Skip to content

Vendor

Apache

Alert
No CISA KEV deadline is open. CISA last added an Apache CVE on 8 Oct.

Tracked since 22 Jan · latest article 26 Oct · RSS · API

That product is not in Apache’s coverage, so the whole vendor is shown.

0Open KEV deadlines

None open

2Added to KEV · 90 days

of 41 in the full CISA catalogue · all time

4High exploit odds · current

EPSS top 5%, not in KEV

8Articles · 7 days

usual rate

Exploited, by due date41

Apache CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Apache CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2016-3081Struts8 OctPassed 11 Oct5
In CISA KEVCVE-2026-34486Tomcat4 AugPassed 7 Aug7
In CISA KEVCVE-2026-34197ActiveMQ16 AprPassed 30 Apr2
In CISA KEVCVE-2024-38475HTTP Server1 MayPassed 22 May–
In CISA KEVCVE-2025-24813Tomcat1 AprPassed 22 Apr–
In CISA KEVCVE-2024-45195OFBiz4 FebPassed 25 Feb–
Show 35 moreCSV of 41 entries

Patch cadence and exploit odds

How often CISA adds Apache CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

1Q1 ’252Q2 ’250Q3 ’250Q4 ’250Q1 ’261Q2 ’261Q3 ’261Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20251
Q2 20252
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20261
Q4 20261

