Exploited vulnerabilities

Last updated: November 3, 2026

Vulnerabilities that attackers exploit on the internet, with how to check whether a server is affected and the vendor's fix first, step by step. Then how InfraFence's virtual patch blocks the attack while you update.

There is a page only for the CVEs that InfraFence has a virtual patch for: a narrow ModSecurity rule built into the agent. A virtual patch blocks the known attack requests; it does not replace the update.

• CVE-2021-44228

  CVE-2021-44228 (Log4Shell): check and fix

  Apache Log4j 2 (log4j-core)

  Remote code execution in Apache Log4j 2 through JNDI lookups in logged text. Find every log4j-core, upgrade to 2.17.1 or later.

  CVSS 10.0 · CriticalCISA KEV

  Read the page

• CVE-2021-41773

  CVE-2021-41773: Apache 2.4.49 path traversal, check and fix

  Apache HTTP Server

  Path traversal in Apache HTTP Server 2.4.49 only: files outside the document root, and code execution with CGI. Upgrade to 2.4.51 or later.

  CVSS 9.8 · CriticalCISA KEV

  Read the page

• CVE-2021-42013

  CVE-2021-42013: Apache 2.4.50 path traversal, check and fix

  Apache HTTP Server

  The bypass of the 2.4.50 fix with double URL encoding, in Apache HTTP Server 2.4.49 and 2.4.50. Upgrade to 2.4.51 or later.

  CVSS 9.8 · CriticalCISA KEV

  Read the page

• CVE-2022-26134

  CVE-2022-26134: Confluence OGNL injection, check and fix

  Atlassian Confluence Server and Data Center

  Unauthenticated remote code execution in Confluence Server and Data Center through an OGNL expression in the URL path.

  CVSS 9.8 · CriticalCISA KEV

  Read the page

• CVE-2023-22527

  CVE-2023-22527: Confluence template injection, check and fix

  Atlassian Confluence Data Center and Server

  Unauthenticated remote code execution in out-of-date Confluence 8 Data Center and Server through a template endpoint. Atlassian lists no workaround.

  CVSS 9.8 · CriticalCISA KEV

  Read the page

• CVE-2017-5638

  CVE-2017-5638: Apache Struts 2 Content-Type RCE, check and fix

  Apache Struts 2

  Remote code execution through the Jakarta multipart parser of Apache Struts 2, with an OGNL expression in the Content-Type header.

  CVSS 9.8 · CriticalCISA KEV

  Read the page

• CVE-2023-23752

  CVE-2023-23752: Joomla 4 API information disclosure, check and fix

  Joomla! CMS

  An access check in Joomla 4.0.0 to 4.2.7 skipped with ?public=true: the API hands out the configuration, database credentials included.

  CVSS 5.3 · MediumCISA KEV

  Read the page

• CVE-2024-4577

  CVE-2024-4577: PHP-CGI argument injection, check and fix

  PHP (PHP-CGI on Windows)

  PHP-CGI on Windows reads a soft hyphen in the query string as a dash, so the URL passes options to PHP. Linux is not affected; the scans reach it anyway.

  CVSS 9.8 · CriticalCISA KEV

  Read the page