CyberSIXT Search
Vendor

Apache

No CISA KEV deadline is open. CISA last added an Apache CVE on 8 Oct.

Tracked since 22 Jan · latest article Mon 26 Oct · RSS

No product called by that name is recorded for this vendor.

Added to KEV · 90 days
2
of 41 in the full CISA catalogue · all time
High exploit odds · current
4
EPSS top 5%, not in KEV

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2016-3081Struts8 OctDeadline passed 11 Oct5 articles
CVE-2026-34486Tomcat4 AugDeadline passed 7 Aug7 articles
CVE-2026-34197ActiveMQ16 AprDeadline passed 30 Apr2 articles
CVE-2024-38475not in CyberSIXT coverageHTTP Server1 May 2025Deadline passed 22 May 2025
CVE-2025-24813not in CyberSIXT coverageTomcat1 Apr 2025Deadline passed 22 Apr 2025
CVE-2024-45195not in CyberSIXT coverageOFBiz4 Feb 2025Deadline passed 25 Feb 2025
CVE-2024-27348not in CyberSIXT coverageHugeGraph-Server18 Sep 2024Deadline passed 9 Oct 2024
CVE-2024-38856not in CyberSIXT coverageOFBiz27 Aug 2024Deadline passed 17 Sep 2024
CVE-2024-32113not in CyberSIXT coverageOFBiz7 Aug 2024Deadline passed 28 Aug 2024
CVE-2020-17519not in CyberSIXT coverageFlink23 May 2024Deadline passed 13 Jun 2024
31 more listed entries
CVE-2023-27524not in CyberSIXT coverageSuperset8 Jan 2024Deadline passed 29 Jan 2024
CVE-2023-46604ActiveMQ2 Nov 2023Deadline passed 23 Nov 2023Known ransomware use · 1 article
CVE-2023-33246not in CyberSIXT coverageRocketMQ6 Sep 2023Deadline passed 27 Sep 2023
CVE-2016-8735not in CyberSIXT coverageTomcat12 May 2023Deadline passed 2 Jun 2023
CVE-2021-45046not in CyberSIXT coverageLog4j21 May 2023Deadline passed 22 May 2023Known ransomware use
CVE-2022-33891not in CyberSIXT coverageSpark7 Mar 2023Deadline passed 28 Mar 2023
CVE-2022-24112not in CyberSIXT coverageAPISIX25 Aug 2022Deadline passed 15 Sep 2022
CVE-2022-24706not in CyberSIXT coverageCouchDB25 Aug 2022Deadline passed 15 Sep 2022
CVE-2013-2251not in CyberSIXT coverageStruts25 Mar 2022Deadline passed 15 Apr 2022
CVE-2017-12615not in CyberSIXT coverageTomcat25 Mar 2022Deadline passed 15 Apr 2022Known ransomware use
CVE-2017-12617not in CyberSIXT coverageTomcat25 Mar 2022Deadline passed 15 Apr 2022
CVE-2020-1956not in CyberSIXT coverageKylin25 Mar 2022Deadline passed 15 Apr 2022
CVE-2020-1938not in CyberSIXT coverageTomcat3 Mar 2022Deadline passed 17 Mar 2022
CVE-2016-3088not in CyberSIXT coverageActiveMQ10 Feb 2022Deadline passed 10 Aug 2022
CVE-2017-9791not in CyberSIXT coverageStruts 110 Feb 2022Deadline passed 10 Aug 2022
CVE-2006-1547not in CyberSIXT coverageStruts 121 Jan 2022Deadline passed 21 Jul 2022
CVE-2012-0391not in CyberSIXT coverageStruts 221 Jan 2022Deadline passed 21 Jul 2022
CVE-2020-11978not in CyberSIXT coverageAirflow18 Jan 2022Deadline passed 18 Jul 2022
CVE-2020-13927not in CyberSIXT coverageAirflow's Experimental API18 Jan 2022Deadline passed 18 Jul 2022
CVE-2021-44228not in CyberSIXT coverageLog4j210 Dec 2021Deadline passed 24 Dec 2021Known ransomware use
CVE-2019-0193not in CyberSIXT coverageSolr10 Dec 2021Deadline passed 10 Jun 2022
CVE-2021-40438not in CyberSIXT coverageApache1 Dec 2021Deadline passed 15 Dec 2021Known ransomware use
CVE-2021-41773not in CyberSIXT coverageHTTP Server3 Nov 2021Deadline passed 17 Nov 2021Known ransomware use
CVE-2021-42013not in CyberSIXT coverageHTTP Server3 Nov 2021Deadline passed 17 Nov 2021Known ransomware use
CVE-2016-4437not in CyberSIXT coverageShiro3 Nov 2021Deadline passed 3 May 2022
CVE-2017-5638Struts3 Nov 2021Deadline passed 3 May 2022Known ransomware use · 1 article
CVE-2017-9805not in CyberSIXT coverageStruts3 Nov 2021Deadline passed 3 May 2022
CVE-2018-11776not in CyberSIXT coverageStruts3 Nov 2021Deadline passed 3 May 2022
CVE-2019-0211not in CyberSIXT coverageHTTP Server3 Nov 2021Deadline passed 3 May 2022
CVE-2019-17558not in CyberSIXT coverageSolr3 Nov 2021Deadline passed 3 May 2022
CVE-2020-17530not in CyberSIXT coverageStruts3 Nov 2021Deadline passed 3 May 2022

