Web and application servers

Web servers, application servers and hosting control panels.

For example: IIS, Apache Tomcat, Oracle WebLogic, ColdFusion.

10 vulnerabilities added in the last 12 months
67 exploited vulnerabilities in the catalog, in total
1 added in the last 30 days

Pace of additions

Number of “Web servers” vulnerabilities added to CISA’s KEV catalog, per 30-day period (the last one, still in progress, ends on October 3, 2026). Source: CISA KEV catalog.

Catalog additions per 30-day period
Period	Vulnerabilities added
Sep 9, 2025 to Oct 8, 2025	0
Oct 9, 2025 to Nov 7, 2025	1
Nov 8, 2025 to Dec 7, 2025	0
Dec 8, 2025 to Jan 6, 2026	0
Jan 7, 2026 to Feb 5, 2026	0
Feb 6, 2026 to Mar 7, 2026	0
Mar 8, 2026 to Apr 6, 2026	0
Apr 7, 2026 to May 6, 2026	2
May 7, 2026 to Jun 5, 2026	2
Jun 6, 2026 to Jul 5, 2026	1
Jul 6, 2026 to Aug 4, 2026	2
Aug 5, 2026 to Sep 3, 2026	1
Sep 4, 2026 to Oct 3, 2026 (in progress)	1

Affected brands

In alphabetical order, with their number of vulnerabilities in this category.

Adobe 16 vulnerabilities · 1 in the last 12 months
Apache 16 vulnerabilities · 2 in the last 12 months
cPanel (WebPros) 1 vulnerability · 1 in the last 12 months
CWP (Control Web Panel / CentOS Web Panel) 2 vulnerabilities · 1 in the last 12 months
CyberPanel (CyberPersons) 2 vulnerabilities
Embedthis 1 vulnerability
IBM 1 vulnerability
LiteSpeed 2 vulnerabilities · 2 in the last 12 months
Microsoft 1 vulnerability
Nostromo 1 vulnerability
Oracle 17 vulnerabilities · 2 in the last 12 months
Protocoles (IETF) 1 vulnerability
Red Hat 3 vulnerabilities
Webmin 1 vulnerability
WSO2 2 vulnerabilities · 1 in the last 12 months

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this category.

Rank 1
WSO2 API Manager, Identity Server, IntegratorCVE-2026-5430
WSO2 Multiple Products Path Traversal Vulnerability
Recently addedHunt for compromise (CISA)
CVSS severity 10.0critical
Added Sep 24, 2026
Rank 2
Oracle WebLogic ServerCVE-2026-21962
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Hunt for compromise (CISA)
CVSS severity 10.0critical
Added Aug 24, 2026
Rank 3
Adobe ColdFusionCVE-2026-48282
Adobe ColdFusion Path Traversal Vulnerability
Hunt for compromise (CISA)
CVSS severity 10.0critical
Added Jul 7, 2026
Rank 4
LiteSpeed cPanel PluginCVE-2026-48172
LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
CVSS severity 9.8critical
Added May 26, 2026
Rank 5
cPanel (WebPros) cPanel & WHM (WP Squared)CVE-2026-41940
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
Ransomware
CVSS severity 9.8critical
Added Apr 30, 2026
Rank 6
CWP (Control Web Panel / CentOS Web Panel) Control Web PanelCVE-2025-48703
CWP Control Web Panel OS Command Injection Vulnerability
CVSS severity 9.0critical
Added Nov 4, 2025
Rank 7
Apache ActiveMQCVE-2026-34197
Apache ActiveMQ Improper Input Validation Vulnerability
CVSS severity 8.8high
Added Apr 16, 2026
Rank 8
LiteSpeed cPanel PluginCVE-2026-54420
LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
CVSS severity 8.5high
Added Jun 15, 2026
Rank 9
Apache TomcatCVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
CVSS severity 7.5high
Added Aug 4, 2026
Rank 10
Oracle WebLogic ServerCVE-2024-21182
Oracle WebLogic Server Unspecified Vulnerability
CVE from 2024, added in 2026
CVSS severity 7.5high
Added Jun 1, 2026

