Skip to content
Sign in

Vendor

Apache

Alert
No CISA KEV deadline is open. CISA last added an Apache CVE on 8 Oct.

Tracked since 22 Jan · latest article 3 Nov · RSS · API

That product is not in Apache’s coverage, so the whole vendor is shown.

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 41 in the full CISA catalogue · all time

4High exploit odds · current

EPSS top 5%, not in KEV

3Articles · 7 days

usual rate

Exploited, by due date41

Apache CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Apache CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2016-3081Struts8 OctPassed 11 Oct5
In CISA KEVCVE-2026-34486Tomcat4 AugPassed 7 Aug7
In CISA KEVCVE-2026-34197ActiveMQ16 AprPassed 30 Apr2
In CISA KEVCVE-2024-38475HTTP Server1 MayPassed 22 May–
In CISA KEVCVE-2025-24813Tomcat1 AprPassed 22 Apr–
In CISA KEVCVE-2024-45195OFBiz4 FebPassed 25 Feb–
Show 35 moreCSV of 41 entries for Apache

Patch cadence and exploit odds

How often CISA adds Apache CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

1Q1 ’252Q2 ’250Q3 ’250Q4 ’250Q1 ’261Q2 ’261Q3 ’261Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20251
Q2 20252
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20261
Q4 20261

Fix listed

222 of 229 CVEs in coverage

7 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV. The 200 most relevant of 229 are drawn.

