Apache Software Foundation Apache Geode

Name: Apache Software Foundation Apache Geode
Brand: Apache Software Foundation

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical8high5medium0low

updated 2026-10-28

vulnerabilities (17)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2017-15692US	critical9.8	4.78% (92nd)	—	no fix	2018-02-27	≤ 1.0.0 to 1.3.0
CVE-2017-9795US	high7.5	4.18% (91st)	—	no fix	2018-01-10	≤ 1.0.0 to 1.2.1
CVE-2017-5649US	high7.5	2.78% (86th)	—	no fix	2017-04-04	≤ 1.1.0
CVE-2022-37021US	critical9.8	2.64% (85th)	—	no fix	2022-08-31	≤ Apache Geode ≤1.12.5
CVE-2021-34797US	high7.5	2.51% (85th)	—	no fix	2022-01-04	≤ Apache Geode ≤1.12.4
CVE-2017-15695US	high8.8OT elevated	2.51% (85th)	—	no fix	2018-06-13	≤ 1.0.0 to 1.4.0
CVE-2017-15693US	high7.5	2.47% (84th)	—	no fix	2018-02-27	≤ 1.0.0 to 1.3.0
CVE-2017-12622US	high7.1	2.08% (81st)	—	no fix	2018-01-10	≤ 1.0.0 to 1.2.1
CVE-2017-15696US	high7.5	2.00% (81st)	—	no fix	2018-02-26	≤ Apache Geode 1.0.0 to 1.3.0
CVE-2022-37023US	medium6.5	1.78% (78th)	—	1.15.0	2022-08-31	Apache Geode → 1.15.0
CVE-2022-37022US	high8.8	1.51% (74th)	—	no fix	2022-08-31	≤ Apache Geode ≤1.12.2
CVE-2017-9796US	medium5.3	1.48% (74th)	—	no fix	2018-01-10	≤ 1.0.0 to 1.2.1
CVE-2022-34870US	medium5.4	1.38% (72nd)	—	no fix	2022-10-25	≤ Apache Geode ≤1.15.0
CVE-2017-9797US	medium6.5	1.36% (72nd)	—	no fix	2017-10-03	4 versions
CVE-2017-9794US	medium4.3	1.18% (67th)	—	no fix	2017-09-30	4 versions
CVE-2024-44088US	—	0.69% (53rd)	—	1.15.2	2025-10-14	1.1.0 → 1.15.2
CVE-2025-47410US	—	0.36% (29th)	—	1.15.2	2025-10-18	1.10.0 → 1.15.2

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor7 CVEs
CWE-502Deserialization of Untrusted Data5 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-532Insertion of Sensitive Information into Log File1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.