Show 57 more vulnerabilities

Rank 11
Apache TomcatCVE-2025-24813
Apache Tomcat Path Equivalence Vulnerability
CVSS severity 9.8critical
Added Apr 1, 2025
Rank 12
Adobe ColdFusionCVE-2017-3066
Adobe ColdFusion Deserialization Vulnerability
CVE from 2017, added in 2025
CVSS severity 9.8critical
Added Feb 24, 2025
Rank 13
Oracle WebLogic ServerCVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability
CVE from 2020, added in 2025
CVSS severity 9.8critical
Added Jan 7, 2025
Rank 14
CyberPanel (CyberPersons) CyberPanelCVE-2024-51378
CyberPanel Incorrect Default Permissions Vulnerability
Ransomware
CVSS severity 9.8critical
Added Dec 4, 2024
Rank 15
Nostromo nhttpdCVE-2019-16278
Nostromo nhttpd Directory Traversal Vulnerability
CVE from 2019, added in 2024
CVSS severity 9.8critical
Added Nov 7, 2024
Rank 16
CyberPanel (CyberPersons) CyberPanelCVE-2024-51567
CyberPanel Incorrect Default Permissions Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 7, 2024
Rank 17
Oracle WebLogic ServerCVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
CVE from 2020, added in 2024
CVSS severity 9.8critical
Added Sep 18, 2024
Rank 18
Adobe ColdFusionCVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Ransomware
CVSS severity 9.8critical
Added Jan 8, 2024
Rank 19
Adobe ColdFusionCVE-2023-38203
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
Ransomware
CVSS severity 9.8critical
Added Jan 8, 2024
Rank 20
Oracle WebLogic ServerCVE-2020-2551
Oracle Fusion Middleware Unspecified Vulnerability
CVE from 2020, added in 2023
CVSS severity 9.8critical
Added Nov 16, 2023
Rank 21
Apache ActiveMQCVE-2023-46604
Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 2, 2023
Rank 22
Apache RocketMQCVE-2023-33246
Apache RocketMQ Command Execution Vulnerability
CVSS severity 9.8critical
Added Sep 6, 2023
Rank 23
Adobe ColdFusionCVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
CVSS severity 9.8critical
Added Aug 21, 2023
Rank 24
Apache TomcatCVE-2016-8735
Apache Tomcat Remote Code Execution Vulnerability
CVE from 2016, added in 2023
CVSS severity 9.8critical
Added May 12, 2023
Rank 25
Adobe ColdFusionCVE-2023-26360
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
CVSS severity 9.8critical
Added Mar 15, 2023
Rank 26
CWP (Control Web Panel / CentOS Web Panel) Control Web PanelCVE-2022-44877
CWP Control Web Panel OS Command Injection Vulnerability
CVSS severity 9.8critical
Added Jan 17, 2023
Rank 27
Oracle WebLogic ServerCVE-2018-2628
Oracle WebLogic Server Unspecified Vulnerability
CVE from 2018, added in 2022
CVSS severity 9.8critical
Added Sep 8, 2022
Rank 28
Apache APISIXCVE-2022-24112
Apache APISIX Authentication Bypass Vulnerability
CVSS severity 9.8critical
Added Aug 25, 2022
Rank 29
Oracle Fusion MiddlewareCVE-2012-1710
Oracle Fusion Middleware Unspecified Vulnerability
RansomwareCVE from 2012, added in 2022
CVSS severity 9.8critical
Added May 25, 2022
Rank 30
WSO2 API Manager, Identity Server, IntegratorCVE-2022-29464
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Ransomware
CVSS severity 9.8critical
Added Apr 25, 2022
Rank 31
Adobe ColdFusionCVE-2010-2861
Adobe ColdFusion Directory Traversal Vulnerability
RansomwareCVE from 2010, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
Rank 32
WebminCVE-2019-15107
Webmin Command Injection Vulnerability
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Mar 25, 2022
Rank 33
Adobe ColdFusionCVE-2013-0625
Adobe ColdFusion Authentication Bypass Vulnerability
CVE from 2013, added in 2022
CVSS severity 9.8critical
Added Mar 7, 2022
Rank 34
Adobe ColdFusionCVE-2013-0632
Adobe ColdFusion Authentication Bypass Vulnerability
CVE from 2013, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 35
Apache TomcatCVE-2020-1938
Apache Tomcat Improper Privilege Management Vulnerability
CVE from 2020, added in 2022
CVSS severity 9.8critical
Added Mar 3, 2022
Rank 36
Apache ActiveMQCVE-2016-3088
Apache ActiveMQ Improper Input Validation Vulnerability
CVE from 2016, added in 2022
CVSS severity 9.8critical
Added Feb 10, 2022
Rank 37
IBM WebSphere Application ServerCVE-2015-7450
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
CVE from 2015, added in 2022
CVSS severity 9.8critical
Added Jan 10, 2022
Rank 38
Oracle WebLogic ServerCVE-2019-2725
Oracle WebLogic Server, Injection
RansomwareCVE from 2019, added in 2022
CVSS severity 9.8critical
Added Jan 10, 2022
Rank 39
Red Hat JBoss Application Server / EAPCVE-2017-12149
Red Hat JBoss Application Server Remote Code Execution Vulnerability
RansomwareCVE from 2017, added in 2021
CVSS severity 9.8critical
Added Dec 10, 2021
Rank 40
Oracle WebLogic ServerCVE-2015-4852
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability
CVE from 2015, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 41