Fix listed

206 of 213 CVEs in coverage

7 CVEs have no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV. The 200 most relevant of 213 are drawn.

top 5%CVE-2017-5638: 100th percentile, in CISA KEVCVE-2023-46604: 100th percentile, in CISA KEVCVE-2026-34486: 99.9th percentile, in CISA KEVCVE-2026-34197: 99.9th percentile, in CISA KEVCVE-2016-3081: 99.9th percentile, in CISA KEVCVE-2025-66516: 99.8th percentileCVE-2022-41678: 99.7th percentileCVE-2019-17571: 99.4th percentileCVE-2026-23918: 98.9th percentileCVE-2024-32114: 94.2th percentileCVE-2026-44825: 90.3th percentileCVE-2026-35152: 88.4th percentileCVE-2026-55957: 86.6th percentileCVE-2026-23795: 79.8th percentileCVE-2026-57967: 73.5th percentileCVE-2026-104711: 72.2th percentileCVE-2026-28780: 71.9th percentileCVE-2026-50633: 69.7th percentileCVE-2026-34355: 67th percentileCVE-2026-23906: 66.3th percentileCVE-2026-42253: 65.6th percentileCVE-2026-80351: 63th percentileCVE-2026-63292: 60.9th percentileCVE-2025-27821: 59.6th percentileCVE-2026-54428: 58.6th percentileCVE-2026-67593: 58.2th percentileCVE-2026-104712: 57.7th percentileCVE-2026-80352: 57.5th percentileCVE-2026-57308: 57.3th percentileCVE-2026-49362: 57th percentileCVE-2026-63043: 56.6th percentileCVE-2026-24343: 56.2th percentileCVE-2026-87976: 56th percentileCVE-2026-59878: 55.7th percentileCVE-2026-54399: 55.6th percentileCVE-2026-45249: 54.6th percentileCVE-2026-58319: 54.6th percentileCVE-2026-41871: 54.5th percentileCVE-2026-57821: 54.4th percentileCVE-2026-42588: 54.3th percentileCVE-2026-24012: 54.3th percentileCVE-2026-68981: 54.3th percentileCVE-2026-92414: 53.8th percentileCVE-2026-47430: 53.7th percentileCVE-2026-50112: 53.7th percentileCVE-2026-34356: 53.2th percentileCVE-2026-50628: 53.1th percentileCVE-2026-57822: 53.1th percentileCVE-2026-105944: 53th percentileCVE-2026-73633: 52.8th percentileCVE-2026-82428: 52.6th percentileCVE-2026-24014: 52.5th percentileCVE-2026-62183: 52.5th percentileCVE-2026-24735: 52.4th percentileCVE-2026-63038: 52.4th percentileCVE-2026-24656: 52.2th percentileCVE-2026-77791: 52.1th percentileCVE-2026-45360: 52th percentileCVE-2026-31377: 51.8th percentileCVE-2026-90797: 51.7th percentileCVE-2026-41870: 51.5th percentileCVE-2026-24072: 51.1th percentileCVE-2026-56287: 51th percentileCVE-2026-90799: 50.6th percentileCVE-2026-24013: 50.2th percentileCVE-2026-39999: 50.2th percentileCVE-2026-90800: 50th percentileCVE-2026-29168: 49.8th percentileCVE-2026-91012: 49.8th percentileCVE-2026-101296: 49.8th percentileCVE-2026-70469: 49.5th percentileCVE-2026-65637: 49th percentileCVE-2026-86471: 48.7th percentileCVE-2026-92142: 48.6th percentileCVE-2026-79993: 48.5th percentileCVE-2026-82232: 48.5th percentileCVE-2026-45505: 48.4th percentileCVE-2026-94134: 48.4th percentileCVE-2026-49844: 48.1th percentileCVE-2026-107755: 48.1th percentileCVE-2026-29169: 48.1th percentileCVE-2026-59265: 47.8th percentileCVE-2026-103119: 47.7th percentileCVE-2026-88920: 47.6th percentileCVE-2026-76646: 47.5th percentileCVE-2026-57866: 47.2th percentileCVE-2026-48207: 47.1th percentileCVE-2026-57941: 47th percentileCVE-2026-76183: 46.7th percentileCVE-2026-49364: 46.7th percentileCVE-2026-54475: 46.6th percentileCVE-2025-66336: 46.4th percentileCVE-2026-104713: 46.3th percentileCVE-2026-59739: 45.9th percentileCVE-2026-92415: 45.7th percentileCVE-2026-91048: 45.4th percentileCVE-2026-54048: 45.4th percentileCVE-2026-87022: 45.1th percentileCVE-2026-65182: 45.1th percentileCVE-2026-56154: 44.9th percentileCVE-2026-49328: 44.9th percentileCVE-2026-65181: 44.7th percentileCVE-2026-92560: 44.5th percentileCVE-2026-104714: 44.3th percentileCVE-2025-48977: 44.3th percentileCVE-2026-50076: 43.9th percentileCVE-2026-49875: 43.7th percentileCVE-2026-103412: 43.6th percentileCVE-2026-33007: 43.5th percentileCVE-2026-23794: 43.4th percentileCVE-2026-49268: 43.4th percentileCVE-2026-73470: 43.4th percentileCVE-2026-47065: 42.8th percentileCVE-2026-63044: 42.8th percentileCVE-2026-78383: 42.6th percentileCVE-2026-101356: 42.5th percentileCVE-2026-80354: 42.4th percentileCVE-2026-86248: 42.2th percentileCVE-2026-105945: 42.2th percentileCVE-2026-68525: 41.9th percentileCVE-2026-108089: 41.8th percentileCVE-2026-111813: 41.8th percentileCVE-2026-47321: 41.7th percentileCVE-2026-59797: 41.5th percentileCVE-2026-92564: 41.4th percentileCVE-2026-92550: 41.4th percentileCVE-2026-46752: 41.2th percentileCVE-2026-33582: 41.1th percentileCVE-2026-103877: 40.3th percentileCVE-2026-92608: 40.3th percentileCVE-2026-59685: 40th percentileCVE-2026-64607: 40th percentileCVE-2026-80181: 39.4th percentileCVE-2026-61487: 39.4th percentileCVE-2026-56207: 39.4th percentileCVE-2026-62354: 39.1th percentileCVE-2026-77147: 38.9th percentileCVE-2026-96443: 38.8th percentileCVE-2026-25700: 38.7th percentileCVE-2026-73635: 38.3th percentileCVE-2026-49157: 38th percentileCVE-2026-84179: 37.6th percentileCVE-2026-92609: 37.5th percentileCVE-2026-73178: 37.2th percentileCVE-2026-61373: 37th percentileCVE-2026-102731: 37th percentileCVE-2026-93546: 36.9th percentileCVE-2026-87779: 36.5th percentileCVE-2026-81270: 36.5th percentileCVE-2026-73634: 36.5th percentileCVE-2026-82426: 36.4th percentileCVE-2026-42356: 36.3th percentileCVE-2026-63772: 35.8th percentileCVE-2026-64959: 35.6th percentileCVE-2026-42528: 34.9th