# Apache Activemq


- [CVE-2023-46604](https://insights.sbomify.com/CVE-2023-46604/): Apache ActiveMQ Deserialization of Untrusted Data (critical 10.0, exploited in the wild)
- [CVE-2016-3088](https://insights.sbomify.com/CVE-2016-3088/): Apache ActiveMQ Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2026-34197](https://insights.sbomify.com/CVE-2026-34197/): Apache ActiveMQ Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2020-11998](https://insights.sbomify.com/CVE-2020-11998/): Remote code execution in Apache ActiveMQ (critical 9.8)
- [CVE-2013-7285](https://insights.sbomify.com/CVE-2013-7285/): Command Injection in Xstream (critical 9.8)
- [CVE-2014-3600](https://insights.sbomify.com/CVE-2014-3600/): Improper Restriction of XML External Entity Reference in Apache ActiveMQ (critical 9.8)
- [CVE-2015-5254](https://insights.sbomify.com/CVE-2015-5254/): Improper Input Validation in Apache ActiveMQ (critical 9.8)
- [CVE-2026-45505](https://insights.sbomify.com/CVE-2026-45505/): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass (high 8.8)
- [CVE-2026-49157](https://insights.sbomify.com/CVE-2026-49157/): Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default (high 8.8)
- [CVE-2026-40466](https://insights.sbomify.com/CVE-2026-40466/): Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection (high 8.8)
- [CVE-2026-41044](https://insights.sbomify.com/CVE-2026-41044/): Apache ActiveMQ Vulnerable to Code Injection (high 8.8)
- [CVE-2022-41678](https://insights.sbomify.com/CVE-2022-41678/): Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/activemq/