top 5%CVE-2017-5638: 100th percentile, in CISA KEVCVE-2023-46604: 100th percentile, in CISA KEVCVE-2026-34486: 99.9th percentile, in CISA KEVCVE-2026-34197: 99.9th percentile, in CISA KEVCVE-2016-3081: 99.9th percentile, in CISA KEVCVE-2025-66516: 99.8th percentileCVE-2022-41678: 99.7th percentileCVE-2019-17571: 99.4th percentileCVE-2026-23918: 98.9th percentileCVE-2024-32114: 94.3th percentileCVE-2026-44825: 90.3th percentileCVE-2026-35152: 88.4th percentileCVE-2026-55957: 86.7th percentileCVE-2026-23795: 80.4th percentileCVE-2026-57967: 73.7th percentileCVE-2026-104711: 72.4th percentileCVE-2026-28780: 72.1th percentileCVE-2026-34355: 67.2th percentileCVE-2026-23906: 66.5th percentileCVE-2026-42253: 63.3th percentileCVE-2026-80351: 63.2th percentileCVE-2026-63292: 61.2th percentileCVE-2025-27821: 59.9th percentileCVE-2026-50633: 59.3th percentileCVE-2026-54428: 58.9th percentileCVE-2026-67593: 58.5th percentileCVE-2026-104712: 58th percentileCVE-2026-95664: 57.7th percentileCVE-2026-80352: 57.7th percentileCVE-2026-57308: 57.6th percentileCVE-2026-49362: 57.3th percentileCVE-2026-63043: 56.9th percentileCVE-2026-24343: 56.5th percentileCVE-2026-87976: 56.3th percentileCVE-2026-59878: 56.1th percentileCVE-2026-54399: 55.9th percentileCVE-2026-65637: 55th percentileCVE-2026-45249: 54.9th percentileCVE-2026-58319: 54.9th percentileCVE-2026-41871: 54.8th percentileCVE-2026-57821: 54.7th percentileCVE-2026-84439: 54.7th percentileCVE-2026-42588: 54.6th percentileCVE-2026-68981: 54.6th percentileCVE-2026-24012: 54.5th percentileCVE-2026-92414: 54.1th percentileCVE-2026-47430: 54th percentileCVE-2026-50112: 54th percentileCVE-2026-34356: 53.5th percentileCVE-2026-50628: 53.4th percentileCVE-2026-57822: 53.4th percentileCVE-2026-105944: 53.3th percentileCVE-2026-73633: 53.1th percentileCVE-2026-82428: 52.9th percentileCVE-2026-62183: 52.8th percentileCVE-2026-24014: 52.8th percentileCVE-2026-63038: 52.7th percentileCVE-2026-24656: 52.5th percentileCVE-2026-77791: 52.4th percentileCVE-2026-45360: 52.2th percentileCVE-2026-31377: 52.1th percentileCVE-2026-90797: 52th percentileCVE-2026-41870: 51.8th percentileCVE-2026-78334: 51.7th percentileCVE-2026-24072: 51.4th percentileCVE-2026-56287: 51.3th percentileCVE-2026-65182: 51.3th percentileCVE-2026-24735: 51th percentileCVE-2026-90799: 50.9th percentileCVE-2026-68525: 50.8th percentileCVE-2026-24013: 50.5th percentileCVE-2026-39999: 50.5th percentileCVE-2026-90800: 50.3th percentileCVE-2026-29168: 50.1th percentileCVE-2026-91012: 50.1th percentileCVE-2026-101296: 50.1th percentileCVE-2026-70469: 49.8th percentileCVE-2026-86471: 49th percentileCVE-2026-92142: 48.9th percentileCVE-2026-79993: 48.9th percentileCVE-2026-82232: 48.8th percentileCVE-2026-94134: 48.7th percentileCVE-2026-45505: 48.7th percentileCVE-2026-90885: 48.6th percentileCVE-2026-49844: 48.4th percentileCVE-2026-107755: 48.4th percentileCVE-2026-29169: 48.4th percentileCVE-2026-59265: 48.1th percentileCVE-2026-103119: 48th percentileCVE-2026-88920: 47.9th percentileCVE-2026-76646: 47.8th percentileCVE-2026-57866: 47.5th percentileCVE-2026-48207: 47.4th percentileCVE-2026-57941: 47.3th percentileCVE-2026-76183: 47th percentileCVE-2026-49364: 47th percentileCVE-2026-54475: 46.8th percentileCVE-2026-86249: 46.7th percentileCVE-2025-66336: 46.7th percentileCVE-2026-104713: 46.6th percentileCVE-2026-58663: 46.6th percentileCVE-2026-48830: 46.4th percentileCVE-2026-59739: 46.2th percentileCVE-2026-86147: 46.1th percentileCVE-2026-86146: 46th percentileCVE-2026-92415: 46th percentileCVE-2026-54048: 45.7th percentileCVE-2026-91048: 45.7th percentileCVE-2026-65181: 45.5th percentileCVE-2026-87022: 45.4th percentileCVE-2026-56154: 45.2th percentileCVE-2026-49328: 45.2th percentileCVE-2026-49875: 45th percentileCVE-2026-92560: 44.8th percentileCVE-2026-104714: 44.6th percentileCVE-2025-48977: 44.6th percentileCVE-2026-23794: 44.5th percentileCVE-2026-50076: 44.2th percentileCVE-2026-103412: 43.9th percentileCVE-2026-33007: 43.8th percentileCVE-2026-49268: 43.7th percentileCVE-2026-73470: 43.7th percentileCVE-2026-78437: 43.6th percentileCVE-2026-47065: 43.1th percentileCVE-2026-63044: 43.1th percentileCVE-2026-78383: 42.9th percentileCVE-2026-101356: 42.8th percentileCVE-2026-80354: 42.7th percentileCVE-2026-86248: 42.6th percentileCVE-2026-105945: 42.5th percentileCVE-2026-108089: 42.1th percentileCVE-2026-111813: 42.1th percentileCVE-2026-47321: 42th percentileCVE-2026-59797: 41.8th percentileCVE-2026-86350: 41.7th percentileCVE-2026-92564: 41.7th percentileCVE-2026-92550: 41.7th percentileCVE-2026-46752: 41.5th percentileCVE-2026-33582: 41.4th percentileCVE-2026-103877: 40.6th percentileCVE-2026-92608: 40.5th percentileCVE-2026-56207: 40.3th percentileCVE-2026-59685: 40.3th percentileCVE-2026-64607: 40.2th percentileCVE-2026-84747: 39.9th percentileCVE-2026-92609: 39.7th percentileCVE-2026-80181: 39.7th percentileCVE-2026-61487: 39.6th percentileCVE-2026-62354: 39.4th percentileCVE-2026-73635: 39.2th percentileCVE-2026-77147: 39.2th percentileCVE-2026-96443: 39.1th percentileCVE-2026-59229: 39th percentileCVE-2026-25700: 39th percentileCVE-2026-49157: 38.2th percentileCVE-2026-84179: 37.8th percentileCVE-2026-87779: 37.5th