percentileCVE-2026-95616: 34.9th percentileCVE-2026-25699: 34.7th percentileCVE-2026-25688: 34.6th percentileCVE-2026-92573: 34.5th percentileCVE-2026-77185: 34.3th percentileCVE-2026-103413: 32.8th percentileCVE-2026-94135: 31.7th percentileCVE-2026-73631: 31.3th percentileCVE-2026-73632: 31.2th percentileCVE-2026-91085: 31.1th percentileCVE-2026-96806: 31th percentileCVE-2026-83632: 30.6th percentileCVE-2026-94052: 30.3th percentileCVE-2026-41566: 30th percentileCVE-2026-94053: 29.8th percentileCVE-2026-73236: 29.5th percentileCVE-2026-94002: 29.4th percentileCVE-2026-111811: 29.1th percentileCVE-2026-91135: 27.1th percentileCVE-2026-95628: 26.7th percentileCVE-2026-34033: 26.6th percentileCVE-2026-71290: 26th percentileCVE-2026-59969: 25.9th percentileCVE-2026-103552: 25.5th percentileCVE-2026-66084: 25.4th percentileCVE-2026-86249: 25.3th percentileCVE-2026-94029: 24.8th percentileCVE-2026-86350: 23th percentileCVE-2026-105869: 22.9th percentileCVE-2026-93994: 22.8th percentileCVE-2026-95664: 22.6th percentileCVE-2026-66082: 22.5th percentileCVE-2026-102795: 20.6th percentileCVE-2026-50634: 19.9th percentileCVE-2026-66087: 19.9th percentileCVE-2026-58663: 19.8th percentileCVE-2026-48830: 18th percentileCVE-2026-80180: 17.9th percentileCVE-2026-78334: 17.7th percentileCVE-2026-71896: 17.3th percentileCVE-2026-80190: 17.2th percentileCVE-2026-59229: 17th percentileCVE-2026-78437: 16.7th percentileCVE-2026-95663: 15.5th percentileCVE-2026-105937: 15.4th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2017-5638100
CVE-2023-46604100
CVE-2026-3448699.9
CVE-2026-3419799.9
CVE-2016-308199.9
CVE-2025-6651699.8
CVE-2022-4167899.7
CVE-2019-1757199.4
CVE-2026-2391898.9
CVE-2024-3211494.2
CVE-2026-4482590.3
CVE-2026-3515288.4
CVE-2026-5595786.6
CVE-2026-2379579.8
CVE-2026-5796773.5
CVE-2026-10471172.2
CVE-2026-2878071.9
CVE-2026-5063369.7
CVE-2026-3435567
CVE-2026-2390666.3
CVE-2026-4225365.6
CVE-2026-8035163
CVE-2026-6329260.9
CVE-2025-2782159.6
CVE-2026-5442858.6
CVE-2026-6759358.2
CVE-2026-10471257.7
CVE-2026-8035257.5
CVE-2026-5730857.3
CVE-2026-4936257
CVE-2026-6304356.6
CVE-2026-2434356.2
CVE-2026-8797656
CVE-2026-5987855.7
CVE-2026-5439955.6
CVE-2026-4524954.6
CVE-2026-5831954.6
CVE-2026-4187154.5
CVE-2026-5782154.4
CVE-2026-4258854.3
CVE-2026-2401254.3
CVE-2026-6898154.3
CVE-2026-9241453.8
CVE-2026-4743053.7
CVE-2026-5011253.7
CVE-2026-3435653.2
CVE-2026-5062853.1
CVE-2026-5782253.1
CVE-2026-10594453
CVE-2026-7363352.8
CVE-2026-8242852.6
CVE-2026-2401452.5
CVE-2026-6218352.5
CVE-2026-2473552.4
CVE-2026-6303852.4
CVE-2026-2465652.2
CVE-2026-7779152.1
CVE-2026-4536052
CVE-2026-3137751.8
CVE-2026-9079751.7
CVE-2026-4187051.5
CVE-2026-2407251.1
CVE-2026-5628751
CVE-2026-9079950.6
CVE-2026-2401350.2
CVE-2026-3999950.2
CVE-2026-9080050
CVE-2026-2916849.8
CVE-2026-9101249.8
CVE-2026-10129649.8
CVE-2026-7046949.5
CVE-2026-6563749
CVE-2026-8647148.7
CVE-2026-9214248.6
CVE-2026-7999348.5
CVE-2026-8223248.5
CVE-2026-4550548.4
CVE-2026-9413448.4
CVE-2026-4984448.1
CVE-2026-10775548.1
CVE-2026-2916948.1
CVE-2026-5926547.8
CVE-2026-10311947.7
CVE-2026-8892047.6
CVE-2026-7664647.5
CVE-2026-5786647.2
CVE-2026-4820747.1
CVE-2026-5794147
CVE-2026-7618346.7
CVE-2026-4936446.7
CVE-2026-5447546.6
CVE-2025-6633646.4
CVE-2026-10471346.3
CVE-2026-5973945.9
CVE-2026-9241545.7
CVE-2026-9104845.4
CVE-2026-5404845.4
CVE-2026-8702245.1
CVE-2026-6518245.1
CVE-2026-5615444.9
CVE-2026-4932844.9
CVE-2026-6518144.7
CVE-2026-9256044.5
CVE-2026-10471444.3
CVE-2025-4897744.3
CVE-2026-5007643.9
CVE-2026-4987543.7
CVE-2026-10341243.6
CVE-2026-3300743.5
CVE-2026-2379443.4
CVE-2026-4926843.4
CVE-2026-7347043.4
CVE-2026-4706542.8
CVE-2026-6304442.8
CVE-2026-7838342.6
CVE-2026-10135642.5
CVE-2026-8035442.4
CVE-2026-8624842.2
CVE-2026-10594542.2
CVE-2026-6852541.9
CVE-2026-10808941.8
CVE-2026-11181341.8
CVE-2026-4732141.7
CVE-2026-5979741.5
CVE-2026-9256441.4
CVE-2026-9255041.4
CVE-2026-4675241.2
CVE-2026-3358241.1
CVE-2026-10387740.3
CVE-2026-9260840.3
CVE-2026-5968540
CVE-2026-6460740
CVE-2026-8018139.4
CVE-2026-6148739.4
CVE-2026-5620739.4
CVE-2026-6235439.1
CVE-2026-7714738.9
CVE-2026-9644338.8
CVE-2026-2570038.7
CVE-2026-7363538.3
CVE-2026-4915738
CVE-2026-8417937.6
CVE-2026-9260937.5
CVE-2026-7317837.2
CVE-2026-6137337
CVE-2026-10273137
CVE-2026-9354636.9
CVE-2026-8777936.5
CVE-2026-8127036.5
CVE-2026-7363436.5
CVE-2026-8242636.4
CVE-2026-4235636.3
CVE-2026-6377235.8
CVE-2026-6495935.6
CVE-2026-4252834.9
CVE-2026-9561634.9
CVE-2026-2569934.7
CVE-2026-2568834.6
CVE-2026-9257334.5
CVE-2026-7718534.3
CVE-2026-10341332.8
CVE-2026-9413531.7
CVE-2026-7363131.3
CVE-2026-7363231.2
CVE-2026-9108531.1
CVE-2026-9680631
CVE-2026-8363230.6
CVE-2026-9405230.3
CVE-2026-4156630
CVE-2026-9405329.8
CVE-2026-7323629.5
CVE-2026-9400229.4
CVE-2026-11181129.1
CVE-2026-9113527.1
CVE-2026-9562826.7
CVE-2026-3403326.6
CVE-2026-7129026
CVE-2026-5996925.9
CVE-2026-10355225.5
CVE-2026-6608425.4
CVE-2026-8624925.3
CVE-2026-9402924.8
CVE-2026-8635023
CVE-2026-10586922.9
CVE-2026-9399422.8
CVE-2026-9566422.6
CVE-2026-6608222.5
CVE-2026-10279520.6
CVE-2026-5063419.9
CVE-2026-6608719.9
CVE-2026-5866319.8
CVE-2026-4883018
CVE-2026-8018017.9
CVE-2026-7833417.7
CVE-2026-7189617.3
CVE-2026-8019017.2
CVE-2026-5922917
CVE-2026-7843716.7
CVE-2026-9566315.5
CVE-2026-10593715.4

