AS
Vendor security profile4 actively exploited CVEs
Apache Software Foundation
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs614
Critical116
CISA KEV4
Public exploit16
Patch rate%35
Avg. CVSS7.5
12-month vulnerability rate
0
0
1
2
2
13
4
18
44
168
187
146
CVE KEV
CVE severity distribution
614toplam CVE
Critical116 (19%)
High289 (47%)
Medium179 (29%)
Low10 (2%)
Uncertain20 (3%)
Patch and exploitation view
%35
Verified patch
%1
CISA KEV
%3
Public exploit
212Patch available
0Partial
2Workaround
0Vendor: no patch
400Unknown
Latest vulnerabilities
-
CVE-2026-107460
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
AS
Patch verified
-
CVE-2026-92120
Apache Allura: Oauth1 Replay Attack
AS
Patch status unknownEPSS %0
-
CVE-2026-92119
Apache Allura: REST API Mass Assignment
AS
Patch status unknownEPSS %0
-
CVE-2026-92116
Apache Allura: OAuth1 missing callback validation
AS
Patch status unknown
-
CVE-2026-85499
Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
AS
Patch status unknown
-
CVE-2026-103636
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103635
Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103513
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
-
CVE-2026-103501
Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch
AS
Patch status unknownEPSS %0
8.8
CVE-2026-103413
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
AS
Patch verifiedEPSS %0