CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,206 CVEs published, 247 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,206
Show in the list
Critical, last 7 days
247
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,760
Show in the list

Showing CVEs that name the product apache_software_foundation:apache_activemq_all. Show all products

20 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-34197
Known exploited
High 8.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
Assigned by apache
Apr 7, 2026
CVE-2026-33227Medium 4.3Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory
Assigned by apache
Apr 7, 2026
CVE-2026-40046High 7.5Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT control packet remaining length field is not properly validated
Assigned by apache
Apr 9, 2026
CVE-2026-39304High 7.5Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM
Assigned by apache
Apr 10, 2026
CVE-2026-40466High 8.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
Assigned by apache
Apr 24, 2026
CVE-2026-41044High 8.8Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia
Assigned by apache
Apr 24, 2026
CVE-2026-49270Medium 5.9Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire)
Assigned by apache
Jun 1, 2026
CVE-2026-46605Medium 4.3Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal
Assigned by apache
Jun 1, 2026
CVE-2026-45505High 8.8Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass
Assigned by apache
Jun 1, 2026
CVE-2026-42588High 8.1Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector
Assigned by apache
Jun 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.