Products

40 products · 213 CVEs in coverage
Struts11 CVEs · 9 in KEVlatest 11 OctTomcat15 CVEs · 6 in KEVlatest 23 OctHTTP Server16 CVEs · 4 in KEVlatest 2 OctActiveMQ6 CVEs · 3 in KEVlatest 2 JunOFBiz0 CVEs · 3 in KEV
35 more productsSolr1 CVE · 2 in KEVlatest 3 JunLog4j20 CVEs · 2 in KEVCouchDB5 CVEs · 1 in KEVlatest 21 OctKylin1 CVE · 1 in KEVlatest 19 OctAPISIX1 CVE · 1 in KEVlatest 8 JulShiro1 CVE · 1 in KEVlatest 17 JunAirflow1 CVE · 1 in KEVlatest 4 JunAirflow's Experimental API0 CVEs · 1 in KEVFlink0 CVEs · 1 in KEVSpark0 CVEs · 1 in KEVSuperset0 CVEs · 1 in KEVRocketMQ0 CVEs · 1 in KEVHugeGraph-Server0 CVEs · 1 in KEVSyncope10 CVEs · 0 in KEVlatest 16 SepMINA SSHD6 CVEs · 0 in KEVlatest 23 OctbRPC6 CVEs · 0 in KEVlatest 22 OctDolphinScheduler6 CVEs · 0 in KEVlatest 8 OctQpid Broker-J6 CVEs · 0 in KEVlatest 25 SepAnswer6 CVEs · 0 in KEVlatest 12 JunCamel5 CVEs · 0 in KEVlatest 26 OctIoTDB5 CVEs · 0 in KEVlatest 22 OctThrift5 CVEs · 0 in KEVlatest 6 OctKaraf5 CVEs · 0 in KEVlatest 29 SepArtemis5 CVEs · 0 in KEVlatest 10 SepDirectory LDAP API4 CVEs · 0 in KEVlatest 3 OctImpala4 CVEs · 0 in KEVlatest 9 SepAllura4 CVEs · 0 in KEVlatest 4 SepActiveMQ Broker4 CVEs · 0 in KEVlatest 28 JulCXF4 CVEs · 0 in KEVlatest 13 JunTraffic Server3 CVEs · 0 in KEVlatest 22 OctPulsar3 CVEs · 0 in KEVlatest 22 OctDoris3 CVEs · 0 in KEVlatest 23 SepNiFi3 CVEs · 0 in KEVlatest 17 SepZooKeeper3 CVEs · 0 in KEVlatest 16 SepStorm Nimbus3 CVEs · 0 in KEVlatest 14 Sep

Coverage

92 articles · all timeFull timeline

92 articles from 7 outlets; 8 in the last 7 days.

