null,{"id":1438,"product_name":1439,"version_count":42,"cve_count":61,"kev_count":61,"last_cve_update":1436},6742,"kerby",{"id":1441,"product_name":1442,"version_count":34,"cve_count":61,"kev_count":61,"last_cve_update":1436},6556,"airflow_providers_amazon",{"id":1444,"product_name":1445,"version_count":248,"cve_count":61,"kev_count":61,"last_cve_update":1436},6689,"hop_engine",{"id":1447,"product_name":1448,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6913,"wagon-http",{"id":1450,"product_name":1451,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6914,"whisker",{"id":1453,"product_name":1454,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6834,"sanselan",{"id":1456,"product_name":1457,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6825,"qpid_java",{"id":1459,"product_name":1460,"version_count":35,"cve_count":61,"kev_count":61,"last_cve_update":1436},6824,"qpid_dispatch_firmware",{"id":1462,"product_name":1463,"version_count":216,"cve_count":61,"kev_count":61,"last_cve_update":1436},6547,"activemq_nms_openwire",{"id":1465,"product_name":1466,"version_count":35,"cve_count":61,"kev_count":61,"last_cve_update":1436},6645,"coyote_http_connector",{"id":1468,"product_name":1469,"version_count":227,"cve_count":61,"kev_count":61,"last_cve_update":1436},6741,"karaf_decanter",{"id":1471,"product_name":1472,"version_count":35,"cve_count":61,"kev_count":61,"last_cve_update":1436},6891,"tinkerpop",{"id":1474,"product_name":1475,"version_count":182,"cve_count":61,"kev_count":61,"last_cve_update":1436},6929,"xml_security_for_java",{"id":1477,"product_name":1478,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6846,"simple_object_access_protocol",{"id":1480,"product_name":1481,"version_count":503,"cve_count":61,"kev_count":61,"last_cve_update":1436},6809,"pekko_management",{"id":1483,"product_name":1484,"version_count":68,"cve_count":61,"kev_count":61,"last_cve_update":1436},6848,"skywalking_nodejs_agent",{"id":1486,"product_name":1487,"version_count":253,"cve_count":61,"kev_count":61,"last_cve_update":1436},6740,"karaf_cellar",{"id":1489,"product_name":1490,"version_count":206,"cve_count":61,"kev_count":61,"last_cve_update":1436},6578,"apache-airflow-providers-ftp",{"id":1492,"product_name":1493,"version_count":42,"cve_count":61,"kev_count":61,"last_cve_update":1436},6739,"karaf_cave",{"id":1495,"product_name":1496,"version_count":147,"cve_count":61,"kev_count":61,"last_cve_update":1436},6587,"apache-airflow-providers-snowflake",{"id":1498,"product_name":1499,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6796,"open_office",{"id":1501,"product_name":1502,"version_count":68,"cve_count":61,"kev_count":61,"last_cve_update":1436},6719,"jakarta_isapi_redirector",{"id":1504,"product_name":1505,"version_count":1506,"cve_count":61,"kev_count":61,"last_cve_update":1436},6709,"incubator_superset",90,{"id":1508,"product_name":1509,"version_count":1510,"cve_count":61,"kev_count":61,"last_cve_update":1436},6674,"freemarker",49,{"id":1512,"product_name":1513,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6668,"flink_cdc",{"id":1515,"product_name":1516,"version_count":54,"cve_count":61,"kev_count":61,"last_cve_update":1436},6663,"felix_webconsole",{"id":1518,"product_name":1519,"version_count":503,"cve_count":61,"kev_count":61,"last_cve_update":1436},6662,"felix_http_webconsole_plugin",{"id":1521,"product_name":1522,"version_count":108,"cve_count":61,"kev_count":61,"last_cve_update":1436},6622,"commons-compress",{"id":1524,"product_name":1525,"version_count":237,"cve_count":61,"kev_count":61,"last_cve_update":1436},6792,"open_for_business_project",{"id":1527,"product_name":1528,"version_count":28,"cve_count":61,"kev_count":61,"last_cve_update":1436},6593,"apache-ssl",{"id":1530,"product_name":1531,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6634,"commons_messaging_mail",{"id":1533,"product_name":1534,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6594,"apache_test",{"id":1536,"product_name":1537,"version_count":316,"cve_count":61,"kev_count":61,"last_cve_update":1436},6785,"nimble",{"id":1539,"product_name":1540,"version_count":61,"cve_count":61,"kev_count":61,"last_cve_update":1436},6773,"mod_imap",{"id":1542,"product_name":1543,"version_count":137,"cve_count":61,"kev_count":61,"last_cve_update":1436},6867,"solr_operator",{"id":1545,"product_name":1546,