By year
99
00
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Apache flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2016-3081 Apache Struts Command InjectionExploited since Oct 8, 2026 · CVSS 8.1
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive DataExploited since Aug 4, 2026 · CVSS 7.5
- CVE-2026-34197 Apache ActiveMQ Improper Input ValidationExploited since Apr 16, 2026 · CVSS 8.8
- CVE-2024-38475 Apache HTTP Server Improper Escaping of OutputExploited since May 1, 2025 · CVSS 9.1
- CVE-2025-24813 Apache Tomcat Path EquivalenceExploited since Apr 1, 2025 · CVSS 9.8
- CVE-2024-45195 Apache OFBiz Forced BrowsingExploited since Feb 4, 2025 · CVSS 7.5
- CVE-2024-27348 Apache HugeGraph-Server Improper Access ControlExploited since Sep 18, 2024 · CVSS 9.8
- CVE-2024-38856 Apache OFBiz Incorrect AuthorizationExploited since Aug 27, 2024 · CVSS 9.8
- CVE-2024-32113 Apache OFBiz Path TraversalExploited since Aug 7, 2024 · CVSS 9.8
- CVE-2020-17519 Apache Flink Improper Access ControlExploited since May 23, 2024 · CVSS 7.5
- CVE-2023-27524 Apache Superset Insecure Default Initialization of ResourceExploited since Jan 8, 2024 · CVSS 8.9
- CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted DataExploited since Nov 2, 2023 · ransomware · CVSS 10
- CVE-2023-33246 Apache RocketMQ Command ExecutionExploited since Sep 6, 2023 · CVSS 9.8
- CVE-2016-8735 Apache Tomcat Remote Code ExecutionExploited since May 12, 2023 · CVSS 9.8
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted DataExploited since May 1, 2023 · ransomware · CVSS 9
- CVE-2022-33891 Apache Spark Command InjectionExploited since Mar 7, 2023 · CVSS 8.8
- CVE-2022-24112 Apache APISIX Authentication BypassExploited since Aug 25, 2022 · CVSS 9.8
- CVE-2022-24706 Apache CouchDB Insecure Default Initialization of ResourceExploited since Aug 25, 2022 · CVSS 9.8
- CVE-2017-12617 Apache Tomcat Remote Code ExecutionExploited since Mar 25, 2022 · CVSS 8.1
- CVE-2013-2251 Apache Struts Improper Input ValidationExploited since Mar 25, 2022 · CVSS 9.8
- CVE-2017-12615 Apache Tomcat on Windows Remote Code ExecutionExploited since Mar 25, 2022 · ransomware · CVSS 8.1
- CVE-2020-1956 Apache Kylin OS Command InjectionExploited since Mar 25, 2022 · CVSS 8.8
- CVE-2020-1938 Apache Tomcat Improper Privilege ManagementExploited since Mar 3, 2022 · CVSS 9.8
- CVE-2016-3088 Apache ActiveMQ Improper Input ValidationExploited since Feb 10, 2022 · CVSS 9.8
- CVE-2017-9791 Apache Struts 1 Improper Input ValidationExploited since Feb 10, 2022 · CVSS 9.8
- CVE-2006-1547 Apache Struts 1 ActionForm Denial-of-ServiceExploited since Jan 21, 2022 · CVSS 7.5
- CVE-2012-0391 Apache Struts 2 Improper Input ValidationExploited since Jan 21, 2022 · CVSS 9.8
- CVE-2020-13927 Apache Airflow's Experimental API Authentication BypassExploited since Jan 18, 2022 · CVSS 9.8
- CVE-2020-11978 Apache Airflow Command InjectionExploited since Jan 18, 2022 · CVSS 8.8
- CVE-2021-44228 Apache Log4j2 Remote Code ExecutionExploited since Dec 10, 2021 · ransomware · CVSS 10
- CVE-2019-0193 Apache Solr DataImportHandler Code InjectionExploited since Dec 10, 2021 · CVSS 7.2
- CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)Exploited since Dec 1, 2021 · ransomware · CVSS 9
- CVE-2019-0211 Apache HTTP Server Privilege EscalationExploited since Nov 3, 2021 · CVSS 7.8
- CVE-2016-4437 Apache Shiro Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2021-41773 Apache HTTP Server Path TraversalExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2021-42013 Apache HTTP Server Path TraversalExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2017-5638 Apache Struts Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2018-11776 Apache Struts Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 8.1
- CVE-2019-17558 Apache Solr VelocityResponseWriter Plug-In Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 7.5
- CVE-2017-9805 Apache Struts Deserialization of Untrusted DataExploited since Nov 3, 2021 · CVSS 8.1
- CVE-2020-17530 Apache Struts Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive DataExploited · High 7.5 · Apr 9, 2026
- CVE-2026-34197 Apache ActiveMQ Improper Input ValidationExploited · High 8.8 · Apr 7, 2026
- CVE-2025-24813 Apache Tomcat Path EquivalenceExploited · Critical 9.8 · Mar 10, 2025
- CVE-2024-45195 Apache OFBiz Forced BrowsingExploited · High 7.5 · Sep 4, 2024
- CVE-2024-42362 Hertzbeat is an open source, real-time monitoring system.High 8.8 · Aug 20, 2024
- CVE-2024-42361 Hertzbeat is an open source, real-time monitoring system.High 7.5 · Aug 20, 2024
- CVE-2024-38856 Apache OFBiz Incorrect AuthorizationExploited · Critical 9.8 · Aug 5, 2024
- CVE-2024-38475 Apache HTTP Server Improper Escaping of OutputExploited · Critical 9.1 · Jul 1, 2024
- CVE-2024-32113 Apache OFBiz Path TraversalExploited · Critical 9.8 · May 8, 2024
- CVE-2024-27348 Apache HugeGraph-Server Improper Access ControlExploited · Critical 9.8 · Apr 22, 2024
- CVE-2023-46604 Apache ActiveMQ Deserialization of Untrusted DataExploited · Critical 10 · Oct 27, 2023
- CVE-2023-33246 Apache RocketMQ Command ExecutionExploited · Critical 9.8 · May 24, 2023
- CVE-2023-27524 Apache Superset Insecure Default Initialization of ResourceExploited · High 8.9 · Apr 24, 2023
- CVE-2021-32824 Apache Dubbo is a java based, open source RPC framework.Critical 9.8 · Jan 3, 2023
- CVE-2022-33891 Apache Spark Command InjectionExploited · High 8.8 · Jul 18, 2022
- CVE-2022-24706 Apache CouchDB Insecure Default Initialization of ResourceExploited · Critical 9.8 · Apr 26, 2022
- CVE-2022-24112 Apache APISIX Authentication BypassExploited · Critical 9.8 · Feb 11, 2022
- CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted DataExploited · Critical 9 · Dec 14, 2021
- CVE-2021-44228 Apache Log4j2 Remote Code ExecutionExploited · Critical 10 · Dec 10, 2021
- CVE-2021-42013 Apache HTTP Server Path TraversalExploited · Critical 9.8 · Oct 7, 2021
- CVE-2021-41773 Apache HTTP Server Path TraversalExploited · Critical 9.8 · Oct 5, 2021
- CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)Exploited · Critical 9 · Sep 16, 2021
- CVE-2021-27737 Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.High 7.5 · May 14, 2021
- CVE-2020-11988 Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser.High 8.2 · Feb 24, 2021
- CVE-2020-11987 Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel.High 8.2 · Feb 24, 2021
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.