A
Vendor security profile42 actively exploited CVEs
apache
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs786
Critical159
CISA KEV42
Public exploit86
Patch rate%30
Avg. CVSS7.4
12-month vulnerability rate
2
12
7
3
6
33
30
86
172
165
88
33
CVE KEV
CVE severity distribution
786toplam CVE
Critical159 (20%)
High341 (43%)
Medium264 (34%)
Low10 (1%)
Uncertain12 (2%)
Patch and exploitation view
%30
Verified patch
%5
CISA KEV
%11
Public exploit
230Patch available
7Partial
27Workaround
1Vendor: no patch
521Unknown
Latest vulnerabilities
-
CVE-2026-107460
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
AS
Patch verified
-
CVE-2026-92120
Apache Allura: Oauth1 Replay Attack
AS
Patch status unknownEPSS %0
-
CVE-2026-92119
Apache Allura: REST API Mass Assignment
AS
Patch status unknownEPSS %0
-
CVE-2026-92116
Apache Allura: OAuth1 missing callback validation
AS
Patch status unknownEPSS %0
-
CVE-2026-85499
Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
AS
Patch status unknownEPSS %0
-
CVE-2026-103636
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103635
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103513
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103501
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
8.8
CVE-2026-103413
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
AS
Patch verifiedEPSS %0