Apache: coverage over time92 articles from 7 outlets. Busiest week: 12 articles, week of 5 Oct. 8 in the last 7 days. Apache: coverage over time92 articles from 7 outlets. Busiest week: 12 articles, week of 5 Oct. 8 in the last 7 days.
  • Article
  • Official notice
Show as table
Apache: articles
Published (UTC)OutletHeadline
Mon 26 Oct · 03:21 UTCSecurityOnlineApache Camel fixes eight flaws, including an XXE vulnerability
Fri 23 Oct · 08:36 UTCSecurityWeekAtlassian Flags 162 High and 14 Critical Flaws in Server Products
Thu 22 Oct · 02:53 UTCSecurityOnlineApache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoS
Thu 22 Oct · 02:43 UTCSecurityOnlineApache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk
Thu 22 Oct · 02:43 UTCSecurityOnlineApache Pulsar Flaws Enable Token Bypass and Cross Tenant Access
Wed 21 Oct · 11:01 UTCSecurityOnlineAtlassian patches 176 flaws across Jira and Confluence products
Wed 21 Oct · 06:01 UTCSecurityOnlineCritical CouchDB Flaw Lets Admins Run Shell Commands, Apache Warns
Wed 21 Oct · 03:01 UTCSecurityOnlineApache Tomcat fixes authentication bypass and data leaks in key releases
Mon 19 Oct · 01:44 UTCSecurityOnlineApache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade
Sun 11 Oct · 10:01 UTCSecurity AffairsCISA Flags Five Exploited Flaws in China Linked Cyber Campaign
Fri 9 Oct · 18:13 UTCSecurityOnlineApache Camel Karavan flaws could let attackers hijack Kubernetes deployments
Fri 9 Oct · 12:50 UTCThe Hacker NewsCISA Adds Five Flaws to KEV After Flax Typhoon Attacks
Fri 9 Oct · 07:31 UTCSecurityOnlineCISA Flags Five Actively Exploited Flaws in Enterprise Tools
Thu 8 Oct · 19:02 UTCCISACISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching
Thu 8 Oct · 18:48 UTCThe Hacker NewsChina-Based Hackers Accused of Stealing Emails Across 7 Countries
Thu 8 Oct · 05:11 UTCSecurityOnlineApache DolphinScheduler Fixes Six Flaws Exposing Credentials and Data
Wed 7 Oct · 18:01 UTCSecurityOnlineApache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions
Tue 6 Oct · 12:29 UTCThe Hacker NewsLibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open
Tue 6 Oct · 02:00 UTCSecurityOnlineApache Thrift fixes 61 flaws, including unauthenticated critical bugs
Mon 5 Oct · 15:35 UTCSecurityOnlineApache Struts fixes four flaws, including remote code execution risk
Mon 5 Oct · 12:07 UTCSOCRadarDark Web Claims Expose 10 Million French Records and More
Sat 3 Oct · 06:30 UTCSecurityOnlineApache OpenOffice Flaw Enables Code Execution Through Crafted Documents
Fri 2 Oct · 03:36 UTCSecurityOnlineApache Fixes 20 Flaws Including Critical mod_vhost_alias Bug
Thu 1 Oct · 02:13 UTCSecurityOnlineApache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.1
Thu 1 Oct · 02:13 UTCSecurityOnlineApache WSS4J Flaws Let Attackers Forge Authenticated Messages
Wed 30 Sep · 10:13 UTCSecurityOnlineCritical Apache PLC4X Flaw Enables OPC UA Server Impersonation
Tue 29 Sep · 05:20 UTCSecurityOnlineApache Karaf Flaws Let Low-Privilege Users Seize Admin Access
Fri 25 Sep · 19:22 UTCSecurityOnlineApache Qpid Broker-J Fixes Six Flaws, Including Critical Session Bug
Wed 23 Sep · 20:38 UTCSecurityOnlineApache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoS
Wed 23 Sep · 17:38 UTCSecurityOnlineApache Doris Fixes Flaws Exposing Cluster Data and Enabling RCE
Thu 17 Sep · 11:54 UTCSecurityOnlineApache Fixes NiFi Path Traversal and Denial of Service Flaws
Wed 16 Sep · 05:00 UTCSecurityOnlineApache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof Logs
Wed 16 Sep · 03:13 UTCSecurityOnlineApache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox Escape
Mon 14 Sep · 03:11 UTCSecurityOnlineApache Storm Fixes 17 Flaws Enabling Root Access and Data Theft
Fri 11 Sep · 14:42 UTCSecurityOnlineApache Camel K Patches Critical Flaws Enabling Code Execution
Thu 10 Sep · 03:30 UTCSecurityOnlineApache Artemis Flaws Let Attackers Steal Sessions and Expose Credentials
Wed 9 Sep · 05:50 UTCSecurityOnlineCVE-2026-41870: Unauthenticated RCE in Apache Nutch
Wed 9 Sep · 05:49 UTCSecurityOnlineApache Impala Flaws Let Attackers Seize Analytics Clusters Remotely
Fri 4 Sep · 04:35 UTCSecurityOnlineApache Allura Fixes Four Flaws That Could Expose Repositories
Fri 21 Aug · 17:10 UTCSecurityOnlineApache CloudStack patches critical KVM RCE flaw CVE-2026-50112
Thu 20 Aug · 18:02 UTCSecurityOnlineCVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0
Tue 18 Aug · 13:41 UTCSecurityOnlineApache HttpClient bug lets attackers hijack traffic, update urged
Sat 15 Aug · 15:00 UTCSecurityOnlineApache patches five Struts 2 bugs, warns of remote DoS and leaks
Wed 5 Aug · 16:29 UTCSecurity AffairsCISA Flags Critical Flaws in IBM Langflow, N able and Tomcat
Wed 5 Aug · 10:11 UTCSecurityWeekCISA warns of exploits in IBM Langflow, Nable, and Tomcat flaws
Wed 5 Aug · 09:01 UTCSecurityOnlineApple tightens bug bounty amid surge of AI generated flaw reports
Wed 5 Aug · 03:51 UTCSecurityOnlineN-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog
Tue 4 Aug · 17:05 UTCCISACISA Adds Apache Tomcat Flaw CVE-2026-34486 to KEV Catalog
Tue 4 Aug · 16:55 UTCCISACISA warns Apache Tomcat flaw CVE-2026-34486 risks data
Tue 4 Aug · 03:21 UTCSecurityOnlineApache NiFi flaws enable code execution and auth bypass

