Apache
41 Apache flaws are on CISA's list of vulnerabilities attackers have used, 3 of them added in 2026. CISA says 8 are known to be used by ransomware. The latest was added Oct 8, 2026.
41on CISA's list, all time
3added in 2026
2in the last 90 days
8used by ransomware
2zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| Struts | 6 | Oct 8, 2026 |
| Tomcat | 6 | Aug 4, 2026 |
| HTTP Server | 4 | May 1, 2025 |
| ActiveMQ | 3 | Apr 16, 2026 |
| OFBiz | 3 | Feb 4, 2025 |
| Log4j2 | 2 | May 1, 2023 |
| Struts 1 | 2 | Feb 10, 2022 |
| Solr | 2 | Dec 10, 2021 |
| HugeGraph-Server | 1 | Sep 18, 2024 |
| Flink | 1 | May 23, 2024 |
Latest Apache flaws
- StrutsApache Struts Command Injection Vulnerability
- TomcatApache Tomcat Missing Encryption of Sensitive Data Vulnerability
- ActiveMQApache ActiveMQ Improper Input Validation Vulnerability
- HTTP ServerApache HTTP Server Improper Escaping of Output Vulnerability
- TomcatApache Tomcat Path Equivalence Vulnerability
- OFBizApache OFBiz Forced Browsing Vulnerability
- HugeGraph-ServerApache HugeGraph-Server Improper Access Control Vulnerability
- OFBizApache OFBiz Incorrect Authorization Vulnerability
- OFBizApache OFBiz Path Traversal Vulnerability
- FlinkApache Flink Improper Access Control Vulnerability
- SupersetApache Superset Insecure Default Initialization of Resource Vulnerability
- ActiveMQApache ActiveMQ Deserialization of Untrusted Data Vulnerability
- RocketMQApache RocketMQ Command Execution Vulnerability
- TomcatApache Tomcat Remote Code Execution Vulnerability
- Log4j2Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.