Coverage92 articles · all time

The latest 50 of 92 articles naming Apache, in the shared story grammar.

Full timeline
Developinglatest 21 hours ago50 articles6 outlets

50 articles from 6 outlets since 4 Aug. Picked up again on 26 Oct after 3 days quiet.

Now4 Aug141924304813182329481318First reportSecurityOnline · 4 Aug, 03:21Picked up againafter 10 days quiet
  • Tue 4 Aug, 03:21 UTC. SecurityOnline, first report. Apache NiFi flaws enable code execution and auth bypass.
  • Tue 4 Aug, 16:55 UTC. CISA, its first report on the story. CISA warns Apache Tomcat flaw CVE-2026-34486 risks data. Cites a CVE in CISA KEV.
  • Tue 4 Aug, 17:05 UTC. CISA. CISA Adds Apache Tomcat Flaw CVE-2026-34486 to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 03:51 UTC. SecurityOnline. N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 09:01 UTC. SecurityOnline. Apple tightens bug bounty amid surge of AI generated flaw reports. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 10:11 UTC. SecurityWeek, its first report on the story. CISA warns of exploits in IBM Langflow, Nable, and Tomcat flaws. Cites a CVE in CISA KEV.
  • Wed 5 Aug, 16:29 UTC. Security Affairs, its first report on the story. CISA Flags Critical Flaws in IBM Langflow, N able and Tomcat. Cites a CVE in CISA KEV.
  • Sat 15 Aug, 15:00 UTC. SecurityOnline. Apache patches five Struts 2 bugs, warns of remote DoS and leaks.
  • Tue 18 Aug, 13:41 UTC. SecurityOnline. Apache HttpClient bug lets attackers hijack traffic, update urged.
  • Thu 20 Aug, 18:02 UTC. SecurityOnline. CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.0.
  • Fri 21 Aug, 17:10 UTC. SecurityOnline. Apache CloudStack patches critical KVM RCE flaw CVE-2026-50112.
  • Fri 4 Sep, 04:35 UTC. SecurityOnline. Apache Allura Fixes Four Flaws That Could Expose Repositories.
  • Wed 9 Sep, 05:49 UTC. SecurityOnline. Apache Impala Flaws Let Attackers Seize Analytics Clusters Remotely.
  • Wed 9 Sep, 05:50 UTC. SecurityOnline. CVE-2026-41870: Unauthenticated RCE in Apache Nutch. Cites a CVE in CISA KEV.
  • Thu 10 Sep, 03:30 UTC. SecurityOnline. Apache Artemis Flaws Let Attackers Steal Sessions and Expose Credentials.
  • Fri 11 Sep, 14:42 UTC. SecurityOnline. Apache Camel K Patches Critical Flaws Enabling Code Execution.
  • Mon 14 Sep, 03:11 UTC. SecurityOnline. Apache Storm Fixes 17 Flaws Enabling Root Access and Data Theft.
  • Wed 16 Sep, 03:13 UTC. SecurityOnline. Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox Escape.
  • Wed 16 Sep, 05:00 UTC. SecurityOnline. Apache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof Logs.
  • Thu 17 Sep, 11:54 UTC. SecurityOnline. Apache Fixes NiFi Path Traversal and Denial of Service Flaws.
  • Wed 23 Sep, 17:38 UTC. SecurityOnline. Apache Doris Fixes Flaws Exposing Cluster Data and Enabling RCE.
  • Wed 23 Sep, 20:38 UTC. SecurityOnline. Apache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoS.
  • Fri 25 Sep, 19:22 UTC. SecurityOnline. Apache Qpid Broker-J Fixes Six Flaws, Including Critical Session Bug.
  • Tue 29 Sep, 05:20 UTC. SecurityOnline. Apache Karaf Flaws Let Low-Privilege Users Seize Admin Access.
  • Wed 30 Sep, 10:13 UTC. SecurityOnline. Critical Apache PLC4X Flaw Enables OPC UA Server Impersonation.
  • Thu 1 Oct, 02:13 UTC. SecurityOnline. Apache WSS4J Flaws Let Attackers Forge Authenticated Messages.
  • Thu 1 Oct, 02:13 UTC. SecurityOnline. Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.1.
  • Fri 2 Oct, 03:36 UTC. SecurityOnline. Apache Fixes 20 Flaws Including Critical mod_vhost_alias Bug.
  • Sat 3 Oct, 06:30 UTC. SecurityOnline. Apache OpenOffice Flaw Enables Code Execution Through Crafted Documents.
  • Mon 5 Oct, 12:07 UTC. SOCRadar, its first report on the story. Dark Web Claims Expose 10 Million French Records and More. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 15:35 UTC. SecurityOnline. Apache Struts fixes four flaws, including remote code execution risk.
  • Tue 6 Oct, 02:00 UTC. SecurityOnline. Apache Thrift fixes 61 flaws, including unauthenticated critical bugs.
  • Tue 6 Oct, 12:29 UTC. The Hacker News, its first report on the story. LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open.
  • Wed 7 Oct, 18:01 UTC. SecurityOnline. Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions.
  • Thu 8 Oct, 05:11 UTC. SecurityOnline. Apache DolphinScheduler Fixes Six Flaws Exposing Credentials and Data.
  • Thu 8 Oct, 18:48 UTC. The Hacker News. China-Based Hackers Accused of Stealing Emails Across 7 Countries. Cites a CVE in CISA KEV.
  • Thu 8 Oct, 19:02 UTC. CISA. CISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 07:31 UTC. SecurityOnline. CISA Flags Five Actively Exploited Flaws in Enterprise Tools. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 12:50 UTC. The Hacker News. CISA Adds Five Flaws to KEV After Flax Typhoon Attacks. Cites a CVE in CISA KEV.
  • Fri 9 Oct, 18:13 UTC. SecurityOnline. Apache Camel Karavan flaws could let attackers hijack Kubernetes deployments.
  • Sun 11 Oct, 10:01 UTC. Security Affairs. CISA Flags Five Exploited Flaws in China Linked Cyber Campaign. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 01:44 UTC. SecurityOnline. Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade.
  • Wed 21 Oct, 03:01 UTC. SecurityOnline. Apache Tomcat fixes authentication bypass and data leaks in key releases.
  • Wed 21 Oct, 06:01 UTC. SecurityOnline. Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache Warns.
  • Wed 21 Oct, 11:01 UTC. SecurityOnline. Atlassian patches 176 flaws across Jira and Confluence products.
  • Thu 22 Oct, 02:43 UTC. SecurityOnline. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant Access.
  • Thu 22 Oct, 02:43 UTC. SecurityOnline. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk.
  • Thu 22 Oct, 02:53 UTC. SecurityOnline. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoS.
  • Fri 23 Oct, 08:36 UTC. SecurityWeek. Atlassian Flags 162 High and 14 Critical Flaws in Server Products.
  • Mon 26 Oct, 03:21 UTC. SecurityOnline. Apache Camel fixes eight flaws, including an XXE vulnerability.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 50 articles as a list
  1. Tue 4 AugDay 03
    1. Apache NiFi flaws enable code execution and auth bypass03:21 · SecurityOnline · First report
    2. CISA warns Apache Tomcat flaw CVE-2026-34486 risks data16:55 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Apache Tomcat Flaw CVE-2026-34486 to KEV Catalog17:05 · CISA · official · Known exploited CVE
  2. Wed 5 AugDay 14
    1. N-able N-central Flaw Exploited in the Wild as CISA Adds Three to KEV Catalog03:51 · SecurityOnline · Known exploited CVE
    2. Apple tightens bug bounty amid surge of AI generated flaw reports09:01 · SecurityOnline · Known exploited CVE
    3. CISA warns of exploits in IBM Langflow, Nable, and Tomcat flaws10:11 · SecurityWeek · Known exploited CVE
    4. CISA Flags Critical Flaws in IBM Langflow, N able and Tomcat16:29 · Security Affairs · Known exploited CVE

  3. Quiet for 10 days

    Sat 15 AugDay 111
    1. Apache patches five Struts 2 bugs, warns of remote DoS and leaks15:00 · SecurityOnline · Picked up again

  4. Quiet for 3 days

    Tue 18 AugDay 141
    1. Apache HttpClient bug lets attackers hijack traffic, update urged13:41 · SecurityOnline · Picked up again

  5. Quiet for 2 days

    Thu 20 AugDay 161
    1. CVE-2026-63038: Apache InLong SQL Injection Flaw Patched in 2.4.018:02 · SecurityOnline · Picked up again
  6. Fri 21 AugDay 171
    1. Apache CloudStack patches critical KVM RCE flaw CVE-2026-5011217:10 · SecurityOnline

  7. Quiet for 13 days

    Fri 4 SepDay 311
    1. Apache Allura Fixes Four Flaws That Could Expose Repositories04:35 · SecurityOnline · Picked up again

  8. Quiet for 5 days

    Wed 9 SepDay 362
    1. Apache Impala Flaws Let Attackers Seize Analytics Clusters Remotely05:49 · SecurityOnline · Picked up again
    2. CVE-2026-41870: Unauthenticated RCE in Apache Nutch05:50 · SecurityOnline · Known exploited CVE
  9. Thu 10 SepDay 371
    1. Apache Artemis Flaws Let Attackers Steal Sessions and Expose Credentials03:30 · SecurityOnline
  10. Fri 11 SepDay 381
    1. Apache Camel K Patches Critical Flaws Enabling Code Execution14:42 · SecurityOnline

  11. Quiet for 3 days

    Mon 14 SepDay 411
    1. Apache Storm Fixes 17 Flaws Enabling Root Access and Data Theft03:11 · SecurityOnline · Picked up again

  12. Quiet for 2 days

    Wed 16 SepDay 432
    1. Apache Syncope Fixes Six Flaws, Including Critical SQL Injection and Sandbox Escape03:13 · SecurityOnline · Picked up again
    2. Apache ZooKeeper Flaws Let Attackers Delete Nodes and Spoof Logs05:00 · SecurityOnline
  13. Thu 17 SepDay 441
    1. Apache Fixes NiFi Path Traversal and Denial of Service Flaws11:54 · SecurityOnline