Who reported 7 outlets, last 12 months

  • SecurityOnline71
  • The Hacker News6
  • SecurityWeek5
  • SOCRadar3
  • Security Affairs3
  • CISA3
  • Infosecurity1
  1. Apache Camel fixes eight flaws, including an XXE vulnerabilitySecurityOnline
  2. Atlassian Flags 162 High and 14 Critical Flaws in Server ProductsSecurityWeek
  3. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoSSecurityOnline
  4. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE RiskSecurityOnline
  5. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant AccessSecurityOnline
  6. Atlassian patches 176 flaws across Jira and Confluence productsSecurityOnline
  7. Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache WarnsSecurityOnline
  8. Apache Tomcat fixes authentication bypass and data leaks in key releasesSecurityOnline
  9. Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent UpgradeSecurityOnline
  10. CISA Flags Five Exploited Flaws in China Linked Cyber CampaignSecurity Affairs

Named in the same articles

Threat actors · articles in common
Integrity Technology Group 2Flax Typhoon 1

All CVEs in coverage

213
CVE-2017-5638Apache Struts Remote Code Execution VulnerabilityCVSS9.8CriticalExploited99.9%EPSS1article
CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityCVSS10.0CriticalExploited99.8%EPSS1article
CVE-2026-34486Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityCVSS9.8CriticalExploited99%EPSS7articles
CVE-2026-34197Apache ActiveMQ Improper Input Validation VulnerabilityCVSS8.8HighExploited98%EPSS2articles
CVE-2016-3081Apache Struts Command Injection VulnerabilityCVSS8.1HighExploited97%EPSS5articles
CVE-2025-66516Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affectedCVSSUnrated–Not in KEV89%EPSS1article
CVE-2022-41678Apache Software Foundation Apache ActiveMQ vulnerabilityCVSSUnrated–Not in KEV86%EPSS1article
CVE-2019-17571Apache Software Foundation Log4j vulnerabilityCVSSUnrated–Not in KEV70%EPSS2articles
CVE-2026-23918Apache Software Foundation Apache HTTP Server vulnerabilityCVSS8.8High–Not in KEV50%EPSS3articles
CVE-2024-32114Apache Software Foundation Apache ActiveMQ vulnerabilityCVSS8.5High–Not in KEV7.2%EPSS2articles
CVE-2026-44825Apache Software Foundation Apache Solr vulnerabilityCVSS8.1High–Not in KEV3.9%EPSS1article
CVE-2026-35152Apache Software Foundation Apache Fineract vulnerabilityCVSS8.8High–Not in KEV3.3%EPSS1article
188 more CVEs
CVE-2026-55957Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bindCVSS7.3High–Not in KEV2.9%EPSS1article
CVE-2026-23795Apache Syncope: Console XXE on Keymaster parametersCVSSUnrated–Not in KEV1.9%EPSS1article
CVE-2026-57967Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachmentCVSSUnrated–Not in KEV1.5%EPSS1article
CVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapperCVSSUnrated–Not in KEV1.4%EPSS1article
CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()CVSS9.8Critical–Not in KEV1.4%EPSS1article
CVE-2026-50633Apache Software Foundation Apache CXF vulnerabilityCVSS8.1High–Not in KEV1.3%EPSS1article
CVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflowCVSS7.5High–Not in KEV1.2%EPSS1article
CVE-2026-23906Apache Druid: Authentication Bypass via LDAP Anonymous BindCVSSUnrated–Not in KEV1.1%EPSS1article
CVE-2026-42253Apache Software Foundation Apache ActiveMQ vulnerabilityCVSS6.1Medium–Not in KEV1.1%EPSS1article
CVE-2026-80351Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator podCVSS9.8Critical–Not in KEV1.0%EPSS1article
CVE-2026-63292Apache HTTP Server: mod_vhost_alias stack overflowCVSS7.5High–Not in KEV0.9%EPSS1article
CVE-2025-27821HDFS native client: Out of bounds write in URI parser of native HDFS clientCVSSUnrated–Not in KEV0.9%EPSS1article
CVE-2026-54428Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKCVSS7.5High–Not in KEV0.9%EPSS1article
CVE-2026-67593Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletionCVSSUnrated–Not in KEV0.9%EPSS1article
CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parametersCVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2026-80352Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objectsCVSS9.8Critical–Not in KEV0.8%EPSS1article
CVE-2026-57308Apache Syncope: SQL injection vulnerability in Audit Events searchCVSS9.8Critical–Not in KEV0.8%EPSS1article
CVE-2026-49362Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue CreationCVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2026-63043Apache InLong: Agent path traversal via unvalidated file source pathCVSS7.5High–Not in KEV0.8%EPSS1article
CVE-2026-24343Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsCVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2026-87976Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension BundlesCVSS7.2High–Not in KEV0.8%EPSS1article