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6564,"amqp_jms_client",{"id":1548,"product_name":1549,"version_count":227,"cve_count":61,"kev_count":61,"last_cve_update":1436},6905,"uniffle",{"id":1551,"product_name":1552,"version_count":227,"cve_count":61,"kev_count":61,"last_cve_update":1436},6870,"spatial_information_system",{"id":1554,"product_name":1555,"version_count":1556,"cve_count":61,"kev_count":61,"last_cve_update":1436},6757,"lucene",150,{"id":1558,"product_name":1559,"version_count":21,"cve_count":61,"kev_count":61,"last_cve_update":1436},6704,"hugegraph-hubble",{"id":1561,"product_name":1562,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6660,"felix_health_checks",{"id":1564,"product_name":1565,"version_count":366,"cve_count":61,"kev_count":61,"last_cve_update":1436},6748,"kyuubi",{"id":1567,"product_name":1568,"version_count":222,"cve_count":61,"kev_count":61,"last_cve_update":1436},6908,"unstructured_information_management_architecture_distributed_uima_cluster_computing",{"id":1570,"product_name":1571,"version_count":1572,"cve_count":61,"kev_count":61,"last_cve_update":1436},6746,"kvrocks",74,{"id":1574,"product_name":1575,"version_count":503,"cve_count":61,"kev_count":61,"last_cve_update":1436},6659,"eventmesh-connector-rabbitmq",{"id":1577,"product_name":1578,"version_count":237,"cve_count":61,"kev_count":61,"last_cve_update":1436},6921,"xerces-c",{"id":1580,"product_name":1581,"version_count":49,"cve_count":61,"kev_count":61,"last_cve_update":1436},6630,"commons-jelly",{"id":1583,"product_name":1584,"version_count":42,"cve_count":61,"kev_count":61,"last_cve_update":1436},6743,"kerby_ldap_backend",{"id":1586,"product_name":1587,"version_count":60,"cve_count":61,"kev_count":61,"last_cve_update":1436},6558,"airflow_providers_http","Apache is a technology vendor with 391 tracked products and 2540 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[1590,1598,1603,1610,1617,1625,1630,1635,1641,1646],{"cveId":1591,"description":1592,"publishedDate":1593,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1597},"CVE-2017-5638","The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.","2017-03-11",9.8,"v3.1","Critical",0.99999,{"cveId":1599,"description":1600,"publishedDate":1601,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1602},"CVE-2013-2251","Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.","2013-07-20",0.99998,{"cveId":1604,"description":1605,"publishedDate":1606,"cvssScore":1607,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1609},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"High",0.99988,{"cveId":1611,"description":1612,"publishedDate":1613,"cvssScore":1594,"cvssVersion":1614,"severity":1596,"isKev":1615,"epssScore":1616},"CVE-2017-12635","Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.","2017-11-14","v3.0",false,0.99838,{"cveId":1618,"description":1619,"publishedDate":1620,"cvssScore":1621,"cvssVersion":1622,"severity":1623,"isKev":1615,"epssScore":1624},"CVE-2008-2938","Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.","2008-08-13",4.3,"v2","Medium",0.99708,{"cveId":1626,"description":1627,"publishedDate":1628,"cvssScore":21,"cvssVersion":1622,"severity":1623,"isKev":1615,"epssScore":1629},"CVE-2014-0094","The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to \"manipulate\" the ClassLoader via the class parameter, which is passed to the getClass method.","2014-03-11",0.99614,{"cveId":1631,"description":1632,"publishedDate":1633,"cvssScore":1607,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1634},"CVE-2017-12615","When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-09-19",0.99607,{"cveId":1636,"description":1637,"publishedDate":1638,"cvssScore":1639,"cvssVersion":1622,"severity":1608,"isKev":1615,"epssScore":1640},"CVE-2011-3192","The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.","2011-08-29",7.8,0.98945,{"cveId":1642,"description":1643,"publishedDate":1644,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1645},"CVE-2016-3088","The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.","2016-06-01",0.98518,{"cveId":1647,"description":1648,"publishedDate":972,"cvssScore":1649,"cvssVersion":1622,"severity":1608,"isKev":1615,"epssScore":1650},"CVE-2014-0112","ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.",7.5,0.98094,[1652,1662,1669,1677,1684,1691,1699,1706,1715,1722,1728,1736,1745,1752,1759,1767,1773,1780,1788,1791,1798,1801,1803,1811,1819,1822,1830,1837,1844,1851,1858,1865,1873,1879,1887,1894,1896,1902,1908,1915,1922,1929,1935],{"cveId":1653,"description":1654,"publishedDate":1655,"cvssScore":1656,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1657,"cisaVulnName":1658,"cisaDateAdded":1659,"cisaShortDescription":1660,"cisaRequiredAction":1661},"CVE-2024-38475","Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally\u002Fdirectly