  14. Quiet for 6 days

    Wed 23 SepDay 502
    1. Apache Doris Fixes Flaws Exposing Cluster Data and Enabling RCE17:38 · SecurityOnline · Picked up again
    2. Apache Tomcat 11.0.26 Fixes 15 Flaws Enabling Request Smuggling and DoS20:38 · SecurityOnline

  15. Quiet for 2 days

    Fri 25 SepDay 521
    1. Apache Qpid Broker-J Fixes Six Flaws, Including Critical Session Bug19:22 · SecurityOnline

  16. Quiet for 3 days

    Tue 29 SepDay 561
    1. Apache Karaf Flaws Let Low-Privilege Users Seize Admin Access05:20 · SecurityOnline · Picked up again
  17. Wed 30 SepDay 571
    1. Critical Apache PLC4X Flaw Enables OPC UA Server Impersonation10:13 · SecurityOnline
  18. Thu 1 OctDay 582
    1. Apache WSS4J Flaws Let Attackers Forge Authenticated Messages02:13 · SecurityOnline
    2. Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.102:13 · SecurityOnline
  19. Fri 2 OctDay 591
    1. Apache Fixes 20 Flaws Including Critical mod_vhost_alias Bug03:36 · SecurityOnline
  20. Sat 3 OctDay 601
    1. Apache OpenOffice Flaw Enables Code Execution Through Crafted Documents06:30 · SecurityOnline

  21. Quiet for 2 days

    Mon 5 OctDay 622
    1. Dark Web Claims Expose 10 Million French Records and More12:07 · SOCRadar · Picked up again · Known exploited CVE
    2. Apache Struts fixes four flaws, including remote code execution risk15:35 · SecurityOnline
  22. Tue 6 OctDay 632
    1. Apache Thrift fixes 61 flaws, including unauthenticated critical bugs02:00 · SecurityOnline
    2. LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open12:29 · The Hacker News
  23. Wed 7 OctDay 641
    1. Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions18:01 · SecurityOnline
  24. Thu 8 OctDay 653
    1. Apache DolphinScheduler Fixes Six Flaws Exposing Credentials and Data05:11 · SecurityOnline
    2. China-Based Hackers Accused of Stealing Emails Across 7 Countries18:48 · The Hacker News · Known exploited CVE
    3. CISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching19:02 · CISA · official · Known exploited CVE
  25. Fri 9 OctDay 663
    1. CISA Flags Five Actively Exploited Flaws in Enterprise Tools07:31 · SecurityOnline · Known exploited CVE
    2. CISA Adds Five Flaws to KEV After Flax Typhoon Attacks12:50 · The Hacker News · Known exploited CVE
    3. Apache Camel Karavan flaws could let attackers hijack Kubernetes deployments18:13 · SecurityOnline

  26. Quiet for 2 days

    Sun 11 OctDay 681
    1. CISA Flags Five Exploited Flaws in China Linked Cyber Campaign10:01 · Security Affairs · Known exploited CVE

  27. Quiet for 8 days

    Mon 19 OctDay 761
    1. Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade01:44 · SecurityOnline · Picked up again

  28. Quiet for 2 days

    Wed 21 OctDay 783
    1. Apache Tomcat fixes authentication bypass and data leaks in key releases03:01 · SecurityOnline · Picked up again
    2. Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache Warns06:01 · SecurityOnline
    3. Atlassian patches 176 flaws across Jira and Confluence products11:01 · SecurityOnline
  29. Thu 22 OctDay 793
    1. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant Access02:43 · SecurityOnline
    2. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk02:43 · SecurityOnline
    3. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoS02:53 · SecurityOnline
  30. Fri 23 OctDay 801
    1. Atlassian Flags 162 High and 14 Critical Flaws in Server Products08:36 · SecurityWeek

  31. Quiet for 3 days

    Mon 26 OctDay 831
    1. Apache Camel fixes eight flaws, including an XXE vulnerability03:21 · SecurityOnline · Picked up again

All CVEs in coverage213

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2017-5638Exploited

    Apache Struts Remote Code Execution Vulnerability

    9.8Critical99.9% EPSS · 1 article
  • CVE-2023-46604Exploited

    Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

    10.0Critical99.8% EPSS · 1 article
  • CVE-2026-34486Exploited

    Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

    9.8Critical99% EPSS · 7 articles
  • CVE-2026-34197Exploited

    Apache ActiveMQ Improper Input Validation Vulnerability

    8.8High98% EPSS · 2 articles
  • CVE-2016-3081Exploited

    Apache Struts Command Injection Vulnerability

    8.1High97% EPSS · 5 articles
  • CVE-2025-66516

    Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

    Not scored89% EPSS · 1 article
  • CVE-2022-41678

    Apache Software Foundation Apache ActiveMQ vulnerability

    Not scored86% EPSS · 1 article
  • CVE-2019-17571

    Apache Software Foundation Log4j vulnerability

    Not scored70% EPSS · 2 articles
  • CVE-2026-23918

    Apache Software Foundation Apache HTTP Server vulnerability

    8.8High50% EPSS · 3 articles
  • CVE-2024-32114

    Apache Software Foundation Apache ActiveMQ vulnerability

    8.5High7.2% EPSS · 2 articles
  • CVE-2026-44825

    Apache Software Foundation Apache Solr vulnerability

    8.1High3.9% EPSS · 1 article
  • CVE-2026-35152

    Apache Software Foundation Apache Fineract vulnerability

    8.8High3.3% EPSS · 1 article
Show 188 more CVEs
  • CVE-2026-55957

    Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    7.3High2.9% EPSS · 1 article
  • CVE-2026-23795

    Apache Syncope: Console XXE on Keymaster parameters

    Not scored1.9% EPSS · 1 article
  • CVE-2026-57967

    Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

    Not scored1.5% EPSS · 1 article
  • CVE-2026-104711

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    Not scored1.4% EPSS · 1 article
  • CVE-2026-28780

    Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

    9.8Critical1.4% EPSS · 1 article
  • CVE-2026-50633

    Apache Software Foundation Apache CXF vulnerability

    8.1High1.3% EPSS · 1 article
  • CVE-2026-34355

    Apache HTTP Server: mod_proxy_html buffer overflow

    7.5High1.2% EPSS · 1 article
  • CVE-2026-23906

    Apache Druid: Authentication Bypass via LDAP Anonymous Bind

    Not scored1.1% EPSS · 1 article
  • CVE-2026-42253

    Apache Software Foundation Apache ActiveMQ vulnerability

    6.1Medium1.1% EPSS · 1 article
  • CVE-2026-80351

    Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

    9.8Critical1.0% EPSS · 1 article
  • CVE-2026-63292

    Apache HTTP Server: mod_vhost_alias stack overflow

    7.5High0.9% EPSS · 1 article
  • CVE-2025-27821

    HDFS native client: Out of bounds write in URI parser of native HDFS client

    Not scored0.9% EPSS · 1 article
  • CVE-2026-54428

    Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

    7.5High0.9% EPSS · 1 article
  • CVE-2026-67593

    Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

    Not scored0.9% EPSS · 1 article
  • CVE-2026-104712

    Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

    Not scored0.8% EPSS · 1 article
  • CVE-2026-80352

    Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

    9.8Critical0.8% EPSS · 1 article
  • CVE-2026-57308

    Apache Syncope: SQL injection vulnerability in Audit Events search

    9.8Critical0.8% EPSS · 1 article
  • CVE-2026-49362

    Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

    Not scored0.8% EPSS · 1 article
  • CVE-2026-63043

    Apache InLong: Agent path traversal via unvalidated file source path

    7.5High0.8% EPSS · 1 article
  • CVE-2026-24343

    Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions

    Not scored0.8% EPSS · 1 article
  • CVE-2026-87976

    Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

    7.2High0.8% EPSS · 1 article
  • CVE-2026-59878

    Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

    7.5High0.8% EPSS · 1 article
  • CVE-2026-54399

    Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration

    7.5High0.8% EPSS · 1 article
  • CVE-2026-45249

    Apache Software Foundation Apache ECharts vulnerability

    6.1Medium0.8% EPSS · 1 article
  • CVE-2026-58319

    Apache Software Foundation Apache Doris vulnerability

    9.1Critical0.8% EPSS · 1 article
  • CVE-2026-41871

    Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

    Not scored0.8% EPSS · 1 article
  • CVE-2026-57821

    Apache Software Foundation Apache Fineract vulnerability

    8.1High0.7% EPSS · 1 article
  • CVE-2026-42588

    Apache Software Foundation Apache ActiveMQ Broker vulnerability

    8.1High0.7% EPSS · 1 article
  • CVE-2026-24012

    Apache Software Foundation Apache IoTDB vulnerability

    7.5High0.7% EPSS · 1 article
  • CVE-2026-68981

    Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

    8.8High0.7% EPSS · 1 article
  • CVE-2026-92414

    Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

    9.3Critical0.7% EPSS · 1 article
  • CVE-2026-47430

    Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews

    9.5Critical0.7% EPSS · 1 article
  • CVE-2026-50112

    Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

    8.8High0.7% EPSS · 1 article
  • CVE-2026-34356

    Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow

    7.5High0.7% EPSS · 1 article
  • CVE-2026-50628

    Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

    9.8Critical0.7% EPSS · 0 articles
  • CVE-2026-57822

    Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

    Not scored0.7% EPSS · 1 article
  • CVE-2026-105944

    Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life

    10.0Critical0.7% EPSS · 1 article
  • CVE-2026-73633

    Apache Struts: Unbounded read of a JSON request body

    7.5High0.7% EPSS · 1 article
  • CVE-2026-82428

    Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

    Not scored0.7% EPSS · 1 article
  • CVE-2026-24014

    Apache Software Foundation Apache IoTDB vulnerability

    9.8Critical0.7% EPSS · 1 article
  • CVE-2026-62183

    Apache Syncope: User self-service privilege escalation

    9.8Critical0.7% EPSS · 1 article
  • CVE-2026-24735

    Apache Answer: Revision API Improper Access Control leads to Information Disclosure

    Not scored0.7% EPSS · 1 article
  • CVE-2026-63038

    Apache InLong: SQL Injection via String Concatenation Vulnerability Report

    9.8Critical0.7% EPSS · 1 article
  • CVE-2026-24656

    Apache Karaf: Decanter log-socket collector has deserialization vulnerability

    Not scored0.7% EPSS · 1 article
  • CVE-2026-77791

    Apache Tomcat: DoS via busy wait during WebSocket close

    7.5High0.7% EPSS · 1 article
  • CVE-2026-45360

    Apache Software Foundation Apache Airflow vulnerability

    7.3High0.7% EPSS · 1 article
  • CVE-2026-31377

    Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

    7.5High0.7% EPSS · 1 article
  • CVE-2026-90797

    Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

    7.7High0.7% EPSS · 1 article
  • CVE-2026-41870

    Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

    Not scored0.7% EPSS · 1 article
  • CVE-2026-24072

    Apache Software Foundation Apache HTTP Server vulnerability

    8.8High0.7% EPSS · 1 article
  • CVE-2026-56287

    Apache Software Foundation Apache Fineract vulnerability

    8.1High0.7% EPSS · 1 article
  • CVE-2026-90799

    Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

    1.3Low0.6% EPSS · 1 article
  • CVE-2026-24013

    Apache Software Foundation Apache IoTDB vulnerability

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-39999

    Apache APISIX: JWT Algorithm Confusion allows authentication bypass

    7.0High0.6% EPSS · 1 article
  • CVE-2026-90800

    Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

    8.1High0.6% EPSS · 1 article
  • CVE-2026-29168

    Apache HTTP Server: mod_md unrestricted OCSP response

    7.3High0.6% EPSS · 1 article
  • CVE-2026-91012

    Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

    Not scored0.6% EPSS · 1 article
  • CVE-2026-101296

    Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-70469

    Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

    Not scored0.6% EPSS · 1 article
  • CVE-2026-65637

    Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

    9.8Critical0.6% EPSS · 2 articles
  • CVE-2026-86471

    Apache CouchDB: Admin credentials leading to code execution as operating system user