CVE-2026-59878Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoSCVSS7.5High–Not in KEV0.8%EPSS1article
CVE-2026-54399Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default ConfigurationCVSS7.5High–Not in KEV0.8%EPSS1article
CVE-2026-45249Apache Software Foundation Apache ECharts vulnerabilityCVSS6.1Medium–Not in KEV0.8%EPSS1article
CVE-2026-58319Apache Software Foundation Apache Doris vulnerabilityCVSS9.1Critical–Not in KEV0.8%EPSS1article
CVE-2026-41871Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)CVSSUnrated–Not in KEV0.8%EPSS1article
CVE-2026-57821Apache Software Foundation Apache Fineract vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-42588Apache Software Foundation Apache ActiveMQ Broker vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-24012Apache Software Foundation Apache IoTDB vulnerabilityCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-68981Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsCVSS8.8High–Not in KEV0.7%EPSS1article
CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensCVSS9.3Critical–Not in KEV0.7%EPSS1article
CVE-2026-47430Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViewsCVSS9.5Critical–Not in KEV0.7%EPSS1article
CVE-2026-50112Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templatesCVSS8.8High–Not in KEV0.7%EPSS1article
CVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflowCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-50628Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security ControlCVSS9.8Critical–Not in KEV0.7%EPSS0articles
CVE-2026-57822Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of serviceCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-105944Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of lifeCVSS10.0Critical–Not in KEV0.7%EPSS1article
CVE-2026-73633Apache Struts: Unbounded read of a JSON request bodyCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-82428Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob KeysCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-24014Apache Software Foundation Apache IoTDB vulnerabilityCVSS9.8Critical–Not in KEV0.7%EPSS1article
CVE-2026-62183Apache Syncope: User self-service privilege escalationCVSS9.8Critical–Not in KEV0.7%EPSS1article
CVE-2026-24735Apache Answer: Revision API Improper Access Control leads to Information DisclosureCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-63038Apache InLong: SQL Injection via String Concatenation Vulnerability ReportCVSS9.8Critical–Not in KEV0.7%EPSS1article
CVE-2026-24656Apache Karaf: Decanter log-socket collector has deserialization vulnerabilityCVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-77791Apache Tomcat: DoS via busy wait during WebSocket closeCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-45360Apache Software Foundation Apache Airflow vulnerabilityCVSS7.3High–Not in KEV0.7%EPSS1article
CVE-2026-31377Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta ServiceCVSS7.5High–Not in KEV0.7%EPSS1article
CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionCVSS7.7High–Not in KEV0.7%EPSS1article
CVE-2026-41870Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)CVSSUnrated–Not in KEV0.7%EPSS1article
CVE-2026-24072Apache Software Foundation Apache HTTP Server vulnerabilityCVSS8.8High–Not in KEV0.7%EPSS1article
CVE-2026-56287Apache Software Foundation Apache Fineract vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-90799Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence valuesCVSS1.3Low–Not in KEV0.6%EPSS1article
CVE-2026-24013Apache Software Foundation Apache IoTDB vulnerabilityCVSS9.1Critical–Not in KEV0.6%EPSS1article
CVE-2026-39999Apache APISIX: JWT Algorithm Confusion allows authentication bypassCVSS7.0High–Not in KEV0.6%EPSS1article
CVE-2026-90800Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesCVSS8.1High–Not in KEV0.6%EPSS1article
CVE-2026-29168Apache HTTP Server: mod_md unrestricted OCSP responseCVSS7.3High–Not in KEV0.6%EPSS1article
CVE-2026-91012Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege EscalationCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsCVSS9.1Critical–Not in KEV0.6%EPSS1article
CVE-2026-70469Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteCVSS9.8Critical–Not in KEV0.6%EPSS2articles
CVE-2026-86471Apache CouchDB: Admin credentials leading to code execution as operating system userCVSS9.3Critical–Not in KEV0.6%EPSS1article