reachable by any URL, resulting in code execution or source code disclosure. \n\nSubstitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained.","2024-07-01",9.1,0.99957,"Apache HTTP Server Improper Escaping of Output Vulnerability","2025-05-01","Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally\u002Fdirectly reachable by any URL, resulting in code execution or source code disclosure.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":1663,"description":1664,"publishedDate":1665,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1666,"cisaVulnName":1667,"cisaDateAdded":116,"cisaShortDescription":1668,"cisaRequiredAction":1661},"CVE-2025-24813","Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and\u002For Information disclosure and\u002For malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and\u002For inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","2025-03-10",0.99945,"Apache Tomcat Path Equivalence Vulnerability","Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.",{"cveId":1670,"description":1671,"publishedDate":1672,"cvssScore":1649,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1673,"cisaVulnName":1674,"cisaDateAdded":656,"cisaShortDescription":1675,"cisaRequiredAction":1676},"CVE-2024-45195","Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 18.12.16.\n\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue.","2024-09-04",0.99983,"Apache OFBiz Forced Browsing Vulnerability","Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":1678,"description":1679,"publishedDate":1016,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1680,"cisaVulnName":1681,"cisaDateAdded":1682,"cisaShortDescription":1683,"cisaRequiredAction":1676},"CVE-2024-27348","RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11\n\nUsers are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.",0.9921,"Apache HugeGraph-Server Improper Access Control Vulnerability","2024-09-18","Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.",{"cveId":1685,"description":1686,"publishedDate":1039,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1687,"cisaVulnName":1688,"cisaDateAdded":1689,"cisaShortDescription":1690,"cisaRequiredAction":1676},"CVE-2024-38856","Incorrect Authorization vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: through 18.12.14.\n\nUsers are recommended to upgrade to version 18.12.15, which fixes the issue.\n\nUnauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).",0.99427,"Apache OFBiz Incorrect Authorization Vulnerability","2024-08-27","Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.",{"cveId":1692,"description":1693,"publishedDate":1694,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1695,"cisaVulnName":1696,"cisaDateAdded":1697,"cisaShortDescription":1698,"cisaRequiredAction":1676},"CVE-2024-32113","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.\n\nUsers are recommended to upgrade to version 18.12.13, which fixes the issue.","2024-05-08",0.99442,"Apache OFBiz Path Traversal Vulnerability","2024-08-07","Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.",{"cveId":1700,"description":1701,"publishedDate":603,"cvssScore":1649,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1702,"cisaVulnName":1703,"cisaDateAdded":1704,"cisaShortDescription":1705,"cisaRequiredAction":1676},"CVE-2020-17519","A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache\u002Fflink:master.",0.97856,"Apache Flink Improper Access Control Vulnerability","2024-05-23","Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.",{"cveId":1707,"description":1708,"publishedDate":1709,"cvssScore":1710,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1711,"cisaVulnName":1712,"cisaDateAdded":1713,"cisaShortDescription":1714,"cisaRequiredAction":1676},"CVE-2023-27524","Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003CYOUR_OWN_RANDOM_GENERATED_SECRET_KEY>\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.