CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,231 CVEs published, 236 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,231
Show in the list
Critical, last 7 days
236
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product apache_software_foundation:apache_activemq. Show all products

27 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2023-46604
Known exploited
Critical 10.0Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Assigned by apache
Oct 27, 2023
CVE-2025-66168Medium 5.4Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining length field is not properly validated
Assigned by apache
Mar 4, 2026
CVE-2026-34197
Known exploited
High 8.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Assigned by apache
Apr 7, 2026
CVE-2026-33227Medium 4.3Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory
Assigned by apache
Apr 7, 2026
CVE-2026-40046High 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated
Assigned by apache
Apr 9, 2026
CVE-2026-39304High 7.5Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM
Assigned by apache
Apr 10, 2026
CVE-2026-40466High 8.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Assigned by apache
Apr 24, 2026
CVE-2026-41043Medium 6.5Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
Assigned by apache
Apr 24, 2026
CVE-2026-41044High 8.8Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia
Assigned by apache
Apr 24, 2026
CVE-2026-49270Medium 5.9Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
Assigned by apache
Jun 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.