Exploitation dashboard
Actively exploited vulnerabilities
Every vulnerability here has reliable evidence of exploitation in the wild, based on the CISA Known Exploited Vulnerabilities catalog. If you run an affected product, patch or mitigate it first.
1,734
Known exploited (all time)
39
Added in last 30 days
361
Used by ransomware
40 matching vulnerabilities
| CVE | Vendor / product | Vulnerability | Severity | Added | Ransomware |
|---|---|---|---|---|---|
| CVE-2026-34486 | Apache | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | Severity: High CVSS 7.5 | Aug 4, 2026 | Not known |
| CVE-2026-34197 | Apache | Apache ActiveMQ Improper Input Validation Vulnerability | Severity: High CVSS 8.8 | Apr 16, 2026 | Not known |
| CVE-2024-38475 | Apache | Apache HTTP Server Improper Escaping of Output Vulnerability | Severity: Critical CVSS 9.1 | May 1, 2025 | Not known |
| CVE-2025-24813 | Apache | Apache Tomcat Path Equivalence Vulnerability | Severity: Critical CVSS 9.8 | Apr 1, 2025 | Not known |
| CVE-2024-45195 | Apache | Apache OFBiz Forced Browsing Vulnerability | Severity: High CVSS 7.5 | Feb 4, 2025 | Not known |
| CVE-2024-27348 | Apache | Apache HugeGraph-Server Improper Access Control Vulnerability | Severity: Critical CVSS 9.8 | Sep 18, 2024 | Not known |
| CVE-2024-38856 | Apache | Apache OFBiz Incorrect Authorization Vulnerability | Severity: Critical CVSS 9.8 | Aug 27, 2024 | Not known |
| CVE-2024-32113 | Apache | Apache OFBiz Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Aug 7, 2024 | Not known |
| CVE-2020-17519 | Apache | Apache Flink Improper Access Control Vulnerability | Severity: High CVSS 7.5 | May 23, 2024 | Not known |
| CVE-2023-27524 | Apache | Apache Superset Insecure Default Initialization of Resource Vulnerability | Severity: Critical CVSS 9.8 | Jan 8, 2024 | Not known |
| CVE-2023-46604 | Apache | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.8 | Nov 2, 2023 | Known |
| CVE-2023-33246 | Apache | Apache RocketMQ Command Execution Vulnerability | Severity: Critical CVSS 9.8 | Sep 6, 2023 | Not known |
| CVE-2016-8735 | Apache | Apache Tomcat Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | May 12, 2023 | Not known |
| CVE-2021-45046 | Apache | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | Severity: Critical CVSS 9.0 | May 1, 2023 | Known |
| CVE-2022-33891 | Apache | Apache Spark Command Injection Vulnerability | Severity: High CVSS 8.8 | Mar 7, 2023 | Not known |
| CVE-2022-24112 | Apache | Apache APISIX Authentication Bypass Vulnerability | Severity: Critical CVSS 9.8 | Aug 25, 2022 | Not known |
| CVE-2022-24706 | Apache | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | Severity: Critical CVSS 9.8 | Aug 25, 2022 | Not known |
| CVE-2013-2251 | Apache | Apache Struts Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Mar 25, 2022 | Not known |
| CVE-2020-1956 | Apache | Apache Kylin OS Command Injection Vulnerability | Severity: High CVSS 8.8 | Mar 25, 2022 | Not known |
| CVE-2017-12615 | Apache | Apache Tomcat on Windows Remote Code Execution Vulnerability | Severity: High CVSS 8.1 | Mar 25, 2022 | Known |
| CVE-2017-12617 | Apache | Apache Tomcat Remote Code Execution Vulnerability | Severity: High CVSS 8.1 | Mar 25, 2022 | Not known |
| CVE-2020-1938 | Apache | Apache Tomcat Improper Privilege Management Vulnerability | Severity: Critical CVSS 9.8 | Mar 3, 2022 | Not known |
| CVE-2016-3088 | Apache | Apache ActiveMQ Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Feb 10, 2022 | Not known |
| CVE-2017-9791 | Apache | Apache Struts 1 Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Feb 10, 2022 | Not known |
| CVE-2012-0391 | Apache | Apache Struts 2 Improper Input Validation Vulnerability | Severity: Critical CVSS 9.8 | Jan 21, 2022 | Not known |
| CVE-2006-1547 | Apache | Apache Struts 1 ActionForm Denial-of-Service Vulnerability | Severity: High CVSS 7.5 | Jan 21, 2022 | Not known |
| CVE-2020-13927 | Apache | Apache Airflow's Experimental API Authentication Bypass | Severity: Critical CVSS 9.8 | Jan 18, 2022 | Not known |
| CVE-2020-11978 | Apache | Apache Airflow Command Injection | Severity: High CVSS 8.8 | Jan 18, 2022 | Not known |
| CVE-2021-44228 | Apache | Apache Log4j2 Remote Code Execution Vulnerability | Severity: Critical CVSS 10.0 | Dec 10, 2021 | Known |
| CVE-2019-0193 | Apache | Apache Solr DataImportHandler Code Injection Vulnerability | Severity: High CVSS 7.2 | Dec 10, 2021 | Not known |
| CVE-2021-40438 | Apache | Apache HTTP Server-Side Request Forgery (SSRF) | Severity: Critical CVSS 9.0 | Dec 1, 2021 | Known |
| CVE-2016-4437 | Apache | Apache Shiro Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2017-5638 | Apache | Apache Struts Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2020-17530 | Apache | Apache Struts Remote Code Execution Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Not known |
| CVE-2021-41773 | Apache | Apache HTTP Server Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2021-42013 | Apache | Apache HTTP Server Path Traversal Vulnerability | Severity: Critical CVSS 9.8 | Nov 3, 2021 | Known |
| CVE-2017-9805 | Apache | Apache Struts Deserialization of Untrusted Data Vulnerability | Severity: High CVSS 8.1 | Nov 3, 2021 | Not known |
| CVE-2018-11776 | Apache | Apache Struts Remote Code Execution Vulnerability | Severity: High CVSS 8.1 | Nov 3, 2021 | Not known |
| CVE-2019-0211 | Apache | Apache HTTP Server Privilege Escalation Vulnerability | Severity: High CVSS 7.8 | Nov 3, 2021 | Not known |
| CVE-2019-17558 | Apache | Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | Severity: High CVSS 7.5 | Nov 3, 2021 | Not known |
Source: CISA Known Exploited Vulnerabilities catalog (US government, public domain), refreshed hourly. CVSS scores from the NIST National Vulnerability Database are added as they are fetched.