\n","2023-04-24",8.9,0.97405,"Apache Superset Insecure Default Initialization of Resource Vulnerability","2024-01-08","Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.",{"cveId":1716,"description":1717,"publishedDate":1288,"cvssScore":316,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1718,"cisaVulnName":1719,"cisaDateAdded":1720,"cisaShortDescription":1721,"cisaRequiredAction":1676},"CVE-2023-46604","The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the client or the broker (respectively) to \ninstantiate any class on the classpath.\n\nUsers are recommended to upgrade\n both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 \nwhich fixes this issue.",0.99654,"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","2023-11-02","Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.",{"cveId":1723,"description":1724,"publishedDate":1725,"cvssScore":1649,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1597,"cisaVulnName":1726,"cisaDateAdded":1725,"cisaShortDescription":1727,"cisaRequiredAction":1661},"CVE-2023-44487","The HTTP\u002F2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","2023-10-10","HTTP\u002F2 Rapid Reset Attack Vulnerability","HTTP\u002F2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).",{"cveId":1729,"description":1730,"publishedDate":1731,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1732,"cisaVulnName":1733,"cisaDateAdded":1734,"cisaShortDescription":1735,"cisaRequiredAction":1676},"CVE-2023-33246","For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. \n\nSeveral components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. \n\nTo prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .","2023-05-24",0.96604,"Apache RocketMQ Command Execution Vulnerability","2023-09-06","Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.",{"cveId":1737,"description":1738,"publishedDate":1739,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1740,"cisaVulnName":1741,"cisaDateAdded":1742,"cisaShortDescription":1743,"cisaRequiredAction":1744},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",0.90338,"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"cveId":1746,"description":1747,"publishedDate":1748,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1749,"cisaVulnName":1750,"cisaDateAdded":1742,"cisaShortDescription":1751,"cisaRequiredAction":1744},"CVE-2016-3427","Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","2016-04-21",0.92334,"Oracle Java SE and JRockit Unspecified Vulnerability","Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",{"cveId":1753,"description":1754,"publishedDate":1306,"cvssScore":334,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1755,"cisaVulnName":1756,"cisaDateAdded":1757,"cisaShortDescription":1758,"cisaRequiredAction":1744},"CVE-2021-45046","It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.",0.99977,"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","2023-05-01","Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.",{"cveId":1760,"description":1761,"publishedDate":641,"cvssScore":1762,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1763,"cisaVulnName":1764,"cisaDateAdded":1765,"cisaShortDescription":1766,"cisaRequiredAction":1744},"CVE-2022-33891","The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.",8.8,0.92984,"Apache Spark Command Injection Vulnerability","2023-03-07","Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.",{"cveId":1768,"description":1769,"publishedDate":798,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1770,"cisaVulnName":1771,"cisaDateAdded":583,"cisaShortDescription":1772,"cisaRequiredAction":1744},"CVE-2022-24112","An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.",0.96182,"Apache APISIX Authentication Bypass Vulnerability","Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.",{"cveId":1774,"description":1775,"publishedDate":1776,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1777,"cisaVulnName":1778,"cisaDateAdded":583,"cisaShortDescription":1779,"cisaRequiredAction":1744},"CVE-2022-24706","In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.","2022-04-26",0.92335,"Apache CouchDB Insecure Default Initialization of Resource Vulnerability","Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.",{"cveId":1781,"description":1782,"publishedDate":1783,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1784,"cisaVulnName":1785,"cisaDateAdded":1786,"cisaShortDescription":1787,"cisaRequiredAction":1744},"CVE-2018-1273","Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","2018-04-11",0.95649,"VMware