Microsoft IISCVE-2017-7269
Microsoft Windows Server Buffer Overflow Vulnerability
CVE from 2017, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 42
Adobe ColdFusionCVE-2018-15961
Adobe ColdFusion Unrestricted File Upload Vulnerability
CVE from 2018, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 43
Adobe ColdFusionCVE-2018-4939
Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
CVE from 2018, added in 2021
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 44
Oracle WebLogic ServerCVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 45
Oracle WebLogic ServerCVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 46
Oracle CoherenceCVE-2020-2555
Oracle Multiple Products Remote Code Execution Vulnerability
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 47
Apache HTTP ServerCVE-2021-41773
Apache HTTP Server Path Traversal Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 48
Apache HTTP ServerCVE-2021-42013
Apache HTTP Server Path Traversal Vulnerability
Ransomware
CVSS severity 9.8critical
Added Nov 3, 2021
Rank 49
Apache HTTP ServerCVE-2024-38475
Apache HTTP Server Improper Escaping of Output Vulnerability
CVSS severity 9.1critical
Added May 1, 2025
Rank 50
Oracle Fusion MiddlewareCVE-2012-3152
Oracle Fusion Middleware Unspecified Vulnerability
CVE from 2012, added in 2021
CVSS severity 9.1critical
Added Nov 3, 2021
Rank 51
Apache HTTP ServerCVE-2021-40438
Apache HTTP Server-Side Request Forgery (SSRF)
Ransomware
CVSS severity 9.0critical
Added Dec 1, 2021
Rank 52
Apache TomcatCVE-2017-12615
Apache Tomcat on Windows Remote Code Execution Vulnerability
RansomwareCVE from 2017, added in 2022
CVSS severity 8.1high
Added Mar 25, 2022
Rank 53
Apache TomcatCVE-2017-12617
Apache Tomcat Remote Code Execution Vulnerability
CVE from 2017, added in 2022
CVSS severity 8.1high
Added Mar 25, 2022
Rank 54
Embedthis GoAheadCVE-2017-17562
Embedthis GoAhead Remote Code Execution Vulnerability
CVE from 2017, added in 2021
CVSS severity 8.1high
Added Dec 10, 2021
Rank 55
Apache HTTP ServerCVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability
CVE from 2019, added in 2021
CVSS severity 7.8high
Added Nov 3, 2021
Rank 56
Protocoles (IETF) HTTP/2CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
CVSS severity 7.5high
Added Oct 10, 2023
Rank 57
Adobe ColdFusionCVE-2023-29298
Adobe ColdFusion Improper Access Control Vulnerability
CVSS severity 7.5high
Added Jul 20, 2023
Rank 58
Adobe ColdFusionCVE-2023-38205
Adobe ColdFusion Improper Access Control Vulnerability
CVSS severity 7.5high
Added Jul 20, 2023
Rank 59
Oracle WebLogic ServerCVE-2023-21839
Oracle WebLogic Server Unspecified Vulnerability
CVSS severity 7.5high
Added May 1, 2023
Rank 60
Red Hat JBoss Application Server / EAPCVE-2010-1428
Red Hat JBoss Information Disclosure Vulnerability
RansomwareCVE from 2010, added in 2022
CVSS severity 7.5high
Added May 25, 2022
Rank 61
Adobe ColdFusionCVE-2013-0629
Adobe ColdFusion Directory Traversal Vulnerability
CVE from 2013, added in 2022
CVSS severity 7.5high
Added Mar 7, 2022
Rank 62
Adobe ColdFusionCVE-2013-0631
Adobe ColdFusion Information Disclosure Vulnerability
CVE from 2013, added in 2022
CVSS severity 7.5high
Added Mar 7, 2022
Rank 63
Oracle WebLogic ServerCVE-2017-10271
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
RansomwareCVE from 2017, added in 2022
CVSS severity 7.5high
Added Feb 10, 2022
Rank 64
Adobe ColdFusionCVE-2024-20767
Adobe ColdFusion Improper Access Control Vulnerability
CVSS severity 7.4high
Added Dec 16, 2024
Rank 65
Oracle WebLogic ServerCVE-2017-3506
Oracle WebLogic Server OS Command Injection Vulnerability
CVE from 2017, added in 2024
CVSS severity 7.4high
Added Jun 3, 2024
Rank 66
Oracle WebLogic ServerCVE-2020-14883
Oracle WebLogic Server Unspecified Vulnerability
CVSS severity 7.2high
Added Nov 3, 2021
Rank 67
Red Hat JBoss Application Server / EAPCVE-2010-0738
Red Hat JBoss Authentication Bypass Vulnerability
RansomwareCVE from 2010, added in 2022
CVSS severity 5.3medium
Added May 25, 2022

Filed under another category

These 2 vulnerabilities also concern this type of product, but are counted in their main category. My radar finds them when you follow this category.

Oracle ADF FacesCVE-2022-21445
Oracle ADF Faces Deserialization of Untrusted Data Vulnerability
CVE from 2022, added in 2024
CVSS severity 9.8critical
Added Sep 18, 2024
Adobe BlazeDSCVE-2009-3960
Adobe BlazeDS Information Disclosure Vulnerability
RansomwareCVE from 2009, added in 2022
CVSS severity 6.5medium
Added Mar 7, 2022

Get new vulnerabilities in this category: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

Pace of additions

Affected brands

See also

Patch first

Filed under another category

Follow and verify