AC
Messaging
ActiveMQ
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 13High 31Medium 16Low 2
Watch
Add ActiveMQ to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-61487 | 6.5 | Jul 28 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations Affected: before 5.19.9; 6.0.0 before 6.2.8 |
| CVE-2026-41043 | 6.5 | Apr 24 | Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues Affected: before 5.19.6; 6.0.0 before 6.2.5 |
| CVE-2026-52760 | 6.1 | Jun 30 | Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console Affected: before 5.19.8; 6.0.0 before 6.2.7 |
| CVE-2026-42253 | 6.1 | Jun 1 | Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2020-13947 | 6.1 | Feb 8 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions… Affected: before 5.15.14; 5.16.0 before 5.16.1 |
| CVE-2020-1941 | 6.1 | May 14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue Affected: 5.0.0 through 5.15.11 |
| CVE-2019-10241 | 6.1 | Apr 22 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL… Affected: 5.15.9 |
| CVE-2018-8006 | 6.1 | Oct 10 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to… Affected: 5.0.0 through 5.15.5 |
| CVE-2016-6810 | 6.1 | Jan 10 | In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console Affected: 5.0.0 before 5.14.2 |
| CVE-2016-0734 | 6.1 | Apr 7 | The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +21 more |
| CVE-2026-49270 | 5.9 | Jun 1 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) Affected: 5.14.0 before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2020-13920 | 5.9 | Sep 10 | Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry Affected: before 5.15.12 |
| CVE-2019-0201 | 5.9 | May 23 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta Affected: 5.15.9 |
| CVE-2016-0782 | 5.4 | Aug 5 | The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site… Affected: 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; 5.4.0; +22 more |
| CVE-2026-46605 | 4.3 | Jun 1 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2026-33227 | 4.3 | Apr 7 | Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory Affected: before 5.19.3; 6.0.0 before 6.2.2 |
Showing 16