Apache
- Exploited flaws
- 41in 21 products
- Added to CISA's list in 2026
- 33 in 2025
- Used by ransomware
- 8of 41, says CISA
- Disclosure to CISA's list
- 369 daysmedian; 5 of 32 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2006 | 1 |
| 2007 | 0 |
| 2008 | 0 |
| 2009 | 0 |
| 2010 | 0 |
| 2011 | 0 |
| 2012 | 1 |
| 2013 | 1 |
| 2014 | 0 |
| 2015 | 0 |
| 2016 | 4 |
| 2017 | 5 |
| 2018 | 1 |
| 2019 | 3 |
| 2020 | 6 |
| 2021 | 5 |
| 2022 | 3 |
| 2023 | 3 |
| 2024 | 5 |
| 2025 | 1 |
| 2026 | 2 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Struts | 6 | 2021-11-03 | 2026-10-08 |
| Tomcat | 6 | 2022-03-03 | 2026-08-04 |
| HTTP Server | 4 | 2021-11-03 | 2025-05-01 |
| ActiveMQ | 3 | 2022-02-10 | 2026-04-16 |
| OFBiz | 3 | 2024-08-07 | 2025-02-04 |
| Log4j2 | 2 | 2021-12-10 | 2023-05-01 |
| Solr | 2 | 2021-11-03 | 2021-12-10 |
| Struts 1 | 2 | 2022-01-21 | 2022-02-10 |
Latest on CISA's list
- Apache Struts Command Injection Vulnerability
- Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- Apache ActiveMQ Improper Input Validation Vulnerability
- Apache HTTP Server Improper Escaping of Output Vulnerability
- Apache Tomcat Path Equivalence Vulnerability
- Apache OFBiz Forced Browsing Vulnerability
- Apache HugeGraph-Server Improper Access Control Vulnerability
- Apache OFBiz Incorrect Authorization Vulnerability
- Apache OFBiz Path Traversal Vulnerability
- Apache Flink Improper Access Control Vulnerability
In the news
No security story in the last 14 days named Apache in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.