    9.3Critical0.6% EPSS · 1 article
  • CVE-2026-92142

    Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

    Not scored0.6% EPSS · 1 article
  • CVE-2026-79993

    Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

    Not scored0.6% EPSS · 1 article
  • CVE-2026-82232

    Apache Syncope: SQL injection via sort parameter in Task search

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-45505

    Apache Software Foundation Apache ActiveMQ Broker vulnerability

    8.8High0.6% EPSS · 1 article
  • CVE-2026-94134

    Apache Software Foundation Apache Airflow SSH provider vulnerability

    9.1Critical0.6% EPSS · 0 articles
  • CVE-2026-49844

    Apache Software Foundation Apache Log4j API vulnerability

    6.3Medium0.6% EPSS · 1 article
  • CVE-2026-107755

    Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

    6.0Medium0.6% EPSS · 1 article
  • CVE-2026-29169

    Apache Software Foundation Apache HTTP Server vulnerability

    7.5High0.6% EPSS · 1 article
  • CVE-2026-59265

    Apache Software Foundation Apache OpenOffice vulnerability

    Not scored0.6% EPSS · 2 articles
  • CVE-2026-103119

    Apache Tomcat: AJP response mix-up

    9.1Critical0.6% EPSS · 1 article
  • CVE-2026-88920

    Apache WSS4J: SAML Sender-Vouches Authentication Bypass

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-76646

    Apache MyFaces: Denial of Service via Unbounded Request Parsing

    Not scored0.6% EPSS · 1 article
  • CVE-2026-57866

    Apache Impala: Secrets Exfiltration via SSRF

    Not scored0.6% EPSS · 1 article
  • CVE-2026-48207

    Apache Software Foundation Apache Fory vulnerability

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-57941

    Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

    9.8Critical0.6% EPSS · 1 article
  • CVE-2026-76183

    Apache Tomcat: Bypass of security constraints for WebSocket endpoints

    9.8Critical0.6% EPSS · 0 articles
  • CVE-2026-49364

    Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

    Not scored0.6% EPSS · 1 article
  • CVE-2026-54475

    Apache Software Foundation Apache ActiveMQ Broker vulnerability

    7.5High0.6% EPSS · 1 article
  • CVE-2025-66336

    Apache Doris MCP Server: SQL injection leading the authentication bypass

    8.1High0.6% EPSS · 1 article
  • CVE-2026-104713

    Apache Struts: Unbounded request body read in the REST plugin

    Not scored0.6% EPSS · 1 article
  • CVE-2026-59739

    Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

    Not scored0.6% EPSS · 1 article
  • CVE-2026-92415

    Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

    6.9Medium0.6% EPSS · 1 article
  • CVE-2026-91048

    Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

    Not scored0.5% EPSS · 1 article
  • CVE-2026-54048

    Apache Impala: Avro Schema URL Server-Side Request Forgery

    Not scored0.5% EPSS · 1 article
  • CVE-2026-87022

    Apache Tomcat: WebSocket message smuggling with per-message-deflate

    7.5High0.5% EPSS · 1 article
  • CVE-2026-65182

    Apache Tomcat: Bypass longest prefix security constraint

    9.1Critical0.5% EPSS · 2 articles
  • CVE-2026-56154

    Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

    9.8Critical0.5% EPSS · 0 articles
  • CVE-2026-49328

    Apache Software Foundation Apache Fesod (Incubating) vulnerability

    5.3Medium0.5% EPSS · 1 article
  • CVE-2026-65181

    Apache Impala: RCE via External Data Source Class Loading

    Not scored0.5% EPSS · 1 article
  • CVE-2026-92560

    Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

    7.5High0.5% EPSS · 1 article
  • CVE-2026-104714

    Apache Struts: Shared message formatter exposes date and time values across concurrent requests

    Not scored0.5% EPSS · 1 article
  • CVE-2025-48977

    Apache Software Foundation Apache Ignite vulnerability

    8.5High0.5% EPSS · 1 article
  • CVE-2026-50076

    Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass

    9.1Critical0.5% EPSS · 1 article
  • CVE-2026-49875

    Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-103412

    Apache Software Foundation Apache Camel Karavan vulnerability

    8.8High0.5% EPSS · 0 articles
  • CVE-2026-33007

    Apache Software Foundation Apache HTTP Server vulnerability

    5.3Medium0.5% EPSS · 1 article
  • CVE-2026-23794

    Apache Syncope: Reflected XSS on Enduser Login

    Not scored0.5% EPSS · 1 article
  • CVE-2026-49268

    Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    8.8High0.5% EPSS · 1 article
  • CVE-2026-73470

    Apache Syncope: Delegating users can grant unowned Roles

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-47065

    Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-63044

    Apache InLong: Authenticated SSRF via POST /api/node/testConnection

    5.4Medium0.5% EPSS · 1 article
  • CVE-2026-78383

    Apache Tomcat: AJP DoS via missing request body

    7.5High0.5% EPSS · 1 article
  • CVE-2026-101356

    Apache Tomcat: HTTP/2 request/response mix-up after error during async processing

    9.1Critical0.5% EPSS · 1 article
  • CVE-2026-80354

    Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace

    8.1High0.5% EPSS · 1 article
  • CVE-2026-86248

    Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

    9.8Critical0.5% EPSS · 1 article
  • CVE-2026-105945

    Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

    7.7High0.5% EPSS · 1 article
  • CVE-2026-68525

    Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

    9.1Critical0.5% EPSS · 2 articles
  • CVE-2026-108089

    Apache Cocoon: Unauthenticated access to diagnostic interfaces

    7.5High0.5% EPSS · 1 article
  • CVE-2026-111813

    Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

    10.0Critical0.5% EPSS · 1 article
  • CVE-2026-47321

    Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

    High0.5% EPSS · 1 article
  • CVE-2026-59797

    Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

    9.8Critical0.5% EPSS · 0 articles
  • CVE-2026-92564

    Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

    Not scored0.5% EPSS · 0 articles
  • CVE-2026-92550

    Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

    7.5High0.5% EPSS · 1 article
  • CVE-2026-46752

    Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()

    10.0Critical0.5% EPSS · 1 article
  • CVE-2026-33582

    Apache Software Foundation Apache Answer vulnerability

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-103877

    Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

    Not scored0.5% EPSS · 1 article
  • CVE-2026-92608

    Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

    7.5High0.5% EPSS · 1 article
  • CVE-2026-59685

    Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

    7.5High0.5% EPSS · 1 article
  • CVE-2026-64607

    Apache Software Foundation Apache HttpComponents Client vulnerability

    5.3Medium0.5% EPSS · 1 article
  • CVE-2026-80181

    Apache Allura: Server-side request forgery

    Not scored0.5% EPSS · 1 article
  • CVE-2026-61487

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-56207

    Apache Impala: SAML authentication bypass via forged bearer token

    Not scored0.5% EPSS · 1 article
  • CVE-2026-62354

    Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

    7.7High0.5% EPSS · 1 article
  • CVE-2026-77147

    Apache Syncope: Groovy Sandbox escape for empty CommandArgs

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-96443

    Apache Doris: JDBC driver URL validation bypass leads to remote code execution

    6.5Medium0.5% EPSS · 1 article
  • CVE-2026-25700

    Apache Software Foundation Apache Answer vulnerability

    7.2High0.5% EPSS · 1 article
  • CVE-2026-73635

    Apache Struts: Unbounded growth of localized-text caches driven by the request locale