percentileCVE-2026-73178: 37.5th percentileCVE-2026-81270: 37.5th percentileCVE-2026-61373: 37.3th percentileCVE-2026-102731: 37.3th percentileCVE-2026-93546: 37.2th percentileCVE-2026-73634: 36.8th percentileCVE-2026-82426: 36.7th percentileCVE-2026-42356: 36.5th percentileCVE-2026-64959: 36th percentileCVE-2026-92573: 35.6th percentileCVE-2026-95616: 35.1th percentileCVE-2026-25699: 34.9th percentileCVE-2026-25688: 34.9th percentileCVE-2026-77185: 34.5th percentileCVE-2026-42528: 34.4th percentileCVE-2026-103413: 33.1th percentileCVE-2026-94135: 32th percentileCVE-2026-73632: 31.5th percentileCVE-2026-73631: 31.5th percentileCVE-2026-91085: 31.4th percentileCVE-2026-96806: 31.3th percentileCVE-2026-94052: 30.6th percentileCVE-2026-41566: 30.3th percentileCVE-2026-94053: 30.1th percentileCVE-2026-73236: 29.8th percentileCVE-2026-94002: 29.7th percentileCVE-2026-111811: 29.4th percentileCVE-2026-71569: 28.1th percentileCVE-2026-94386: 28th percentileCVE-2026-91135: 27.3th percentileCVE-2026-95628: 27th percentileCVE-2026-34033: 26.8th percentileCVE-2026-71290: 26.3th percentileCVE-2026-59969: 26.1th percentileCVE-2026-103552: 25.8th percentileCVE-2026-66084: 25.7th percentileCVE-2026-94029: 25.1th percentileCVE-2026-63772: 24.5th percentileCVE-2026-105869: 23.1th percentileCVE-2026-93994: 23.1th percentileCVE-2026-66082: 22.8th percentileCVE-2026-83632: 22.3th percentileCVE-2026-102795: 20.9th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2017-5638100
CVE-2023-46604100
CVE-2026-3448699.9
CVE-2026-3419799.9
CVE-2016-308199.9
CVE-2025-6651699.8
CVE-2022-4167899.7
CVE-2019-1757199.4
CVE-2026-2391898.9
CVE-2024-3211494.3
CVE-2026-4482590.3
CVE-2026-3515288.4
CVE-2026-5595786.7
CVE-2026-2379580.4
CVE-2026-5796773.7
CVE-2026-10471172.4
CVE-2026-2878072.1
CVE-2026-3435567.2
CVE-2026-2390666.5
CVE-2026-4225363.3
CVE-2026-8035163.2
CVE-2026-6329261.2
CVE-2025-2782159.9
CVE-2026-5063359.3
CVE-2026-5442858.9
CVE-2026-6759358.5
CVE-2026-10471258
CVE-2026-9566457.7
CVE-2026-8035257.7
CVE-2026-5730857.6
CVE-2026-4936257.3
CVE-2026-6304356.9
CVE-2026-2434356.5
CVE-2026-8797656.3
CVE-2026-5987856.1
CVE-2026-5439955.9
CVE-2026-6563755
CVE-2026-4524954.9
CVE-2026-5831954.9
CVE-2026-4187154.8
CVE-2026-5782154.7
CVE-2026-8443954.7
CVE-2026-4258854.6
CVE-2026-6898154.6
CVE-2026-2401254.5
CVE-2026-9241454.1
CVE-2026-4743054
CVE-2026-5011254
CVE-2026-3435653.5
CVE-2026-5062853.4
CVE-2026-5782253.4
CVE-2026-10594453.3
CVE-2026-7363353.1
CVE-2026-8242852.9
CVE-2026-6218352.8
CVE-2026-2401452.8
CVE-2026-6303852.7
CVE-2026-2465652.5
CVE-2026-7779152.4
CVE-2026-4536052.2
CVE-2026-3137752.1
CVE-2026-9079752
CVE-2026-4187051.8
CVE-2026-7833451.7
CVE-2026-2407251.4
CVE-2026-5628751.3
CVE-2026-6518251.3
CVE-2026-2473551
CVE-2026-9079950.9
CVE-2026-6852550.8
CVE-2026-2401350.5
CVE-2026-3999950.5
CVE-2026-9080050.3
CVE-2026-2916850.1
CVE-2026-9101250.1
CVE-2026-10129650.1
CVE-2026-7046949.8
CVE-2026-8647149
CVE-2026-9214248.9
CVE-2026-7999348.9
CVE-2026-8223248.8
CVE-2026-9413448.7
CVE-2026-4550548.7
CVE-2026-9088548.6
CVE-2026-4984448.4
CVE-2026-10775548.4
CVE-2026-2916948.4
CVE-2026-5926548.1
CVE-2026-10311948
CVE-2026-8892047.9
CVE-2026-7664647.8
CVE-2026-5786647.5
CVE-2026-4820747.4
CVE-2026-5794147.3
CVE-2026-7618347
CVE-2026-4936447
CVE-2026-5447546.8
CVE-2026-8624946.7
CVE-2025-6633646.7
CVE-2026-10471346.6
CVE-2026-5866346.6
CVE-2026-4883046.4
CVE-2026-5973946.2
CVE-2026-8614746.1
CVE-2026-8614646
CVE-2026-9241546
CVE-2026-5404845.7
CVE-2026-9104845.7
CVE-2026-6518145.5
CVE-2026-8702245.4
CVE-2026-5615445.2
CVE-2026-4932845.2
CVE-2026-4987545
CVE-2026-9256044.8
CVE-2026-10471444.6
CVE-2025-4897744.6
CVE-2026-2379444.5
CVE-2026-5007644.2
CVE-2026-10341243.9
CVE-2026-3300743.8
CVE-2026-4926843.7
CVE-2026-7347043.7
CVE-2026-7843743.6
CVE-2026-4706543.1
CVE-2026-6304443.1
CVE-2026-7838342.9
CVE-2026-10135642.8
CVE-2026-8035442.7
CVE-2026-8624842.6
CVE-2026-10594542.5
CVE-2026-10808942.1
CVE-2026-11181342.1
CVE-2026-4732142
CVE-2026-5979741.8
CVE-2026-8635041.7
CVE-2026-9256441.7
CVE-2026-9255041.7
CVE-2026-4675241.5
CVE-2026-3358241.4
CVE-2026-10387740.6
CVE-2026-9260840.5
CVE-2026-5620740.3
CVE-2026-5968540.3
CVE-2026-6460740.2
CVE-2026-8474739.9
CVE-2026-9260939.7
CVE-2026-8018139.7
CVE-2026-6148739.6
CVE-2026-6235439.4
CVE-2026-7363539.2
CVE-2026-7714739.2
CVE-2026-9644339.1
CVE-2026-5922939
CVE-2026-2570039
CVE-2026-4915738.2
CVE-2026-8417937.8
CVE-2026-8777937.5
CVE-2026-7317837.5
CVE-2026-8127037.5
CVE-2026-6137337.3
CVE-2026-10273137.3
CVE-2026-9354637.2
CVE-2026-7363436.8
CVE-2026-8242636.7
CVE-2026-4235636.5
CVE-2026-6495936
CVE-2026-9257335.6
CVE-2026-9561635.1
CVE-2026-2569934.9
CVE-2026-2568834.9
CVE-2026-7718534.5
CVE-2026-4252834.4
CVE-2026-10341333.1
CVE-2026-9413532
CVE-2026-7363231.5
CVE-2026-7363131.5
CVE-2026-9108531.4
CVE-2026-9680631.3
CVE-2026-9405230.6
CVE-2026-4156630.3
CVE-2026-9405330.1
CVE-2026-7323629.8
CVE-2026-9400229.7
CVE-2026-11181129.4
CVE-2026-7156928.1
CVE-2026-9438628
CVE-2026-9113527.3
CVE-2026-9562827
CVE-2026-3403326.8
CVE-2026-7129026.3
CVE-2026-5996926.1
CVE-2026-10355225.8
CVE-2026-6608425.7
CVE-2026-9402925.1
CVE-2026-6377224.5
CVE-2026-10586923.1
CVE-2026-9399423.1
CVE-2026-6608222.8
CVE-2026-8363222.3
CVE-2026-10279520.9

