CVE-2026-42253

CVE-2026-42253 affects Apache ActiveMQ and Apache ActiveMQ Web. The vulnerability arises in the MessageServlet of the web console API, which copies every JMS message property into HTTP response headers without validation, enabling potential HTTP header injection and cross-site scripting via JMS m...

CVE-2026-33227

Apache ActiveMQ products, including ActiveMQ Client , Broker , All , Web , and the core ActiveMQ project, are vulnerable to a classpath path resource loading vulnerability (CWE-22 ). An authenticated user can provide a crafted "key" value that, due to improper path concatenation, allows for class...

CVE-2026-52760

A Cross-site Scripting (XSS) vulnerability exists in Apache ActiveMQ and Apache ActiveMQ Web Console due to the lack of input sanitization when rendering a message ID on the browse page. An authenticated producer can craft a JMS message ID containing malicious HTML or JavaScript; when an administ...

CVE-2026-41043

Apache ActiveMQ and Apache ActiveMQ Web are vulnerable to a Basic XSS vulnerability due to the improper neutralization of script-related HTML tags in web pages. An authenticated attacker can inject malicious HTML content into a JMS selector field and override the content type to HTML (instead of ...