Exposição de Apache HTTP Server

Web servers
633
score de exposição
1.465.263
sites usam
6
em exploração
24
críticos
Análise Vexday

O Apache HTTP Server acumula 169 CVEs catalogadas, com 16 classificadas como críticas e 34 surgidas apenas nos últimos 90 dias, sinalizando um ritmo elevado de descobertas recentes que exige atenção contínua. A taxa de exploração ativa é 6,6 vezes acima da média geral do catálogo CISA KEV, com 5 vulnerabilidades confirmadas em uso por agentes de ameaça — proporção que coloca o servidor entre as tecnologias de maior risco operacional imediato. A CVE mais perigosa atualmente ativa, CVE-2021-40438, apresenta EPSS de 1,0, o valor máximo possível, indicando probabilidade praticamente certa de exploração observada no ambiente real. O tipo de falha mais recorrente é CWE-476 (desreferência de ponteiro nulo), embora o perfil de risco mais crítico esteja nas vulnerabilidades com exploração confirmada, que devem ser priorizadas em qualquer plano de remediação.

CVEs

204 resultados
CVE-2026-42528MEDIUMApache HTTP Server: mod_dav shared lock overflowEPSS 0.4%CVE-2026-73636HIGHApache HTTP Server: mod_auth_digest one-time-nonce replay attackEPSS 0.4%CVE-2026-34059HIGHApache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()EPSS 0.4%CVE-2026-33857MEDIUMApache HTTP Server: Off-by-one OOB reads in AJP getter functionsEPSS 0.4%CVE-2026-8850HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2026-87347CRITICALVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected EPSS 0.4%CVE-2026-47360HIGHApache HTTP Server: mod_session: Session cookie not removed during internal redirectEPSS 0.4%CVE-2026-104150HIGHAdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityEPSS 0.4%CVE-2024-21545HIGHProxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against maliEPSS 0.4%CVE-2026-8854HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2026-61526MEDIUMAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handlerEPSS 0.3%CVE-2026-87346HIGHVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTPEPSS 0.3%CVE-2026-107718MEDIUMAdonisJS: Unencoded route parameters can produce open redirectsEPSS 0.3%CVE-2026-34291HIGHVulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.EPSS 0.3%CVE-2026-8834HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-8835HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-40255MEDIUM@adonisjs/http-server has an Open Redirect vulnerabilityEPSS 0.2%CVE-2026-8856HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2026-8852MEDIUMIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2026-44119MEDIUMApache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modulesEPSS 0.2%