    7.5High0.5% EPSS · 1 article
  • CVE-2026-49157

    Apache Software Foundation Apache ActiveMQ vulnerability

    8.8High0.4% EPSS · 1 article
  • CVE-2026-84179

    Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

    Not scored0.4% EPSS · 1 article
  • CVE-2026-92609

    Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

    9.8Critical0.4% EPSS · 1 article
  • CVE-2026-73178

    Apache Syncope: JWT Access Token takeover

    7.5High0.4% EPSS · 1 article
  • CVE-2026-61373

    Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

    8.7High0.4% EPSS · 1 article
  • CVE-2026-102731

    Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

    Not scored0.4% EPSS · 1 article
  • CVE-2026-93546

    Apache HTTP Server: mod_dav_fs namespace overflow

    8.8High0.4% EPSS · 1 article
  • CVE-2026-87779

    Apache Syncope: AES Secret Key disclosure via log output

    7.5High0.4% EPSS · 1 article
  • CVE-2026-81270

    Apache Allura: Information exposure via search

    7.5High0.4% EPSS · 1 article
  • CVE-2026-73634

    Apache Struts: Unbounded read of a Content Security Policy violation report

    7.5High0.4% EPSS · 1 article
  • CVE-2026-82426

    Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

    Not scored0.4% EPSS · 1 article
  • CVE-2026-42356

    Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

    3.7Low0.4% EPSS · 1 article
  • CVE-2026-63772

    Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

    8.7High0.4% EPSS · 1 article
  • CVE-2026-64959

    Apache Kylin: Missing authentication on certain cache API endpoints

    Not scored0.4% EPSS · 1 article
  • CVE-2026-42528

    Apache HTTP Server: mod_dav shared lock overflow

    4.3Medium0.4% EPSS · 1 article
  • CVE-2026-95616

    Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

    7.5High0.4% EPSS · 1 article
  • CVE-2026-25699

    Apache Software Foundation Apache Answer vulnerability

    6.1Medium0.4% EPSS · 1 article
  • CVE-2026-25688

    Apache Software Foundation Apache Answer vulnerability

    6.1Medium0.4% EPSS · 1 article
  • CVE-2026-92573

    Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

    6.5Medium0.4% EPSS · 0 articles
  • CVE-2026-77185

    Apache MINA SSHD: Asynchronous authentication can bypass signature verification

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-103413

    Apache Software Foundation Apache Camel Karavan vulnerability

    8.8High0.4% EPSS · 0 articles
  • CVE-2026-94135

    Apache Software Foundation Apache Airflow SFTP provider vulnerability

    4.3Medium0.4% EPSS · 0 articles
  • CVE-2026-73631

    Apache Struts: Shared parsing state in the JSON plugin

    4.3Medium0.4% EPSS · 1 article
  • CVE-2026-73632

    Apache Struts: Shared serialization state in the JSON plugin

    4.3Medium0.4% EPSS · 1 article
  • CVE-2026-91085

    Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

    Not scored0.4% EPSS · 1 article
  • CVE-2026-96806

    Apache Software Foundation Apache Airflow Keycloak provider vulnerability

    5.8Medium0.4% EPSS · 0 articles
  • CVE-2026-83632

    Apache Thrift: C++ THttpTransport grows its line buffer without bound

    9.2Critical0.4% EPSS · 1 article
  • CVE-2026-94052

    Apache MINA SSHD: LDAP password authentication ineffective

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-41566

    Apache Kvrocks: Improper permission for the APPLYBATCH command

    9.4Critical0.4% EPSS · 1 article
  • CVE-2026-94053

    Apache MINA SSHD: LDAP injection in sshd-ldap

    9.1Critical0.4% EPSS · 1 article
  • CVE-2026-73236

    Apache Syncope: Cross-Realm authorization bypass in delegated administration

    7.5High0.4% EPSS · 1 article
  • CVE-2026-94002

    Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

    7.5High0.4% EPSS · 1 article
  • CVE-2026-111811

    Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

    9.4Critical0.4% EPSS · 0 articles
  • CVE-2026-91135

    Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

    9.2Critical0.3% EPSS · 1 article
  • CVE-2026-95628

    Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

    Not scored0.3% EPSS · 1 article
  • CVE-2026-34033

    Apache Answer: HTML Content Injection in Email

    5.4Medium0.3% EPSS · 1 article
  • CVE-2026-71290

    Apache Software Foundation Apache HttpComponents Client vulnerability

    9.1Critical0.3% EPSS · 1 article
  • CVE-2026-59969

    Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

    Not scored0.3% EPSS · 1 article
  • CVE-2026-103552

    Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder

    7.3High0.3% EPSS · 1 article
  • CVE-2026-66084

    Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

    Not scored0.3% EPSS · 1 article
  • CVE-2026-86249

    Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

    Not scored0.3% EPSS · 1 article
  • CVE-2026-94029

    Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

    6.5Medium0.3% EPSS · 1 article
  • CVE-2026-86350

    Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

    9.1Critical0.3% EPSS · 1 article
  • CVE-2026-105869

    Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

    9.2Critical0.3% EPSS · 1 article
  • CVE-2026-93994

    Apache MINA SSHD: Repeated-publickey policy bypass on server

    8.1High0.3% EPSS · 1 article
  • CVE-2026-95664

    Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

    Not scored0.3% EPSS · 1 article
  • CVE-2026-66082

    Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

    Not scored0.3% EPSS · 1 article
  • CVE-2026-102795

    Apache Traffic Server: SNI to Host header matching policy is not properly enforced

    9.3Critical0.3% EPSS · 1 article
  • CVE-2026-50634

    Apache Software Foundation Apache CXF vulnerability

    6.5Medium0.3% EPSS · 1 article
  • CVE-2026-66087

    Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

    Not scored0.3% EPSS · 1 article
  • CVE-2026-58663

    Apache IoTDB: Auth Bypass in pipeTransfer() interface

    Not scored0.3% EPSS · 1 article
  • CVE-2026-48830

    Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests

    Not scored0.3% EPSS · 1 article
  • CVE-2026-80180

    Apache Allura: Stored XSS via markdown HTML processing

    6.1Medium0.3% EPSS · 1 article
  • CVE-2026-78334

    Apache bRPC: Missing Authentication for Streaming RPC Frames

    Not scored0.3% EPSS · 1 article
  • CVE-2026-71896

    Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

    Not scored0.3% EPSS · 1 article
  • CVE-2026-80190

    Apache Allura: Stored XSS via code repositories

    6.1Medium0.3% EPSS · 1 article
  • CVE-2026-59229

    Apache IoTDB: Legacy Pipe Privilege Escalation

    Not scored0.3% EPSS · 1 article
  • CVE-2026-78437

    Apache Tomcat: HTTP/2 DoS via malformed request

    7.3High0.3% EPSS · 1 article
  • CVE-2026-95663

    Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

    Not scored0.2% EPSS · 1 article
  • CVE-2026-105937

    Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data

    8.7High0.2% EPSS · 1 article

13 more CVEs are in the CVE tracker.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in