Coverage95 articles · all time

The latest 50 of 95 articles naming Apache, in the shared story grammar.

Full timeline
Developinglatest 3 hours ago50 articles6 outlets

50 articles from 6 outlets since 5 Aug. Picked up again on 2 Nov after 4 days quiet.

Now5 Aug16212726111621272611162127First reportSecurityOnline · 5 Aug, 03:51CISA alert8 Oct, 19:02 · official
  • Wed 5 Aug, 03:51 UTC. SecurityOnline, first report. N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 09:01 UTC. SecurityOnline. Apple tightens bug bounty amid surge of AI generated flaw reports. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 10:11 UTC. SecurityWeek, its first report on the story. CISA warns of exploits in IBM Langflow, Nable, and Tomcat flaws. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 16:29 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in IBM Langflow, N able and Tomcat. Cites a CVE in CISA KEV.
  • Sat 15 Aug, 15:00 UTC. SecurityOnline. Apache patches five Struts 2 bugs, warns of remote DoS and leaks.
  • Tue 18 Aug, 13:41 UTC. SecurityOnline. Apache HttpClient bug lets attackers hijack traffic, update urged.
  • Thu 20 Aug, 18:02 UTC. SecurityOnline. CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0.
  • Fri 21 Aug, 17:10 UTC. SecurityOnline. Apache CloudStack patches critical KVM RCE flaw CVE-2026-50112.
  • Fri 4 Sep, 04:35 UTC. SecurityOnline. Apache Allura Fixes Four Flaws That Could Expose Repositories.
  • Wed 9 Sep, 05:49 UTC. SecurityOnline. Apache Impala Flaws Let Attackers Seize Analytics Clusters Remotely.
  • Wed 9 Sep, 05:50 UTC. SecurityOnline. CVE-2026-41870: Unauthenticated RCE in Apache Nutch. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 03:30 UTC. SecurityOnline. Apache Artemis Flaws Let Attackers Steal Sessions and Expose Credentials.
  • Fri 11 Sep, 14:42 UTC. SecurityOnline. Apache Camel K Patches Critical Flaws Enabling Code Execution.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. Apache Storm Fixes 17 Flaws Enabling Root Access and Data Theft.
  • Wed 16 Sep, 03:13 UTC. SecurityOnline. Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox Escape.
  • Wed 16 Sep, 05:00 UTC. SecurityOnline. Apache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof Logs.
  • Thu 17 Sep, 11:54 UTC. SecurityOnline. Apache Fixes NiFi Path Traversal and Denial of Service Flaws.
  • Wed 23 Sep, 17:38 UTC. SecurityOnline. Apache Doris Fixes Flaws Exposing Cluster Data and Enabling RCE.
  • Wed 23 Sep, 20:38 UTC. SecurityOnline. Apache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoS.
  • Fri 25 Sep, 19:22 UTC. SecurityOnline. Apache Qpid Broker-J Fixes Six Flaws, Including Critical Session Bug.
  • Tue 29 Sep, 05:20 UTC. SecurityOnline. Apache Karaf Flaws Let Low-Privilege Users Seize Admin Access.
  • Wed 30 Sep, 10:13 UTC. SecurityOnline. Critical Apache PLC4X Flaw Enables OPC UA Server Impersonation.
  • Thu 1 Oct, 02:13 UTC. SecurityOnline. Apache WSS4J Flaws Let Attackers Forge Authenticated Messages.
  • Thu 1 Oct, 02:13 UTC. SecurityOnline. Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.1.
  • Fri 2 Oct, 03:36 UTC. SecurityOnline. Apache Fixes 20 Flaws Including Critical mod_vhost_alias Bug.
  • Sat 3 Oct, 06:30 UTC. SecurityOnline. Apache OpenOffice Flaw Enables Code Execution Through Crafted Documents.
  • Mon 5 Oct, 12:07 UTC. SOCRadar, its first report on the story. Dark Web Claims Expose 10 Million French Records and More. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 15:35 UTC. SecurityOnline. Apache Struts fixes four flaws, including remote code execution risk.
  • Tue 6 Oct, 02:00 UTC. SecurityOnline. Apache Thrift fixes 61 flaws, including unauthenticated critical bugs.
  • Tue 6 Oct, 12:29 UTC. The Hacker News, its first report on the story. LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open.
  • Wed 7 Oct, 18:01 UTC. SecurityOnline. Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions.
  • Thu 8 Oct, 05:11 UTC. SecurityOnline. Apache DolphinScheduler Fixes Six Flaws Exposing Credentials and Data.
  • Thu 8 Oct, 18:48 UTC. The Hacker News. China-Based Hackers Accused of Stealing Emails Across 7 Countries. Cites a CVE in CISA KEV.
  • Thu 8 Oct, 19:02 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 07:31 UTC. SecurityOnline. CISA Flags Five Actively Exploited Flaws in Enterprise Tools. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 12:50 UTC. The Hacker News. CISA Adds Five Flaws to KEV After Flax Typhoon Attacks. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 18:13 UTC. SecurityOnline. Apache Camel Karavan flaws could let attackers hijack Kubernetes deployments.
  • Sun 11 Oct, 10:01 UTC. Security Affairs. CISA Flags Five Exploited Flaws in China Linked Cyber Campaign. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 01:44 UTC. SecurityOnline. Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade.
  • Wed 21 Oct, 03:01 UTC. SecurityOnline. Apache Tomcat fixes authentication bypass and data leaks in key releases.
  • Wed 21 Oct, 06:01 UTC. SecurityOnline. Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache Warns.
  • Wed 21 Oct, 11:01 UTC. SecurityOnline. Atlassian patches 176 flaws across Jira and Confluence products.
  • Thu 22 Oct, 02:43 UTC. SecurityOnline. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant Access.
  • Thu 22 Oct, 02:43 UTC. SecurityOnline. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk.
  • Thu 22 Oct, 02:53 UTC. SecurityOnline. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoS.
  • Fri 23 Oct, 08:36 UTC. SecurityWeek. Atlassian Flags 162 High and 14 Critical Flaws in Server Products.
  • Mon 26 Oct, 03:21 UTC. SecurityOnline. Apache Camel fixes eight flaws, including an XXE vulnerability.
  • Thu 29 Oct, 05:00 UTC. SecurityOnline. Apache Kafka fixes 12 flaws, including a cluster access bypass.
  • Mon 2 Nov, 03:30 UTC. SecurityOnline. Apache Wicket fixes 19 flaws across three supported releases.
  • Tue 3 Nov, 03:30 UTC. SecurityOnline. Apache fixes eight high risk flaws across three projects.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 50 articles as a list
  1. Wed 5 AugDay 04
    1. N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog03:51 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Apple tightens bug bounty amid surge of AI generated flaw reports09:01 · SecurityOnline · Known exploited CVE
    3. CISA warns of exploits in IBM Langflow, Nable, and Tomcat flaws10:11 · SecurityWeek · Known exploited CVE
    4. CISA Flags Critical Flaws in IBM Langflow, N able and Tomcat16:29 · Security Affairs · Known exploited CVE

  2. Quiet for 10 days

    Sat 15 AugDay 101
    1. Apache patches five Struts 2 bugs, warns of remote DoS and leaks15:00 · SecurityOnline · Picked up again

  3. Quiet for 3 days

    Tue 18 AugDay 131
    1. Apache HttpClient bug lets attackers hijack traffic, update urged13:41 · SecurityOnline · Picked up again

  4. Quiet for 2 days

    Thu 20 AugDay 151
    1. CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.018:02 · SecurityOnline · Picked up again
  5. Fri 21 AugDay 161
    1. Apache CloudStack patches critical KVM RCE flaw CVE-2026-5011217:10 · SecurityOnline

  6. Quiet for 13 days

    Fri 4 SepDay 301
    1. Apache Allura Fixes Four Flaws That Could Expose Repositories04:35 · SecurityOnline · Picked up again

  7. Quiet for 5 days

    Wed 9 SepDay 352
    1. Apache Impala Flaws Let Attackers Seize Analytics Clusters Remotely05:49 · SecurityOnline · Picked up again
    2. CVE-2026-41870: Unauthenticated RCE in Apache Nutch05:50 · SecurityOnline · Known exploited CVE
  8. Thu 10 SepDay 361
    1. Apache Artemis Flaws Let Attackers Steal Sessions and Expose Credentials03:30 · SecurityOnline
  9. Fri 11 SepDay 371
    1. Apache Camel K Patches Critical Flaws Enabling Code Execution14:42 · SecurityOnline

  10. Quiet for 3 days

    Mon 14 SepDay 401
    1. Apache Storm Fixes 17 Flaws Enabling Root Access and Data Theft03:11 · SecurityOnline · Picked up again

  11. Quiet for 2 days

    Wed 16 SepDay 422
    1. Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox Escape03:13 · SecurityOnline · Picked up again
    2. Apache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof Logs05:00 · SecurityOnline
  12. Thu 17 SepDay 431
    1. Apache Fixes NiFi Path Traversal and Denial of Service Flaws11:54 · SecurityOnline

  13. Quiet for 6 days

    Wed 23 SepDay 492
    1. Apache Doris Fixes Flaws Exposing Cluster Data and Enabling RCE17:38 · SecurityOnline · Picked up again
    2. Apache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoS20:38 · SecurityOnline

