CVE Tools
Track your stack

Apache

3,150 CVEs tracked since 1999. Since Oct 2021, 19 of them reached CISA KEV.

Apache CVEs per month

Oct 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-10152
2021-11240
2021-12142
2022-01320
2022-02141
2022-03120
2022-04111
2022-0590
2022-06180
2022-07131
2022-08260
2022-09260
2022-10170
2022-11270
2022-12180
2023-01250
2023-02160
2023-03no snapshot
2023-04211
2023-05311
2023-06160
2023-07290
2023-08160
2023-09170
2023-10252
2023-11260
2023-12280
2024-01150
2024-02410
2024-03280
2024-04271
2024-0581
2024-06100
2024-07461
2024-08201
2024-09141
2024-10150
2024-11260
2024-12170
2025-01160
2025-02130
2025-03231
2025-04190
2025-05150
2025-06210
2025-07240
2025-08200
2025-09100
2025-10200
2025-11190
2025-12200
2026-01220
2026-02200
2026-03200
2026-04841
2026-05800
2026-061100
2026-071160
2026-081630
2026-09590
2026-10461
2026-110

Products

The products that kept showing up in Apache's monthly top three, with their CVEs summed over those months.

  1. Airflow9817 months
  2. HTTP Server9313 months
  3. Superset5113 months
  4. Camel453 months
  5. Cloudstack427 months
  6. Traffic Server429 months
  7. Tomcat3610 months
  8. Ofbiz274 months
  9. Cxf253 months
  10. Inlong256 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache.

  1. CVE-2026-59267Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption7.8
  2. CVE-2026-90632Apache OpenOffice: Local file inclusion via GStreamer plugin5.5
  3. CVE-2026-90634Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files7.3
  4. CVE-2026-90631Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables3.3
  5. CVE-2026-90629Apache OpenOffice: Out of bounds memory access during WMF import7.3
  6. CVE-2026-90628Apache OpenOffice: Stack overflow in CFF hint handling7.3
  7. CVE-2026-90627Apache OpenOffice: Local file inclusion via SQL provider and flat file database references5.5
  8. CVE-2026-90626Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files7.3
  9. CVE-2026-90624Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability7.3
  10. CVE-2026-59268Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader7.3
  11. CVE-2026-59264Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer7.8
  12. CVE-2026-59263Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.5.5
  13. CVE-2026-64618Apache Fineract: SQL injection vulnerability in Search API9.8
  14. CVE-2026-65874Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints8.8
  15. CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)5.4

The record

Peak rank
#3 in Jan 2012
Busiest month shown
Aug 2026, 163 CVEs
Months with a KEV entry
16 since Oct 2021
Monthly snapshots
262 since 1999
Apache's full record, month by month