Tanzu Spring Data Commons Property Binder Vulnerability","2022-03-25","Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.",{"cveId":1599,"description":1600,"publishedDate":1601,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1602,"cisaVulnName":1789,"cisaDateAdded":1786,"cisaShortDescription":1790,"cisaRequiredAction":1744},"Apache Struts Improper Input Validation Vulnerability","Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.",{"cveId":1792,"description":1793,"publishedDate":1794,"cvssScore":1762,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1795,"cisaVulnName":1796,"cisaDateAdded":1786,"cisaShortDescription":1797,"cisaRequiredAction":1744},"CVE-2020-1956","Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.","2020-05-22",0.9796,"Apache Kylin OS Command Injection Vulnerability","Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.",{"cveId":1631,"description":1632,"publishedDate":1633,"cvssScore":1607,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1634,"cisaVulnName":1799,"cisaDateAdded":1786,"cisaShortDescription":1800,"cisaRequiredAction":1744},"Apache Tomcat on Windows Remote Code Execution Vulnerability","When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":1604,"description":1605,"publishedDate":1606,"cvssScore":1607,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1609,"cisaVulnName":1741,"cisaDateAdded":1786,"cisaShortDescription":1802,"cisaRequiredAction":1744},"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":1804,"description":1805,"publishedDate":1806,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1807,"cisaVulnName":1808,"cisaDateAdded":1809,"cisaShortDescription":1810,"cisaRequiredAction":1744},"CVE-2020-1938","When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.","2020-02-24",0.9927,"Apache Tomcat Improper Privilege Management Vulnerability","2022-03-03","Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.",{"cveId":1812,"description":1813,"publishedDate":1814,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1815,"cisaVulnName":1816,"cisaDateAdded":1817,"cisaShortDescription":1818,"cisaRequiredAction":1744},"CVE-2017-9791","The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.","2017-07-10",0.98931,"Apache Struts 1 Improper Input Validation Vulnerability","2022-02-10","The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.",{"cveId":1642,"description":1643,"publishedDate":1644,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1645,"cisaVulnName":1820,"cisaDateAdded":1817,"cisaShortDescription":1821,"cisaRequiredAction":1744},"Apache ActiveMQ Improper Input Validation Vulnerability","The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request",{"cveId":1823,"description":1824,"publishedDate":1825,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1826,"cisaVulnName":1827,"cisaDateAdded":1828,"cisaShortDescription":1829,"cisaRequiredAction":1744},"CVE-2012-0391","The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.","2012-01-08",0.75071,"Apache Struts 2 Improper Input Validation Vulnerability","2022-01-21","The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.",{"cveId":1831,"description":1832,"publishedDate":1833,"cvssScore":1649,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1834,"cisaVulnName":1835,"cisaDateAdded":1828,"cisaShortDescription":1836,"cisaRequiredAction":1744},"CVE-2006-1547","ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart\u002Fform-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.","2006-03-30",0.54635,"Apache Struts 1 ActionForm Denial-of-Service Vulnerability","ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).",{"cveId":1838,"description":1839,"publishedDate":1840,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1841,"cisaVulnName":1842,"cisaDateAdded":685,"cisaShortDescription":1843,"cisaRequiredAction":1744},"CVE-2020-13927","The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https:\u002F\u002Fairflow.apache.org\u002Fdocs\u002F1.10.11\u002Fsecurity.