  14. Quiet for 2 days

    Fri 25 SepDay 511
    1. Apache Qpid Broker-J Fixes Six Flaws, Including Critical Session Bug19:22 · SecurityOnline

  15. Quiet for 3 days

    Tue 29 SepDay 551
    1. Apache Karaf Flaws Let Low-Privilege Users Seize Admin Access05:20 · SecurityOnline · Picked up again
  16. Wed 30 SepDay 561
    1. Critical Apache PLC4X Flaw Enables OPC UA Server Impersonation10:13 · SecurityOnline
  17. Thu 1 OctDay 572
    1. Apache WSS4J Flaws Let Attackers Forge Authenticated Messages02:13 · SecurityOnline
    2. Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.102:13 · SecurityOnline
  18. Fri 2 OctDay 581
    1. Apache Fixes 20 Flaws Including Critical mod_vhost_alias Bug03:36 · SecurityOnline
  19. Sat 3 OctDay 591
    1. Apache OpenOffice Flaw Enables Code Execution Through Crafted Documents06:30 · SecurityOnline

  20. Quiet for 2 days

    Mon 5 OctDay 612
    1. Dark Web Claims Expose 10 Million French Records and More12:07 · SOCRadar · Picked up again · Known exploited CVE
    2. Apache Struts fixes four flaws, including remote code execution risk15:35 · SecurityOnline
  21. Tue 6 OctDay 622
    1. Apache Thrift fixes 61 flaws, including unauthenticated critical bugs02:00 · SecurityOnline
    2. LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open12:29 · The Hacker News
  22. Wed 7 OctDay 631
    1. Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions18:01 · SecurityOnline
  23. Thu 8 OctDay 643
    1. Apache DolphinScheduler Fixes Six Flaws Exposing Credentials and Data05:11 · SecurityOnline
    2. China-Based Hackers Accused of Stealing Emails Across 7 Countries18:48 · The Hacker News · Known exploited CVE
    3. CISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching19:02 · CISA · official · CISA alert · Known exploited CVE
  24. Fri 9 OctDay 653
    1. CISA Flags Five Actively Exploited Flaws in Enterprise Tools07:31 · SecurityOnline · Known exploited CVE
    2. CISA Adds Five Flaws to KEV After Flax Typhoon Attacks12:50 · The Hacker News · Known exploited CVE
    3. Apache Camel Karavan flaws could let attackers hijack Kubernetes deployments18:13 · SecurityOnline

  25. Quiet for 2 days

    Sun 11 OctDay 671
    1. CISA Flags Five Exploited Flaws in China Linked Cyber Campaign10:01 · Security Affairs · Known exploited CVE

  26. Quiet for 8 days

    Mon 19 OctDay 751
    1. Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade01:44 · SecurityOnline · Picked up again

  27. Quiet for 2 days

    Wed 21 OctDay 773
    1. Apache Tomcat fixes authentication bypass and data leaks in key releases03:01 · SecurityOnline · Picked up again
    2. Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache Warns06:01 · SecurityOnline
    3. Atlassian patches 176 flaws across Jira and Confluence products11:01 · SecurityOnline
  28. Thu 22 OctDay 783
    1. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant Access02:43 · SecurityOnline
    2. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk02:43 · SecurityOnline
    3. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoS02:53 · SecurityOnline
  29. Fri 23 OctDay 791
    1. Atlassian Flags 162 High and 14 Critical Flaws in Server Products08:36 · SecurityWeek

  30. Quiet for 3 days

    Mon 26 OctDay 821
    1. Apache Camel fixes eight flaws, including an XXE vulnerability03:21 · SecurityOnline · Picked up again

  31. Quiet for 3 days

    Thu 29 OctDay 851
    1. Apache Kafka fixes 12 flaws, including a cluster access bypass05:00 · SecurityOnline · Picked up again

  32. Quiet for 4 days

    Mon 2 NovDay 891
    1. Apache Wicket fixes 19 flaws across three supported releases03:30 · SecurityOnline · Picked up again
  33. Tue 3 NovDay 901
    1. Apache fixes eight high risk flaws across three projects03:30 · SecurityOnline

All CVEs in coverage229

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2017-5638Exploited

    Apache Struts Remote Code Execution Vulnerability

    9.8Critical99.9% EPSS · 1 article
  • CVE-2023-46604Exploited

    Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

    10.0Critical99.9% EPSS · 1 article
  • CVE-2026-34486Exploited

    Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

    9.8Critical99% EPSS · 7 articles
  • CVE-2026-34197Exploited

    Apache ActiveMQ Improper Input Validation Vulnerability

    8.8High98% EPSS · 2 articles
  • CVE-2016-3081Exploited

    Apache Struts Command Injection Vulnerability

    8.1High97% EPSS · 5 articles
  • CVE-2025-66516

    Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

    8.4High89% EPSS · 1 article
  • CVE-2022-41678

    Apache Software Foundation Apache ActiveMQ vulnerability

    Not scored86% EPSS · 1 article
  • CVE-2019-17571

    Apache Software Foundation Log4j vulnerability

    Not scored70% EPSS · 2 articles
  • CVE-2026-23918

    Apache Software Foundation Apache HTTP Server vulnerability

    8.8High50% EPSS · 3 articles
  • CVE-2024-32114

    Apache Software Foundation Apache ActiveMQ vulnerability

    8.5High7.2% EPSS · 2 articles
  • CVE-2026-44825

    Apache Software Foundation Apache Solr vulnerability

    8.1High3.9% EPSS · 1 article
  • CVE-2026-35152

    Apache Software Foundation Apache Fineract vulnerability

    8.8High3.3% EPSS · 1 article
Show 188 more CVEs
  • CVE-2026-55957

    Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    7.3High2.9% EPSS · 1 article
  • CVE-2026-23795

    Apache Syncope: Console XXE on Keymaster parameters

    Not scored2.0% EPSS · 1 article
  • CVE-2026-57967

    Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

    Not scored1.5% EPSS · 1 article
  • CVE-2026-104711

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    Not scored1.4% EPSS · 1 article
  • CVE-2026-28780

    Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

    9.8Critical1.4% EPSS · 1 article
  • CVE-2026-34355

    Apache HTTP Server: mod_proxy_html buffer overflow

    7.5High1.2% EPSS · 1 article
  • CVE-2026-23906

    Apache Druid: Authentication Bypass via LDAP Anonymous Bind

    Not scored1.1% EPSS · 1 article
  • CVE-2026-42253

    Apache Software Foundation Apache ActiveMQ vulnerability

    6.1Medium1.0% EPSS · 1 article
  • CVE-2026-80351

    Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

    9.8Critical1.0% EPSS · 1 article
  • CVE-2026-63292

    Apache HTTP Server: mod_vhost_alias stack overflow

    7.5High0.9% EPSS · 1 article
  • CVE-2025-27821

    HDFS native client: Out of bounds write in URI parser of native HDFS client

    Not scored0.9% EPSS · 1 article
  • CVE-2026-50633

    Apache Software Foundation Apache CXF vulnerability

    8.1High0.9% EPSS · 1 article
  • CVE-2026-54428

    Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

    7.5High0.9% EPSS · 1 article
  • CVE-2026-67593

    Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

    Not scored0.9% EPSS · 1 article
  • CVE-2026-104712

    Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

    Not scored0.8% EPSS · 1 article
  • CVE-2026-95664

    Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

    Not scored0.8% EPSS · 1 article
  • CVE-2026-80352

    Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

    9.8Critical0.8% EPSS · 1 article
  • CVE-2026-57308

    Apache Syncope: SQL injection vulnerability in Audit Events search

    9.8Critical0.8% EPSS · 1 article
  • CVE-2026-49362

    Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

    Not scored0.8% EPSS · 1 article
  • CVE-2026-63043

    Apache InLong: Agent path traversal via unvalidated file source path

    7.5High0.8% EPSS · 1 article
  • CVE-2026-24343

    Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions

    Not scored0.8% EPSS · 1 article
  • CVE-2026-87976

    Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

    7.2High0.8% EPSS · 1 article
  • CVE-2026-59878

    Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

    7.5High0.8% EPSS · 1 article
  • CVE-2026-54399

    Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

    7.5High0.8% EPSS · 1 article
  • CVE-2026-65637

    Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

    9.8Critical0.8% EPSS · 2 articles
  • CVE-2026-45249

    Apache Software Foundation Apache ECharts vulnerability

    6.1Medium0.8% EPSS · 1 article
  • CVE-2026-58319

    Apache Software Foundation Apache Doris vulnerability

    9.1Critical0.8% EPSS · 1 article
  • CVE-2026-41871

    Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

    Not scored0.8% EPSS · 1 article
  • CVE-2026-57821

    Apache Software Foundation Apache Fineract vulnerability

    8.1High0.7% EPSS · 1 article
  • CVE-2026-84439

    Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

    Not scored0.7% EPSS · 1 article
  • CVE-2026-42588

    Apache Software Foundation Apache ActiveMQ Broker vulnerability

    8.1High0.7% EPSS · 1 article
  • CVE-2026-68981

    Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

    8.8High0.7% EPSS · 1 article
  • CVE-2026-24012

    Apache Software Foundation Apache IoTDB vulnerability

    7.5High0.7% EPSS · 1 article
  • CVE-2026-92414

    Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

    9.3Critical0.7% EPSS · 1 article
  • CVE-2026-47430

    Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

    9.5Critical0.7% EPSS · 1 article
  • CVE-2026-50112

    Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

    8.8High0.7% EPSS · 1 article
  • CVE-2026-34356

    Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

    7.5High0.7% EPSS · 1 article
  • CVE-2026-50628

    Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

    9.8Critical0.7% EPSS · 0 articles
  • CVE-2026-57822

    Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

    Not scored0.7% EPSS · 1 article
  • CVE-2026-105944

    Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life

    10.0Critical0.7% EPSS · 1 article
  • CVE-2026-73633

    Apache Struts: Unbounded read of a JSON request body

    7.5High0.7% EPSS · 1 article
  • CVE-2026-82428

    Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

    Not scored0.7% EPSS · 1 article
  • CVE-2026-62183

    Apache Syncope: User self-service privilege escalation

    9.8Critical0.7% EPSS · 1 article
  • CVE-2026-24014

    Apache Software Foundation Apache IoTDB vulnerability

    9.8Critical0.7% EPSS · 1 article
  • CVE-2026-63038

    Apache InLong: SQL Injection via String Concatenation Vulnerability Report

    9.8Critical0.7% EPSS · 1 article
  • CVE-2026-24656

    Apache Karaf: Decanter log-socket collector has deserialization vulnerability

    Not scored0.7% EPSS · 1 article
  • CVE-2026-77791

    Apache Tomcat: DoS via busy wait during WebSocket close

    7.5High0.7% EPSS · 1 article
  • CVE-2026-45360

    Apache Software Foundation Apache Airflow vulnerability

    7.3High0.7% EPSS · 1 article
  • CVE-2026-31377

    Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

    7.5High0.7% EPSS · 1 article
  • CVE-2026-90797

    Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

    7.7High0.7% EPSS · 1 article
  • CVE-2026-41870

    Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

    Not scored0.7% EPSS · 1 article
  • CVE-2026-78334

    Apache bRPC: Missing Authentication for Streaming RPC Frames

    Not scored0.7% EPSS · 1 article
  • CVE-2026-24072

    Apache Software Foundation Apache HTTP Server vulnerability

    8.8High0.7% EPSS · 1 article
  • CVE-2026-56287

    Apache Software Foundation Apache Fineract vulnerability

    8.1High0.7% EPSS · 1 article
  • CVE-2026-65182

    Apache Tomcat: Bypass longest prefix security constraint

    9.1Critical0.7% EPSS · 2 articles
  • CVE-2026-24735

    Apache Answer: Revision API Improper Access Control leads to Information Disclosure

    Not scored0.7% EPSS · 1 article
  • CVE-2026-90799

    Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

    1.3Low0.6% EPSS · 1 article
  • CVE-2026-68525

    Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

    9.1Critical0.6% EPSS · 2 articles
  • CVE-2026-24013

    Apache Software Foundation Apache IoTDB vulnerability

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-39999

    Apache APISIX: JWT Algorithm Confusion allows authentication bypass

    7.0High0.6% EPSS · 1 article
  • CVE-2026-90800

    Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

    8.1High0.6% EPSS · 1 article
  • CVE-2026-29168

    Apache HTTP Server: mod_md unrestricted OCSP response

    7.3High0.6% EPSS · 1 article
  • CVE-2026-91012

    Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

    Not scored0.6% EPSS · 1 article
  • CVE-2026-101296

    Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-70469

    Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

    Not scored0.6% EPSS · 1 article
  • CVE-2026-86471

    Apache CouchDB: Admin credentials leading to code execution as operating system user

