Search: “apache”

196 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 252 Exploit / PoC 196 Ransomware 125 Malware 53 Data breach 48 Threat actor 31 Advisory 5 Policy & legal 4 Phishing & fraud 4 Model release 2 Research 1 AI safety & security 1

SeverityAll critical 616 high 101 medium 3 low 0 info 2

Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021

Apache Log4j 2 RCE CVE-2021-44228 is actively exploited via crafted JNDI lookups; Palo Alto Unit 42 urges upgrading to Log4j 2.17.1.

Unit 42 details CVE-2021-44228, an easily exploited remote code execution flaw in Apache Log4j 2 where attacker-supplied JNDI lookups in logged user input cause payload download and execution. Massive internet-wide scanning for unpatched systems has begun, with observed follow-on activity including information stealing, Cobalt Strike delivery, and coinmining. The recommended fix is Log4j 2.17.1, which also patches CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Widely used Java software including Apache Struts, Solr, Druid, Flink, ElasticSearch, and Spring Boot is affected.

Palo Alto Unit 42Aug 17, 12:20 UTC · 29d agoExploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+3 CVEs

CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass

Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.

Web discovery (articles for new exploits & KEV entries)Sep 8, 20:09 UTC · 7d agoExploit / PoC CVE-2026-34486 CVE-2026-291461

Threat Advisory: Critical Apache Log4j vulnerability being exploited in the wild

Cisco TalosDec 10, 19:37 UTC · Dec 10, 2021Exploit / PoC in the wildCVE-2021-44228 CVE-2021-45046 CVE-2021-45105+1 CVEs

New Apache Struts Zero-Day Vulnerability Being Exploited in the Wild

The Hacker NewsMar 9, 12:03 UTC · Mar 9, 2017Exploit / PoC in the wildCVE-2017-5638

CVE-2026-34486: Apache Software Foundation Apache Tomcat

CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.

CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.

Web discovery (articles for new exploits & KEV entries)Sep 9, 04:23 UTC · 7d agoExploit / PoC in the wildCVE-2026-34486 CVE-2026-291462

Experts downplay reach of Apache bug ‘Text4Shell’

The RecordJan 9, 00:00 UTC · Jan 9, 2023Exploit / PoC CVE-2022-42889

Apache fixes actively exploited web server zero

The RecordDec 16, 00:00 UTC · Dec 16, 2022Exploit / PoC in the wildCVE-2021-41773

Critical RCE 0day in Apache Log4j library exploited in the wild (CVE-2021-44228)

Help Net SecurityDec 13, 12:51 UTC · Dec 13, 2021Exploit / PoC in the wildCVE-2021-44228

All versions of Apache Tomcat are affected by the Ghostcat flaw

Security AffairsFeb 28, 22:45 UTC · Feb 28, 2020Exploit / PoC CVE-2020-1938

PoC exploit code for Apache Solr RCE flaw is available online

Security AffairsNov 25, 22:55 UTC · Nov 25, 2019Exploit / PoC CVE-2019-124092

New Apache Web Server Bug Threatens Security of Shared Web Hosts

The Hacker NewsApr 3, 09:07 UTC · Apr 3, 2019Exploit / PoC CVE-2019-0211 CVE-2019-0217 CVE-2019-0215

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

The Hacker NewsApr 17, 13:10 UTC · Apr 17, 2026Exploit / PoC in the wildCVE-2026-34197 CVE-2024-32114 CVE-2023-46604

U.S. CISA adds Apache OFBiz bug to its Known Exploited Vulnerabilities catalog

Security AffairsAug 28, 07:41 UTC · Aug 28, 2024Exploit / PoC in the wildCVE-2024-38856

Experts created a PoC for Apache OFBiz flaw CVE-2023

Security AffairsJan 12, 12:07 UTC · Jan 12, 2024Exploit / PoC CVE-2023-51467 CVE-2023-49070 CVE-2020-9496+1 CVEs

Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers

Cisco TalosOct 7, 19:36 UTC · Oct 7, 2021Exploit / PoC in the wildCVE-2021-41733 CVE-2021-42013

Apache Warns of Zero-Day Exploit in the Wild — Patch Your Web Servers Now!

The Hacker NewsOct 7, 05:31 UTC · Oct 7, 2021Exploit / PoC in the wildCVE-2021-41773 CVE-2021-41524

Experts warn of mass scans for Apache Tomcat Ghostcat flaw

Security AffairsMar 3, 07:59 UTC · Mar 3, 2020Exploit / PoC CVE-2020-1938

Critical Apache Struts flaw CVE-2018

Security AffairsAug 28, 16:07 UTC · Aug 28, 2018Exploit / PoC CVE-2018-11776 CVE-2017-5638

Critical Apache HTTP/2 Flaw (CVE-2026

The Hacker NewsMay 5, 16:46 UTC · May 5, 2026Exploit / PoC CVE-2026-23918

Atlassian fixed maximum severity flaw CVE-2025

Security AffairsDec 15, 15:03 UTC · Dec 15, 2025Exploit / PoC CVE-2025-66516 CVE-2025-54988 CVE-2021-39227+1 CVEs

Critical Flaw in Apache Parquet Allows Remote Attackers to Execute Arbitrary Code

The Hacker NewsApr 4, 03:38 UTC · Apr 4, 2025Exploit / PoC in the wildCVE-2025-30065 CVE-2025-24813

U.S. CISA adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalog

Security AffairsApr 2, 13:47 UTC · Apr 2, 2025Exploit / PoC in the wildCVE-2025-24813

Threat actors rapidly exploit new Apache Tomcat flaw following PoC release

Security AffairsMar 17, 19:59 UTC · Mar 17, 2025Exploit / PoC in the wildCVE-2025-24813

U.S. CISA adds Microsoft .NET Framework, Apache OFBiz, and Paessler PRTG Network Monitor flaws to its Known Exploited Vulnerabilities catalog

Security AffairsFeb 5, 15:03 UTC · Feb 5, 2025Exploit / PoC in the wildCVE-2024-45195 CVE-2024-29059 CVE-2018-9276+1 CVEs