# Apache security incidents · pwn.watch

> Security incidents tagged Apache (vendor, product, platform or attack type).

Page: https://pwn.watch/t/apache · generated 2026-10-22T19:10:46.198Z

## Status (as of 2026-10-22)
- Incidents: 14 (1 live, 1 live and not fully patched, 13 patched)
- Days without a Apache security incident: 0 (1 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-17

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/apache.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/apache/feed.xml
- This file: https://pwn.watch/t/apache/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [PHP2Shell: critical unauthenticated RCE in PHP core](https://pwn.watch/i/php2shell-cve-2026-109618-109619) ([json](https://pwn.watch/i/php2shell-cve-2026-109618-109619.json)): critical, live, partial, started 2026-10-17, CVE-2026-109618, CVE-2026-109619
- [Apache Tomcat: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability](https://pwn.watch/i/apache-tomcat-cve-2026-34486) ([json](https://pwn.watch/i/apache-tomcat-cve-2026-34486.json)): high, closed, patched, started 2026-08-04, CVE-2026-34486
- [Apache ActiveMQ: Apache ActiveMQ Improper Input Validation Vulnerability](https://pwn.watch/i/apache-activemq-cve-2026-34197) ([json](https://pwn.watch/i/apache-activemq-cve-2026-34197.json)): high, closed, patched, started 2026-04-16, CVE-2026-34197
- [Apache HTTP Server: HTTP Server Improper Escaping of Output Vulnerability](https://pwn.watch/i/apache-http-server-cve-2024-38475) ([json](https://pwn.watch/i/apache-http-server-cve-2024-38475.json)): critical, closed, patched, started 2025-05-01, CVE-2024-38475
- [Apache Tomcat: Tomcat Path Equivalence Vulnerability](https://pwn.watch/i/apache-tomcat-cve-2025-24813) ([json](https://pwn.watch/i/apache-tomcat-cve-2025-24813.json)): critical, closed, patched, started 2025-04-01, CVE-2025-24813
- [Apache OFBiz: OFBiz Forced Browsing Vulnerability](https://pwn.watch/i/apache-ofbiz-cve-2024-45195) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-45195.json)): critical, closed, patched, started 2025-02-04, CVE-2024-45195
- [Apache OFBiz Incorrect Authorization](https://pwn.watch/i/apache-ofbiz-cve-2024-38856) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-38856.json)): high, closed, patched, started 2024-08-05, CVE-2024-38856
- [Apache Flink Improper Access Control](https://pwn.watch/i/apache-flink-cve-2020-17519) ([json](https://pwn.watch/i/apache-flink-cve-2020-17519.json)): critical, closed, patched, started 2024-05-23, CVE-2020-17519
- [Apache OFBiz Path Traversal](https://pwn.watch/i/apache-ofbiz-cve-2024-32113) ([json](https://pwn.watch/i/apache-ofbiz-cve-2024-32113.json)): critical, closed, patched, started 2024-05-08, CVE-2024-32113
- [Apache HugeGraph-Server Improper Access Control](https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348) ([json](https://pwn.watch/i/apache-hugegraph-server-cve-2024-27348.json)): critical, closed, patched, started 2024-04-22, CVE-2024-27348
- [Apache Superset Insecure Default Initialization of Resource](https://pwn.watch/i/apache-superset-cve-2023-27524) ([json](https://pwn.watch/i/apache-superset-cve-2023-27524.json)): high, closed, patched, started 2024-01-08, CVE-2023-27524
- [Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604) ([json](https://pwn.watch/i/apache-activemq-openwire-rce-cve-2023-46604.json)): critical, closed, patched, started 2023-10-27, CVE-2023-46604
- [Apache RocketMQ: Command Execution (CVE-2023-33246)](https://pwn.watch/i/apache-rocketmq-cve-2023-33246) ([json](https://pwn.watch/i/apache-rocketmq-cve-2023-33246.json)): critical, closed, patched, started 2023-09-06, CVE-2023-33246
- [Apache Spark: Command Injection (CVE-2022-33891)](https://pwn.watch/i/apache-spark-cve-2022-33891) ([json](https://pwn.watch/i/apache-spark-cve-2022-33891.json)): high, closed, patched, started 2023-03-07, CVE-2022-33891