    9.3Critical0.6% EPSS · 1 article
  • CVE-2026-92142

    Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

    Not scored0.6% EPSS · 1 article
  • CVE-2026-79993

    Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

    Not scored0.6% EPSS · 1 article
  • CVE-2026-82232

    Apache Syncope: SQL injection via sort parameter in Task search

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-94134

    Apache Software Foundation Apache Airflow SSH provider vulnerability

    9.1Critical0.6% EPSS · 0 articles
  • CVE-2026-45505

    Apache Software Foundation Apache ActiveMQ Broker vulnerability

    8.8High0.6% EPSS · 1 article
  • CVE-2026-90885

    Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

    Not scored0.6% EPSS · 1 article
  • CVE-2026-49844

    Apache Software Foundation Apache Log4j API vulnerability

    6.3Medium0.6% EPSS · 1 article
  • CVE-2026-107755

    Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

    6.0Medium0.6% EPSS · 1 article
  • CVE-2026-29169

    Apache Software Foundation Apache HTTP Server vulnerability

    7.5High0.6% EPSS · 1 article
  • CVE-2026-59265

    Apache Software Foundation Apache OpenOffice vulnerability

    Not scored0.6% EPSS · 2 articles
  • CVE-2026-103119

    Apache Tomcat: AJP response mix-up

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-88920

    Apache WSS4J: SAML Sender-Vouches Authentication Bypass

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-76646

    Apache MyFaces: Denial of Service via Unbounded Request Parsing

    Not scored0.6% EPSS · 1 article
  • CVE-2026-57866

    Apache Impala: Secrets Exfiltration via SSRF

    Not scored0.6% EPSS · 1 article
  • CVE-2026-48207

    Apache Software Foundation Apache Fory vulnerability

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-57941

    Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-76183

    Apache Tomcat: Bypass of security constraints for WebSocket endpoints

    9.8Critical0.6% EPSS · 0 articles
  • CVE-2026-49364

    Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

    Not scored0.6% EPSS · 1 article
  • CVE-2026-54475

    Apache Software Foundation Apache ActiveMQ Broker vulnerability

    7.5High0.6% EPSS · 1 article
  • CVE-2026-86249

    Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

    Not scored0.6% EPSS · 1 article
  • CVE-2025-66336

    Apache Doris MCP Server: SQL injection leading the authentication bypass

    8.1High0.6% EPSS · 1 article
  • CVE-2026-104713

    Apache Struts: Unbounded request body read in the REST plugin

    Not scored0.6% EPSS · 1 article
  • CVE-2026-58663

    Apache IoTDB: Auth Bypass in pipeTransfer() interface

    Not scored0.6% EPSS · 1 article
  • CVE-2026-48830

    Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests

    Not scored0.6% EPSS · 1 article
  • CVE-2026-59739

    Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

    Not scored0.6% EPSS · 1 article
  • CVE-2026-86147

    Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof

    Not scored0.6% EPSS · 1 article
  • CVE-2026-86146

    Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

    Not scored0.6% EPSS · 1 article
  • CVE-2026-92415

    Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

    6.9Medium0.6% EPSS · 1 article
  • CVE-2026-54048

    Apache Impala: Avro Schema URL Server-Side Request Forgery

    Not scored0.5% EPSS · 1 article
  • CVE-2026-91048

    Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

    Not scored0.5% EPSS · 1 article
  • CVE-2026-65181

    Apache Impala: RCE via External Data Source Class Loading

    Not scored0.5% EPSS · 1 article
  • CVE-2026-87022

    Apache Tomcat: WebSocket message smuggling with per-message-deflate

    7.5High0.5% EPSS · 1 article
  • CVE-2026-56154

    Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

    9.8Critical0.5% EPSS · 0 articles
  • CVE-2026-49328

    Apache Software Foundation Apache Fesod (Incubating) vulnerability

    5.3Medium0.5% EPSS · 1 article
  • CVE-2026-49875

    Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-92560

    Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

    7.5High0.5% EPSS · 1 article
  • CVE-2026-104714

    Apache Struts: Shared message formatter exposes date and time values across concurrent requests

    Not scored0.5% EPSS · 1 article
  • CVE-2025-48977

    Apache Software Foundation Apache Ignite vulnerability

    8.5High0.5% EPSS · 1 article
  • CVE-2026-23794

    Apache Syncope: Reflected XSS on Enduser Login

    Not scored0.5% EPSS · 1 article
  • CVE-2026-50076

    Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

    9.1Critical0.5% EPSS · 1 article
  • CVE-2026-103412

    Apache Software Foundation Apache Camel Karavan vulnerability

    8.8High0.5% EPSS · 0 articles
  • CVE-2026-33007

    Apache Software Foundation Apache HTTP Server vulnerability

    5.3Medium0.5% EPSS · 1 article
  • CVE-2026-49268

    Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    8.8High0.5% EPSS · 1 article
  • CVE-2026-73470

    Apache Syncope: Delegating users can grant unowned Roles

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-78437

    Apache Tomcat: HTTP/2 DoS via malformed request

    7.3High0.5% EPSS · 1 article
  • CVE-2026-47065

    Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-63044

    Apache InLong: Authenticated SSRF via POST /api/node/testConnection

    5.4Medium0.5% EPSS · 1 article
  • CVE-2026-78383

    Apache Tomcat: AJP DoS via missing request body

    7.5High0.5% EPSS · 1 article
  • CVE-2026-101356

    Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

    9.1Critical0.5% EPSS · 1 article
  • CVE-2026-80354

    Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace

    8.1High0.5% EPSS · 1 article
  • CVE-2026-86248

    Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-105945

    Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

    7.7High0.5% EPSS · 1 article
  • CVE-2026-108089

    Apache Cocoon: Unauthenticated access to diagnostic interfaces

    7.5High0.5% EPSS · 1 article
  • CVE-2026-111813

    Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

    10.0Critical0.5% EPSS · 1 article
  • CVE-2026-47321

    Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

    High0.5% EPSS · 1 article
  • CVE-2026-59797

    Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

    9.8Critical0.5% EPSS · 0 articles
  • CVE-2026-86350

    Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

    9.1Critical0.5% EPSS · 1 article
  • CVE-2026-92564

    Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

    Not scored0.5% EPSS · 0 articles
  • CVE-2026-92550

    Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

    7.5High0.5% EPSS · 1 article
  • CVE-2026-46752

    Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()