CVE-2026-92142Apache Karaf: Authorization bypass in JMX MBean lifecycle operationsCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-79993Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znodeCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-82232Apache Syncope: SQL injection via sort parameter in Task searchCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-45505Apache Software Foundation Apache ActiveMQ Broker vulnerabilityCVSS8.8High–Not in KEV0.6%EPSS1article
CVE-2026-94134Apache Software Foundation Apache Airflow SSH provider vulnerabilityCVSS9.1Critical–Not in KEV0.6%EPSS0articles
CVE-2026-49844Apache Software Foundation Apache Log4j API vulnerabilityCVSS6.3Medium–Not in KEV0.6%EPSS1article
CVE-2026-107755Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLsCVSS6.0Medium–Not in KEV0.6%EPSS1article
CVE-2026-29169Apache Software Foundation Apache HTTP Server vulnerabilityCVSS7.5High–Not in KEV0.6%EPSS1article
CVE-2026-59265Apache Software Foundation Apache OpenOffice vulnerabilityCVSSUnrated–Not in KEV0.6%EPSS2articles
CVE-2026-103119Apache Tomcat: AJP response mix-upCVSS9.1Critical–Not in KEV0.6%EPSS1article
CVE-2026-88920Apache WSS4J: SAML Sender-Vouches Authentication BypassCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-76646Apache MyFaces: Denial of Service via Unbounded Request ParsingCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-57866Apache Impala: Secrets Exfiltration via SSRFCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-48207Apache Software Foundation Apache Fory vulnerabilityCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-57941Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancyCVSS9.8Critical–Not in KEV0.6%EPSS1article
CVE-2026-76183Apache Tomcat: Bypass of security constraints for WebSocket endpointsCVSS9.8Critical–Not in KEV0.6%EPSS0articles
CVE-2026-49364Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered PeersCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-54475Apache Software Foundation Apache ActiveMQ Broker vulnerabilityCVSS7.5High–Not in KEV0.6%EPSS1article
CVE-2025-66336Apache Doris MCP Server: SQL injection leading the authentication bypassCVSS8.1High–Not in KEV0.6%EPSS1article
CVE-2026-104713Apache Struts: Unbounded request body read in the REST pluginCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-59739Apache ZooKeeper: Information disclosure via SetWatches reconnect replayCVSSUnrated–Not in KEV0.6%EPSS1article
CVE-2026-92415Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodiesCVSS6.9Medium–Not in KEV0.6%EPSS1article
CVE-2026-91048Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-createCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-54048Apache Impala: Avro Schema URL Server-Side Request ForgeryCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflateCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintCVSS9.1Critical–Not in KEV0.5%EPSS2articles
CVE-2026-56154Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}CVSS9.8Critical–Not in KEV0.5%EPSS0articles
CVE-2026-49328Apache Software Foundation Apache Fesod (Incubating) vulnerabilityCVSS5.3Medium–Not in KEV0.5%EPSS1article
CVE-2026-65181Apache Impala: RCE via External Data Source Class LoadingCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-92560Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoderCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requestsCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2025-48977Apache Software Foundation Apache Ignite vulnerabilityCVSS8.5High–Not in KEV0.5%EPSS1article
CVE-2026-50076Apache Fory: Java ReplaceResolverSerializer deserialization checks bypassCVSS9.1Critical–Not in KEV0.5%EPSS1article
CVE-2026-49875Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-103412Apache Software Foundation Apache Camel Karavan vulnerabilityCVSS8.8High–Not in KEV0.5%EPSS0articles
CVE-2026-33007Apache Software Foundation Apache HTTP Server vulnerabilityCVSS5.3Medium–Not in KEV0.5%EPSS1article
CVE-2026-23794Apache Syncope: Reflected XSS on Enduser LoginCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-49268Apache Shiro: LDAP DN Injection in DefaultLdapRealmCVSS8.8High–Not in KEV0.5%EPSS1article
CVE-2026-73470Apache Syncope: Delegating users can grant unowned RolesCVSS9.8Critical–Not in KEV0.5%EPSS1article
CVE-2026-47065Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232CVSS9.8Critical–Not in KEV0.5%EPSS1article
CVE-2026-63044Apache InLong: Authenticated SSRF via POST /api/node/testConnectionCVSS5.4Medium–Not in KEV0.5%EPSS1article
CVE-2026-78383Apache Tomcat: AJP DoS via missing request bodyCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processingCVSS9.1Critical–Not in KEV0.5%EPSS1article
CVE-2026-80354Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespaceCVSS8.1High–Not in KEV0.5%EPSS1article
CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledCVSS9.8Critical–Not in KEV0.5%EPSS1article
CVE-2026-105945Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package StorageCVSS7.7High–Not in KEV0.5%EPSS1article
CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsCVSS9.1Critical–Not in KEV0.5%EPSS2articles
CVE-2026-108089Apache Cocoon: Unauthenticated access to diagnostic interfacesCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-111813Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configurationCVSS10.0Critical–Not in KEV0.5%EPSS1article
CVE-2026-47321Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-59797Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-functionCVSS9.8Critical–Not in KEV0.5%EPSS0articles
CVE-2026-92550Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoderCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-46752Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()CVSS10.0Critical–Not in KEV0.5%EPSS1article
CVE-2026-33582Apache Software Foundation Apache Answer vulnerabilityCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-92564Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingCVSSUnrated–Not in KEV0.5%EPSS0articles
CVE-2026-103877Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elementsCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-92608Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10CVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-59685Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEMCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-80181Apache Allura: Server-side request forgeryCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-61487Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinationsCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-56207Apache Impala: SAML authentication bypass via forged bearer tokenCVSSUnrated–Not in KEV0.5%EPSS1article
CVE-2026-64607Apache Software Foundation Apache HttpComponents Client vulnerabilityCVSS5.3Medium–Not in KEV0.5%EPSS1article
CVE-2026-62354Apache NiFi: Incorrect Authorization for Parameter Context Validation RequestsCVSS7.7High–Not in KEV0.5%EPSS1article
CVE-2026-77147Apache Syncope: Groovy Sandbox escape for empty CommandArgsCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-96443Apache Doris: JDBC driver URL validation bypass leads to remote code executionCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-25700Apache Software Foundation Apache Answer vulnerabilityCVSS7.2High–Not in KEV0.5%EPSS1article
CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request localeCVSS7.5High–Not in KEV0.5%EPSS1article
CVE-2026-49157Apache Software Foundation Apache ActiveMQ vulnerabilityCVSS8.8High–Not in KEV0.4%EPSS1article
CVE-2026-84179Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology PageCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-92609Apache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationCVSS9.8Critical–Not in KEV0.4%EPSS1article
CVE-2026-73178Apache Syncope: JWT Access Token takeoverCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-61373Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocationCVSS8.7High–Not in KEV0.4%EPSS1article
CVE-2026-102731Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decodeCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-93546Apache HTTP Server: mod_dav_fs namespace overflowCVSS8.8High–Not in KEV0.4%EPSS1article
CVE-2026-87779Apache Syncope: AES Secret Key disclosure via log outputCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-81270Apache Allura: Information exposure via searchCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation reportCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-82426Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar LocationCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-42356Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directoriesCVSS3.7Low–Not in KEV0.4%EPSS1article
CVE-2026-63772Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform countCVSS8.7High–Not in KEV0.4%EPSS1article
CVE-2026-64959Apache Kylin: Missing authentication on certain cache API endpointsCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-42528Apache HTTP Server: mod_dav shared lock overflowCVSS4.3Medium–Not in KEV0.4%EPSS1article
CVE-2026-95616Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensionsCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-25699Apache Software Foundation Apache Answer vulnerabilityCVSS6.1Medium–Not in KEV0.4%EPSS1article
CVE-2026-25688Apache Software Foundation Apache Answer vulnerabilityCVSS6.1Medium–Not in KEV0.4%EPSS1article
CVE-2026-92573Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON renderingCVSS6.5Medium–Not in KEV0.4%EPSS0articles
