CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
Apache has 4,055 CVEs, 41 exploited. Pick a weakness or a product to list them.
By weakness
- Access Control464 · 4 exploited
- Denial of Service393
- Input Validation and Logic324 · 2 exploited
- Information Disclosure305
- Cross-site Scripting292
- Authentication287 · 2 exploited
- Memory Corruption279 · 1 exploited
- Injection and Smuggling233 · 3 exploited
- Deserialization and Object Injection214 · 3 exploited
- File and Path Handling208 · 8 exploited
- Command and Code Injection180 · 10 exploited
- Cryptography170 · 2 exploited
- Server-Side Request Forgery90 · 1 exploited
- SQL Injection80
- Cross-Site Request Forgery48
- Race Conditions41
- Other weaknesses32
- Misconfiguration and Insecure Design31 · 2 exploited
- Insecure Direct Object Reference28
- Open Redirect22
- Supply Chain and Malicious Code5
- No weakness recorded329 · 3 exploited
By product
- Http Server183
- Apache Airflow167 · 2 exploited
- Apache HTTP Server157 · 5 exploited
- Apache Tomcat150 · 6 exploited
- Tomcat135
- Apache Traffic Server118
- Apache Camel103
- Apache OFBiz103 · 3 exploited
- Apache Thrift93
- Apache Superset67 · 1 exploited
- Apache CXF59
- Struts57 · 2 exploited
- Apache NiFi55
- Apache CloudStack52
- Apache Syncope49
- Apache DolphinScheduler46
- Apache Kylin44
- Apache APISIX41 · 1 exploited
- Apache bRPC41
- Apache InLong41
- Apache TomEE41
- Apache Wicket41
- Apache OpenOffice40
- Apache Roller40
- Apache Answer37
- Apache Struts35 · 5 exploited
- Subversion34
- Apache ActiveMQ30 · 1 exploited
- Apache Pulsar30
- Apache JSPWiki29
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-14.