    10.0Critical0.5% EPSS · 1 article
  • CVE-2026-33582

    Apache Software Foundation Apache Answer vulnerability

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-103877

    Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

    Not scored0.5% EPSS · 1 article
  • CVE-2026-92608

    Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

    7.5High0.5% EPSS · 1 article
  • CVE-2026-56207

    Apache Impala: SAML authentication bypass via forged bearer token

    Not scored0.5% EPSS · 1 article
  • CVE-2026-59685

    Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

    7.5High0.5% EPSS · 1 article
  • CVE-2026-64607

    Apache Software Foundation Apache HttpComponents Client vulnerability

    5.3Medium0.5% EPSS · 1 article
  • CVE-2026-84747

    Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments

    Not scored0.5% EPSS · 1 article
  • CVE-2026-92609

    Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-80181

    Apache Allura: Server-side request forgery

    Not scored0.5% EPSS · 1 article
  • CVE-2026-61487

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-62354

    Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

    7.7High0.5% EPSS · 1 article
  • CVE-2026-73635

    Apache Struts: Unbounded growth of localized-text caches driven by the request locale

    7.5High0.5% EPSS · 1 article
  • CVE-2026-77147

    Apache Syncope: Groovy Sandbox escape for empty CommandArgs

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-96443

    Apache Doris: JDBC driver URL validation bypass leads to remote code execution

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-59229

    Apache IoTDB: Legacy Pipe Privilege Escalation

    Not scored0.5% EPSS · 1 article
  • CVE-2026-25700

    Apache Software Foundation Apache Answer vulnerability

    7.2High0.5% EPSS · 1 article
  • CVE-2026-49157

    Apache Software Foundation Apache ActiveMQ vulnerability

    8.8High0.4% EPSS · 1 article
  • CVE-2026-84179

    Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

    Not scored0.4% EPSS · 1 article
  • CVE-2026-87779

    Apache Syncope: AES Secret Key disclosure via log output

    7.5High0.4% EPSS · 1 article
  • CVE-2026-73178

    Apache Syncope: JWT Access Token takeover

    7.5High0.4% EPSS · 1 article
  • CVE-2026-81270

    Apache Allura: Information exposure via search

    7.5High0.4% EPSS · 1 article
  • CVE-2026-61373

    Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

    8.7High0.4% EPSS · 1 article
  • CVE-2026-102731

    Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

    Not scored0.4% EPSS · 1 article
  • CVE-2026-93546

    Apache HTTP Server: mod_dav_fs namespace overflow

    8.8High0.4% EPSS · 1 article
  • CVE-2026-73634

    Apache Struts: Unbounded read of a Content Security Policy violation report

    7.5High0.4% EPSS · 1 article
  • CVE-2026-82426

    Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

    Not scored0.4% EPSS · 1 article
  • CVE-2026-42356

    Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

    3.7Low0.4% EPSS · 1 article
  • CVE-2026-64959

    Apache Kylin: Missing authentication on certain cache API endpoints

    Not scored0.4% EPSS · 1 article
  • CVE-2026-92573

    Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

    6.5Medium0.4% EPSS · 0 articles
  • CVE-2026-95616

    Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

    7.5High0.4% EPSS · 1 article
  • CVE-2026-25699

    Apache Software Foundation Apache Answer vulnerability

    6.1Medium0.4% EPSS · 1 article
  • CVE-2026-25688

    Apache Software Foundation Apache Answer vulnerability

    6.1Medium0.4% EPSS · 1 article
  • CVE-2026-77185

    Apache MINA SSHD: Asynchronous authentication can bypass signature verification

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-42528

    Apache HTTP Server: mod_dav shared lock overflow

    4.3Medium0.4% EPSS · 1 article
  • CVE-2026-103413

    Apache Software Foundation Apache Camel Karavan vulnerability

    8.8High0.4% EPSS · 0 articles
  • CVE-2026-94135

    Apache Software Foundation Apache Airflow SFTP provider vulnerability

    4.3Medium0.4% EPSS · 0 articles
  • CVE-2026-73632

    Apache Struts: Shared serialization state in the JSON plugin

    4.3Medium0.4% EPSS · 1 article
  • CVE-2026-73631

    Apache Struts: Shared parsing state in the JSON plugin

    4.3Medium0.4% EPSS · 1 article
  • CVE-2026-91085

    Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

    Not scored0.4% EPSS · 1 article
  • CVE-2026-96806

    Apache Software Foundation Apache Airflow Keycloak provider vulnerability

    5.8Medium0.4% EPSS · 0 articles
  • CVE-2026-94052

    Apache MINA SSHD: LDAP password authentication ineffective

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-41566

    Apache Kvrocks: Improper permission for the APPLYBATCH command

    9.4Critical0.4% EPSS · 1 article
  • CVE-2026-94053

    Apache MINA SSHD: LDAP injection in sshd-ldap

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-73236

    Apache Syncope: Cross-Realm authorization bypass in delegated administration

    7.5High0.4% EPSS · 1 article
  • CVE-2026-94002

    Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

    7.5High0.4% EPSS · 1 article
  • CVE-2026-111811

    Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

    9.4Critical0.4% EPSS · 0 articles
  • CVE-2026-71569

    Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name

    Not scored0.3% EPSS · 1 article
  • CVE-2026-94386

    Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

    4.8Medium0.3% EPSS · 1 article
  • CVE-2026-91135

    Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

    9.2Critical0.3% EPSS · 1 article
  • CVE-2026-95628

    Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

    5.4Medium0.3% EPSS · 1 article
  • CVE-2026-34033

    Apache Answer: HTML Content Injection in Email

    5.4Medium0.3% EPSS · 1 article
  • CVE-2026-71290

    Apache Software Foundation Apache HttpComponents Client vulnerability

    9.1Critical0.3% EPSS · 1 article
  • CVE-2026-59969

    Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

    Not scored0.3% EPSS · 1 article
  • CVE-2026-103552

    Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder

    7.3High0.3% EPSS · 1 article
  • CVE-2026-66084

    Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

    Not scored0.3% EPSS · 1 article
  • CVE-2026-94029

    Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

    6.5Medium0.3% EPSS · 1 article
  • CVE-2026-63772

    Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

    8.7High0.3% EPSS · 1 article
  • CVE-2026-105869

    Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

    9.2Critical0.3% EPSS · 1 article
  • CVE-2026-93994

    Apache MINA SSHD: Repeated-publickey policy bypass on server

    8.1High0.3% EPSS · 1 article
  • CVE-2026-66082

    Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

    Not scored0.3% EPSS · 1 article
  • CVE-2026-83632

    Apache Thrift: C++ THttpTransport grows its line buffer without bound

    9.2Critical0.3% EPSS · 1 article
  • CVE-2026-102795

    Apache Traffic Server: SNI to Host header matching policy is not properly enforced

    9.3Critical0.3% EPSS · 1 article

29 more CVEs are in the CVE tracker.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in