Is other Apache software (ActiveMQ, OFBiz, Flink) safe right now?
1 flaw was added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run other Apache software, update now.
Exploited in the last 90 days
- StrutsApache Struts Command Injection Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Earlier exploited flaws
- Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- Apache ActiveMQ Improper Input Validation Vulnerability
- Apache HTTP Server Improper Escaping of Output Vulnerability
- Apache Tomcat Path Equivalence Vulnerability
- Apache OFBiz Forced Browsing Vulnerability
- Apache HugeGraph-Server Improper Access Control Vulnerability
- Apache OFBiz Incorrect Authorization Vulnerability
- Apache OFBiz Path Traversal Vulnerability
- Apache Flink Improper Access Control Vulnerability
- Apache Superset Insecure Default Initialization of Resource Vulnerability
- Apache ActiveMQ Deserialization of Untrusted Data Vulnerability Zero-day
- Apache RocketMQ Command Execution Vulnerability
- Apache Tomcat Remote Code Execution Vulnerability
- Apache Log4j2 Deserialization of Untrusted Data Vulnerability
- Apache Spark Command Injection Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 3 | 0 |
| 2025 | 3 | 0 |
| 2024 | 5 | 0 |
| 2023 | 5 | 1 |
| 2022 | 13 | 0 |
Questions
Is other Apache software (ActiveMQ, OFBiz, Flink) safe right now?
1 flaw was added to CISA's list of actively exploited vulnerabilities in the last 30 days. If you run other Apache software, update now. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many other Apache software vulnerabilities have been exploited?
41 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 8 of them used by ransomware.
Covers products matching activemq, ofbiz, flink, apache. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.