CVE-2026-77185Apache MINA SSHD: Asynchronous authentication can bypass signature verificationCVSS9.1Critical–Not in KEV0.4%EPSS1article
CVE-2026-103413Apache Software Foundation Apache Camel Karavan vulnerabilityCVSS8.8High–Not in KEV0.4%EPSS0articles
CVE-2026-94135Apache Software Foundation Apache Airflow SFTP provider vulnerabilityCVSS4.3Medium–Not in KEV0.4%EPSS0articles
CVE-2026-73631Apache Struts: Shared parsing state in the JSON pluginCVSS4.3Medium–Not in KEV0.4%EPSS1article
CVE-2026-73632Apache Struts: Shared serialization state in the JSON pluginCVSS4.3Medium–Not in KEV0.4%EPSS1article
CVE-2026-91085Apache Karaf: config:install missing ACL entry allows privilege escalation to adminCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-96806Apache Software Foundation Apache Airflow Keycloak provider vulnerabilityCVSS5.8Medium–Not in KEV0.4%EPSS0articles
CVE-2026-83632Apache Thrift: C++ THttpTransport grows its line buffer without boundCVSS9.2Critical–Not in KEV0.4%EPSS1article
CVE-2026-94052Apache MINA SSHD: LDAP password authentication ineffectiveCVSS9.1Critical–Not in KEV0.4%EPSS1article
CVE-2026-41566Apache Kvrocks: Improper permission for the APPLYBATCH commandCVSS9.4Critical–Not in KEV0.4%EPSS1article
CVE-2026-94053Apache MINA SSHD: LDAP injection in sshd-ldapCVSS9.1Critical–Not in KEV0.4%EPSS1article
CVE-2026-73236Apache Syncope: Cross-Realm authorization bypass in delegated administrationCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-94002Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesCVSS7.5High–Not in KEV0.4%EPSS1article
CVE-2026-111811Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authenticationCVSS9.4Critical–Not in KEV0.4%EPSS0articles
CVE-2026-91135Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)CVSS9.2Critical–Not in KEV0.3%EPSS1article
CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)CVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-34033Apache Answer: HTML Content Injection in EmailCVSS5.4Medium–Not in KEV0.3%EPSS1article
CVE-2026-71290Apache Software Foundation Apache HttpComponents Client vulnerabilityCVSS9.1Critical–Not in KEV0.3%EPSS1article
CVE-2026-59969Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-103552Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoderCVSS7.3High–Not in KEV0.3%EPSS1article
CVE-2026-66084Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream EndpointCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-86249Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.authCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-94029Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extensionCVSS6.5Medium–Not in KEV0.3%EPSS1article
CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upCVSS9.1Critical–Not in KEV0.3%EPSS1article
CVE-2026-105869Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user roleCVSS9.2Critical–Not in KEV0.3%EPSS1article
CVE-2026-93994Apache MINA SSHD: Repeated-publickey policy bypass on serverCVSS8.1High–Not in KEV0.3%EPSS1article
CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-66082Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）CVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-102795Apache Traffic Server: SNI to Host header matching policy is not properly enforcedCVSS9.3Critical–Not in KEV0.3%EPSS1article
CVE-2026-50634Apache Software Foundation Apache CXF vulnerabilityCVSS6.5Medium–Not in KEV0.3%EPSS1article
CVE-2026-66087Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint EndpointCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-58663Apache IoTDB: Auth Bypass in pipeTransfer() interfaceCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-48830Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requestsCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-80180Apache Allura: Stored XSS via markdown HTML processingCVSS6.1Medium–Not in KEV0.3%EPSS1article
CVE-2026-78334Apache bRPC: Missing Authentication for Streaming RPC FramesCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-71896Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account InformationCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-80190Apache Allura: Stored XSS via code repositoriesCVSS6.1Medium–Not in KEV0.3%EPSS1article
CVE-2026-59229Apache IoTDB: Legacy Pipe Privilege EscalationCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed requestCVSS7.3High–Not in KEV0.3%EPSS1article
CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryCVSSUnrated–Not in KEV0.2%EPSS1article
CVE-2026-105937Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic dataCVSS8.7High–Not in KEV0.2%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device