CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

25 matches found

Kitploit•added 2026/08/27 12:19 a.m.•2 views

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia 원격 코드 실행 RCE CVE-2026-34197은 Apache ActiveMQ Classic에 영향을 미치는 높은 심각도의 원격 코드 실행 RCE 취약점입니다. 이 문제는 /api/jolokia/ 엔드포인트를 통해 HTTP로 관리 작업을 노출하는 Jolokia JMX-HTTP 브리지에 존재합니다. 기본 Jolokia 액세스 정책은 인증된 사용자가 ActiveMQ MBeans에서 관리 작업을 호출할 수 있도록 허용합니다. 특정 브로커 관리 메서드는 사용자...

8.8CVSS6.7AI score0.9722EPSS

SaveExploits14

Veracode•added 2026/06/08 9:40 a.m.•10 views

Remote Code Execution (RCE)

Apache ActiveMQ is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation of discovery URIs in the Jolokia JMX-HTTP bridge, where non-parenthesized wrappers such as masterslave:vm://... and static:vm://... can evade existing validation checks and load a malicious...

8.8CVSS6.6AI score0.9722EPSS

SaveExploits14References3Affected Software3

Github Security Blog•added 2026/06/01 9:31 a.m.•13 views

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as masterslave:vm://...,... and static:vm://... incorrectly pass validation allowing bypass o...

8.8CVSS6.8AI score0.9722EPSS

SaveExploits14References4Affected Software3

NVD•added 2026/06/01 9:16 a.m.•63 views

CVE-2026-42588

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy...

8.1CVSS0.0074EPSS

SaveExploits2References2

UbuntuCve•added 2026/06/01 9:16 a.m.•8 views

CVE-2026-42588

8.1CVSS7.1AI score0.0074EPSS

SaveExploits2References4

OSV•added 2026/06/01 9:16 a.m.•18 views

UBUNTU-CVE-2026-42588

8.1CVSS6.4AI score0.0074EPSS

SaveExploits2References5

ATTACKERKB•added 2026/06/01 7:23 a.m.•17 views

CVE-2026-42588

6.4AI score0.0074EPSS

SaveExploits2References2Affected Software3

OSV•added 2026/06/01 7:23 a.m.•15 views

CVE-2026-42588 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

8.1CVSS7.8AI score

SaveExploits0References5

EUVD•added 2026/06/01 7:23 a.m.•65 views

EUVD-2026-33577

8.1CVSS6.4AI score0.0074EPSS

SaveExploits2References1

Vulnrichment•added 2026/06/01 7:22 a.m.•18 views

CVE-2026-45505 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass

6.4AI score0.006EPSS

SaveExploits0References2

Tenable Nessus•added 2026/04/30 12:00 a.m.•6 views

Apache ActiveMQ < 5.19.6 / 6.x < 6.2.5 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is prior to 5.19.6 or 6.x prior to 6.2.5. It is, therefore, affected by multiple vulnerabilities: - An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via...

8.8CVSS7.8AI score0.9722EPSS

SaveExploits14References6

OSV•added 2026/04/28 8:37 a.m.•52 views

BIT-ACTIVEMQ-2026-41044 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to...

8.8CVSS6.6AI score0.0098EPSS

SaveExploits0References6

NVD•added 2026/04/24 11:16 a.m.•24 views

CVE-2026-41044

8.8CVSS0.0098EPSS

SaveExploits0References5

CVE•added 2026/04/24 10:16 a.m.•79 views

CVE-2026-41044

The CVE describes an authenticated RCE/Code Injection in Apache ActiveMQ (Classic) and related brokers via the admin web console. An attacker can craft a malicious broker name (bypassing validation) that embeds an xbean binding, which a VM transport can later load through a DestinationView MBean ...

8.8CVSS6.5AI score0.0098EPSS

SaveExploits0References5Affected Software2

EUVD•added 2026/04/24 10:16 a.m.•16 views

EUVD-2026-25412

8.8CVSS6.5AI score0.0098EPSS

SaveExploits0References1

Vulnrichment•added 2026/04/24 10:16 a.m.•7 views

CVE-2026-41044 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

6.5AI score0.0098EPSS

SaveExploits0References1

OSV•added 2026/04/24 10:16 a.m.•9 views

CVE-2026-41044 Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

8.8CVSS7.8AI score

SaveExploits0References8

CVE•added 2026/04/24 10:15 a.m.•153 views

CVE-2026-40466

CVE-2026-40466 affects Apache ActiveMQ components (Broker, All, and ActiveMQ) with vulnerable versions prior to 5.19.6 and 6.0.0–6.2.4/6.2.5 before patch. The issue is due to improper input validation and code injection: an authenticated attacker can bypass CVE-34197 by adding a network connector...

8.8CVSS8.6AI score0.04783EPSS

SaveIn wildExploits14References4Affected Software1

ATTACKERKB•added 2026/04/24 10:15 a.m.•9 views

CVE-2026-40466

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport...

8.8CVSS8.6AI score0.9722EPSS

SaveExploits14References2Affected Software3

Github Security Blog•added 2026/04/07 9:31 a.m.•16 views

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

8.8CVSS7.8AI score0.9722EPSS

SaveExploits14References5Affected Software2

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by