AR
Product
Artemis
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 10Low 0
Watch
Add Artemis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-57967 | 9.8 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Affected: 1.0.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2026-27446 | 9.8 | Mar 4 | Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation Affected: 2.11.0 through 2.44.0; 2.50.0 |
| CVE-2026-49364 | 9.1 | Sep 10 | Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers Affected: 1.0.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2026-67593 | 9.1 | Sep 10 | Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion Affected: 1.0.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2023-50780 | 8.8 | Oct 14 | Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint Affected: before 2.29.0 |
| CVE-2026-49362 | 7.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation Affected: 1.0.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2026-49363 | 7.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription Affected: 1.0.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2022-23913 | 7.5 | Feb 4 | In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory Affected: before 2.19.1 |
| CVE-2021-26118 | 7.5 | Jan 27 | While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access… Affected: 2.15.0 |
| CVE-2021-26117 | 7.5 | Jan 27 | The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server Affected: before 2.16.0 |
| CVE-2017-12174 | 7.5 | Mar 7 | It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast… Affected: before 2.4.0 |
| CVE-2016-4978 | 7.2 | Sep 27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0… Affected: before 1.4.0 |
| CVE-2026-57822 | 6.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service Affected: 1.3.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2026-75880 | 6.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service Affected: 1.0.0 before 2.44.0; 2.50.0 before 2.57.0 |
| CVE-2025-27391 | 6.5 | Apr 9 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis Affected: 1.5.1 before 2.40.0 |
| CVE-2022-35278 | 6.1 | Aug 23 | In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an… Affected: before 2.24.0 |
| CVE-2020-13932 | 6.1 | Jul 20 | In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability Affected: 2.5.0 through 2.13.0 |
| CVE-2020-10727 | 5.5 | Jun 26 | A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file… Affected: 2.7.0 through 2.12.0 |
| CVE-2021-4040 | 5.3 | Aug 24 | A flaw was found in AMQ Broker Affected: before 2.19.1 |
| CVE-2026-40914 | 4.3 | May 28 | Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission Affected: 2.0.0 through 2.44.0; 2.50.0 before 2.54.0 |
| CVE-2026-32642 | 4.3 | Mar 24 | Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without createAddress permission Affected: 2.0.0 through 2.44.0; 2.50.0 before 2.53.0 |
| CVE-2025-27427 | 4.3 | Apr 1 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type… Affected: 2.0.0 before 2.40.0 |
Showing 22