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https:\u002F\u002Fgithub.com\u002Fapache\u002Fairflow\u002Fblob\u002F1.10.11\u002FUPDATING.md#experimental-api-will-deny-all-request-by-default","2020-11-10",0.997,"Apache Airflow's Experimental API Authentication Bypass","The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.",{"cveId":1845,"description":1846,"publishedDate":1847,"cvssScore":1762,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1848,"cisaVulnName":1849,"cisaDateAdded":685,"cisaShortDescription":1850,"cisaRequiredAction":1744},"CVE-2020-11978","An issue was found in Apache Airflow versions 1.10.10 and below. A remote code\u002Fcommand injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker\u002Fscheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.","2020-07-17",0.99118,"Apache Airflow Command Injection","A remote code\u002Fcommand injection vulnerability was discovered in one of the example DAGs shipped with Airflow.",{"cveId":1852,"description":1853,"publishedDate":197,"cvssScore":1854,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1855,"cisaVulnName":1856,"cisaDateAdded":685,"cisaShortDescription":1857,"cisaRequiredAction":1744},"CVE-2021-21315","The System Information Library for Node.JS (npm package \"systeminformation\") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.",7.1,0.9024,"System Information Library for Node.JS Command Injection","In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.",{"cveId":1859,"description":1860,"publishedDate":1861,"cvssScore":316,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1597,"cisaVulnName":1862,"cisaDateAdded":1861,"cisaShortDescription":1863,"cisaRequiredAction":1864},"CVE-2021-44228","Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.","2021-12-10","Apache Log4j2 Remote Code Execution Vulnerability","Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https:\u002F\u002Fwww.cisa.gov\u002Fuscert\u002Fed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.",{"cveId":1866,"description":1867,"publishedDate":1868,"cvssScore":1869,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1870,"cisaVulnName":1871,"cisaDateAdded":1861,"cisaShortDescription":1872,"cisaRequiredAction":1744},"CVE-2019-0193","In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging \u002F development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property \"enable.dih.dataConfigParam\" to true.","2019-08-01",7.2,0.83547,"Apache Solr DataImportHandler Code Injection Vulnerability","The optional Apache Solr module DataImportHandler contains a code injection vulnerability.",{"cveId":1874,"description":1875,"publishedDate":1876,"cvssScore":334,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1597,"cisaVulnName":1877,"cisaDateAdded":1878,"cisaShortDescription":1875,"cisaRequiredAction":1744},"CVE-2021-40438","A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","2021-09-16","Apache HTTP Server-Side Request Forgery (SSRF)","2021-12-01",{"cveId":1880,"description":1881,"publishedDate":1882,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1883,"cisaVulnName":1884,"cisaDateAdded":1885,"cisaShortDescription":1886,"cisaRequiredAction":1744},"CVE-2021-42013","It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.","2021-10-07",0.99964,"Apache HTTP Server Path Traversal Vulnerability","2021-11-03","Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.",{"cveId":1888,"description":1889,"publishedDate":1890,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1891,"cisaVulnName":1892,"cisaDateAdded":1885,"cisaShortDescription":1893,"cisaRequiredAction":1744},"CVE-2020-17530","Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.","2020-12-11",0.95922,"Apache Struts Remote Code Execution Vulnerability","Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.",{"cveId":1591,"description":1592,"publishedDate":1593,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1597,"cisaVulnName":1892,"cisaDateAdded":1885,"cisaShortDescription":1895,"cisaRequiredAction":1744},"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.",{"cveId":1897,"description":1898,"publishedDate":960,"cvssScore":1594,"cvssVersion":1595,"severity":1596,"isKev":4,"epssScore":1899,"cisaVulnName":1900,"cisaDateAdded":1885,"cisaShortDescription":1901,"cisaRequiredAction":1744},"CVE-2016-4437","Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.",0.93143,"Apache Shiro Code Execution Vulnerability","Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature.",{"cveId":1903,"description":1904,"publishedDate":1905,"cvssScore":1607,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1906,"cisaVulnName":1892,"cisaDateAdded":1885,"cisaShortDescription":1907,"cisaRequiredAction":1744},"CVE-2018-11776","Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.","2018-08-22",0.99993,"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.",{"cveId":1909,"description":1910,"publishedDate":1911,"cvssScore":1607,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1912,"cisaVulnName":1913,"cisaDateAdded":1885,"cisaShortDescription":1914,"cisaRequiredAction":1744},"CVE-2017-9805","The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.","2017-09-15",0.99461,"Apache Struts Deserialization of Untrusted Data Vulnerability","Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.",{"cveId":1916,"description":1917,"publishedDate":1918,"cvssScore":1639,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1919,"cisaVulnName":1920,"cisaDateAdded":1885,"cisaShortDescription":1921,"cisaRequiredAction":1744},"CVE-2019-0211","In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.","2019-04-08",0.65005,"Apache HTTP Server Privilege Escalation Vulnerability","Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.",{"cveId":1923,"description":1924,"publishedDate":1925,"cvssScore":1639,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1926,"cisaVulnName":1927,"cisaDateAdded":1885,"cisaShortDescription":1928,"cisaRequiredAction":1744},"CVE-2019-15752","Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\\DockerDesktop\\version-bin\\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.","2019-08-28",0.29628,"Docker Desktop Community Edition Privilege Escalation Vulnerability","Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\\DockerDesktop\\version-bin\\.",{"cveId":1930,"description":1931,"publishedDate":1932,"cvssScore":1649,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1933,"cisaVulnName":1884,"cisaDateAdded":1885,"cisaShortDescription":1934,"cisaRequiredAction":1744},"CVE-2021-41773","A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","2021-10-05",0.99992,"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.",{"cveId":1936,"description":1937,"publishedDate":1938,"cvssScore":1649,"cvssVersion":1595,"severity":1608,"isKev":4,"epssScore":1939,"cisaVulnName":1940,"cisaDateAdded":1885,"cisaShortDescription":1941,"cisaRequiredAction":1744},"CVE-2019-17558","Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity\u002F` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).","2019-12-30",0.98567,"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability","The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.",[1943,1944,1945,1946,1947,1948,1949,1950,1951,1952],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":21,"last_cve_update":22},{"id":24,"product_name":25,"version_count":26,"cve_count":27,"kev_count":28,"last_cve_update":29},{"id":31,"product_name":32,"version_count":33,"cve_count":34,"kev_count":35,"last_cve_update":36},{"id":38,"product_name":39,"version_count":40,"cve_count":41,"kev_count":42,"last_cve_update":43},{"id":45,"product_name":46,"version_count":47,"cve_count":48,"kev_count":49,"last_cve_update":13},{"id":51,"product_name":52,"version_count":53,"cve_count":54,"kev_count":49,"last_cve_update":55},{"id":57,"product_name":58,"version_count":59,"cve_count":60,"kev_count":61,"last_cve_update":62},{"id":64,"product_name":65,"version_count":66,"cve_count":67,"kev_count":68,"last_cve_update":69},{"id":71,"product_name":72,"version_count":73,"cve_count":74,"kev_count":35,"last_cve_update":75},{"id":77,"product_name":78,"version_count":79,"cve_count":80,"kev_count":61,"last_cve_update":81},{"title":1954,"metaDescription":1955,"keywords":1956,"structuredData":1957},"Apache - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Apache covering 391 products with 2540 tracked vulnerabilities including 25 critical and 18 high-severity issues and 43 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Apache vulnerabilities, Apache security, Apache CVE, Apache threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Apache KEV, Apache exploited vulnerabilities",{"@context":1958,"@type":1959,"name":1960,"description":1955,"url":1961},"https:\u002F\u002Fschema.org","Organization","Apache","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fapache",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":1963,"apiVersion":1964},"2026-10-28T13:38:18.137Z","3.0"]